rules: - id: dockerfile.security.last-user-is-root.last-user-is-root patterns: - pattern: USER root - pattern-not-inside: patterns: - pattern: | USER root ... USER $X - metavariable-pattern: metavariable: $X patterns: - pattern-not: root message: The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'. severity: ERROR languages: - dockerfile metadata: cwe: - 'CWE-269: Improper Privilege Management' source-rule-url: https://github.com/hadolint/hadolint/wiki/DL3002 references: - https://github.com/hadolint/hadolint/wiki/DL3002 category: security technology: - dockerfile confidence: MEDIUM owasp: - A04:2021 - Insecure Design - A06:2025 - Insecure Design subcategory: - audit likelihood: MEDIUM impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authorization source: https://semgrep.dev/r/dockerfile.security.last-user-is-root.last-user-is-root shortlink: https://sg.run/5Z43 semgrep.dev: rule: r_id: 20147 rv_id: 1262658 rule_id: ReU2n5 version_id: 6xT29Eg url: https://semgrep.dev/playground/r/6xT29Eg/dockerfile.security.last-user-is-root.last-user-is-root origin: community - id: c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn pattern: gets(...) message: Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead. metadata: cwe: - 'CWE-676: Use of Potentially Dangerous Function' references: - https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s category: security technology: - c confidence: MEDIUM subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Dangerous Method or Function source: https://semgrep.dev/r/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn shortlink: https://sg.run/dKqX semgrep.dev: rule: r_id: 8834 rv_id: 945170 rule_id: GdU7OE version_id: YDTvRlQ url: https://semgrep.dev/playground/r/YDTvRlQ/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn origin: community languages: - c severity: ERROR - id: c.lang.security.insecure-use-printf-fn.insecure-use-printf-fn message: Avoid using user-controlled format strings passed into 'sprintf', 'printf' and 'vsprintf'. These functions put you at risk of buffer overflow vulnerabilities through the use of format string exploits. Instead, use 'snprintf' and 'vsnprintf'. metadata: cwe: - 'CWE-134: Use of Externally-Controlled Format String' references: - https://doc.castsoftware.com/display/SBX/Never+use+sprintf%28%29+or+vsprintf%28%29+functions - https://www.cvedetails.com/cwe-details/134/Uncontrolled-Format-String.html category: security technology: - c confidence: LOW subcategory: - vuln likelihood: MEDIUM impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Validation source: https://semgrep.dev/r/c.lang.security.insecure-use-printf-fn.insecure-use-printf-fn shortlink: https://sg.run/ZvJx semgrep.dev: rule: r_id: 8835 rv_id: 945172 rule_id: ReUgWx version_id: o5TZeB2 url: https://semgrep.dev/playground/r/o5TZeB2/c.lang.security.insecure-use-printf-fn.insecure-use-printf-fn origin: community languages: - c severity: WARNING patterns: - pattern-either: - pattern: | $FUNC($BUFFER, argv[$NUM], ...); ... vsprintf(..., $BUFFER, ...); - pattern: vsprintf(..., argv[$NUM], ...) - pattern: | $FUNC($BUFFER, argv[$NUM], ...); ... sprintf(..., $BUFFER, ...); - pattern: sprintf(...,argv[$NUM],...) - pattern: | $FUNC($BUFFER, argv[$NUM], ...); ... printf(..., $BUFFER, ...); - pattern: printf(...,argv[$NUM],...) - metavariable-comparison: metavariable: $NUM comparison: int($NUM) > 0 - id: c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn pattern-either: - pattern: strcat(...) - pattern: strncat(...) message: Finding triggers whenever there is a strcat or strncat used. This is an issue because strcat or strncat can lead to buffer overflow vulns. Fix this by using strcat_s instead. metadata: cwe: - 'CWE-676: Use of Potentially Dangerous Function' references: - https://nvd.nist.gov/vuln/detail/CVE-2019-12553 - https://techblog.mediaservice.net/2020/04/cve-2020-2851-stack-based-buffer-overflow-in-cde-libdtsvc/ category: security technology: - c confidence: LOW subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Dangerous Method or Function source: https://semgrep.dev/r/c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn shortlink: https://sg.run/EkRP semgrep.dev: rule: r_id: 8837 rv_id: 945174 rule_id: BYUNjA version_id: pZTNOXb url: https://semgrep.dev/playground/r/pZTNOXb/c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn origin: community languages: - c severity: WARNING - id: c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn pattern: strtok(...) message: Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. metadata: cwe: - 'CWE-676: Use of Potentially Dangerous Function' references: - https://wiki.sei.cmu.edu/confluence/display/c/STR06-C.+Do+not+assume+that+strtok%28%29+leaves+the+parse+string+unchanged - https://man7.org/linux/man-pages/man3/strtok.3.html#BUGS - https://stackoverflow.com/a/40335556 category: security technology: - c confidence: LOW subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Dangerous Method or Function source: https://semgrep.dev/r/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn shortlink: https://sg.run/LwqG semgrep.dev: rule: r_id: 8839 rv_id: 1028278 rule_id: WAUo5v version_id: qkTx1oq url: https://semgrep.dev/playground/r/qkTx1oq/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn origin: community languages: - c severity: WARNING - id: c.lang.security.double-free.double-free patterns: - pattern-not: | free($VAR); ... $VAR = NULL; ... free($VAR); - pattern-not: | free($VAR); ... $VAR = malloc(...); ... free($VAR); - pattern-inside: | free($VAR); ... $FREE($VAR); - metavariable-pattern: metavariable: $FREE pattern: free - focus-metavariable: $FREE message: Variable '$VAR' was freed twice. This can lead to undefined behavior. metadata: cwe: - 'CWE-415: Double Free' owasp: - A03:2021 - Injection - A01:2017 - Injection - A05:2025 - Injection references: - https://cwe.mitre.org/data/definitions/415.html - https://owasp.org/www-community/vulnerabilities/Doubly_freeing_memory category: security technology: - c confidence: LOW subcategory: - vuln likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Memory Issues source: https://semgrep.dev/r/c.lang.security.double-free.double-free shortlink: https://sg.run/eLl0 semgrep.dev: rule: r_id: 8832 rv_id: 1262604 rule_id: JDUyw8 version_id: RGT0L3W url: https://semgrep.dev/playground/r/RGT0L3W/c.lang.security.double-free.double-free origin: community languages: - c severity: ERROR - id: c.lang.security.use-after-free.use-after-free patterns: - pattern-either: - pattern: $VAR->$ACCESSOR - pattern: (*$VAR).$ACCESSOR - pattern: $VAR[$NUM] - pattern-inside: free($VAR); ... - pattern-not-inside: $VAR = NULL; ... - pattern-not-inside: free($VAR); ... $VAR = malloc(...); ... message: Variable '$VAR' was used after being freed. This can lead to undefined behavior. metadata: cwe: - 'CWE-416: Use After Free' references: - https://cwe.mitre.org/data/definitions/416.html - https://ctf-wiki.github.io/ctf-wiki/pwn/linux/glibc-heap/use_after_free/ category: security technology: - c confidence: LOW cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Memory Issues source: https://semgrep.dev/r/c.lang.security.use-after-free.use-after-free shortlink: https://sg.run/gL6e semgrep.dev: rule: r_id: 8841 rv_id: 945178 rule_id: KxUb9l version_id: 1QToKPy url: https://semgrep.dev/playground/r/1QToKPy/c.lang.security.use-after-free.use-after-free origin: community languages: - c severity: WARNING - id: c.lang.security.random-fd-exhaustion.random-fd-exhaustion pattern-either: - patterns: - pattern: | $FD = open("/dev/urandom", ...); ... read($FD, ...); - pattern-not: | $FD = open("/dev/urandom", ...); ... $BYTES_READ = read($FD, ...); - patterns: - pattern: | $FD = open("/dev/random", ...); ... read($FD, ...); - pattern-not: | $FD = open("/dev/random", ...); ... $BYTES_READ = read($FD, ...); message: Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' function. metadata: cwe: - 'CWE-774: Allocation of File Descriptors or Handles Without Limits or Throttling' references: - https://lwn.net/Articles/606141/ category: security technology: - c confidence: MEDIUM subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Denial-of-Service (DoS) source: https://semgrep.dev/r/c.lang.security.random-fd-exhaustion.random-fd-exhaustion shortlink: https://sg.run/8yNj semgrep.dev: rule: r_id: 8840 rv_id: 945177 rule_id: 0oU5k4 version_id: jQTzvry url: https://semgrep.dev/playground/r/jQTzvry/c.lang.security.random-fd-exhaustion.random-fd-exhaustion origin: community languages: - c severity: WARNING - id: go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection metadata: cwe: - 'CWE-300: Channel Accessible by Non-Endpoint' references: - https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption category: security technology: - grpc confidence: HIGH owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures subcategory: - audit likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Other source: https://semgrep.dev/r/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection shortlink: https://sg.run/J9yZ semgrep.dev: rule: r_id: 9090 rv_id: 1262916 rule_id: PeUZ4X version_id: YDTZeZB url: https://semgrep.dev/playground/r/YDTZeZB/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection origin: community message: 'Found an insecure gRPC connection using ''grpc.WithInsecure()''. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the ''grpc.WithTransportCredentials()'' function. You can create a create credentials using a ''tls.Config{}'' struct with ''credentials.NewTLS()''. The final fix looks like this: ''grpc.WithTransportCredentials(credentials.NewTLS())''.' languages: - go severity: ERROR pattern: $GRPC.Dial($ADDR, ..., $GRPC.WithInsecure(...), ...) fix-regex: regex: (.*)WithInsecure\(.*?\) replacement: \1WithTransportCredentials(credentials.NewTLS()) - id: go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection metadata: cwe: - 'CWE-300: Channel Accessible by Non-Endpoint' references: - https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption category: security technology: - grpc confidence: HIGH owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures subcategory: - audit likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Other source: https://semgrep.dev/r/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection shortlink: https://sg.run/5Q5l semgrep.dev: rule: r_id: 9091 rv_id: 1262917 rule_id: JDUy0B version_id: 6xT2923 url: https://semgrep.dev/playground/r/6xT2923/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection origin: community message: Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create credentials using 'credentials.NewServerTLSFromFile("cert.pem", "cert.key")'. languages: - go severity: ERROR mode: taint pattern-sinks: - requires: OPTIONS and not CREDS pattern: grpc.NewServer($OPT, ...) - requires: EMPTY_CONSTRUCTOR pattern: grpc.NewServer() pattern-sources: - label: OPTIONS pattern: grpc.ServerOption{ ... } - label: CREDS pattern: grpc.Creds(...) - label: EMPTY_CONSTRUCTOR pattern: grpc.NewServer() - id: go.jwt-go.security.jwt.hardcoded-jwt-key message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). options: interfile: true metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' references: - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures category: security technology: - jwt - secrets confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key shortlink: https://sg.run/Rod2 semgrep.dev: rule: r_id: 9093 rv_id: 1262920 rule_id: GdU7Ny version_id: pZT0305 url: https://semgrep.dev/playground/r/pZT0305/go.jwt-go.security.jwt.hardcoded-jwt-key origin: community severity: WARNING languages: - go mode: taint pattern-sources: - patterns: - pattern-inside: | []byte("$F") pattern-sinks: - patterns: - pattern-either: - pattern-inside: | $TOKEN.SignedString($F) - focus-metavariable: $F - id: go.lang.security.audit.crypto.bad_imports.insecure-module-used message: The package `net/http/cgi` is on the import blocklist. The package is vulnerable to httpoxy attacks (CVE-2015-5386). It is recommended to use `net/http` or a web framework to build a web application instead. metadata: owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' source-rule-url: https://github.com/securego/gosec references: - https://godoc.org/golang.org/x/crypto/sha3 category: security technology: - go confidence: MEDIUM subcategory: - audit likelihood: MEDIUM impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used shortlink: https://sg.run/l2gj semgrep.dev: rule: r_id: 9113 rv_id: 1262921 rule_id: yyUnov version_id: 2KTv2vJ url: https://semgrep.dev/playground/r/2KTv2vJ/go.lang.security.audit.crypto.bad_imports.insecure-module-used origin: community languages: - go severity: WARNING pattern-either: - patterns: - pattern-inside: | import "net/http/cgi" ... - pattern: | cgi.$FUNC(...) - id: go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key message: Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to fix it. metadata: cwe: - 'CWE-322: Key Exchange without Entity Authentication' owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://github.com/securego/gosec references: - https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ - https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d category: security technology: - go confidence: MEDIUM subcategory: - audit likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key shortlink: https://sg.run/Yv6X semgrep.dev: rule: r_id: 9114 rv_id: 1262922 rule_id: r6UrW9 version_id: X0TzyzN url: https://semgrep.dev/playground/r/X0TzyzN/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key origin: community languages: - go severity: WARNING pattern: ssh.InsecureIgnoreHostKey() - id: go.lang.security.audit.crypto.math_random.math-random-used metadata: cwe: - 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)' owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation category: security technology: - go confidence: MEDIUM subcategory: - vuln likelihood: MEDIUM impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used shortlink: https://sg.run/6nK6 semgrep.dev: rule: r_id: 9115 rv_id: 1262923 rule_id: bwUwy8 version_id: jQTn5nj url: https://semgrep.dev/playground/r/jQTn5nj/go.lang.security.audit.crypto.math_random.math-random-used origin: community message: Do not use `math/rand`. Use `crypto/rand` instead. languages: - go severity: WARNING patterns: - pattern-either: - pattern: | import $RAND "$MATH" - pattern: | import "$MATH" - metavariable-regex: metavariable: $MATH regex: ^(math/rand(\/v[0-9]+)*)$ - pattern-either: - pattern-inside: | ... rand.$FUNC(...) - pattern-inside: | ... $RAND.$FUNC(...) - focus-metavariable: - $MATH fix: | crypto/rand - id: go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure message: SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use 'tls.VersionTLS13'. metadata: cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go references: - https://golang.org/doc/go1.14#crypto/tls - https://www.us-cert.gov/ncas/alerts/TA14-290A category: security technology: - go confidence: HIGH subcategory: - vuln likelihood: MEDIUM impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure shortlink: https://sg.run/zvE1 semgrep.dev: rule: r_id: 9117 rv_id: 1262926 rule_id: kxUkJ2 version_id: yeTxpxj url: https://semgrep.dev/playground/r/yeTxpxj/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure origin: community languages: - go severity: WARNING fix-regex: regex: VersionSSL30 replacement: VersionTLS13 pattern: 'tls.Config{..., MinVersion: $TLS.VersionSSL30, ...}' - id: go.lang.security.audit.crypto.tls.tls-with-insecure-cipher message: Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other cipher suites to use. metadata: cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls.go references: - https://golang.org/pkg/crypto/tls/#InsecureCipherSuites category: security technology: - go confidence: HIGH subcategory: - vuln likelihood: HIGH impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher shortlink: https://sg.run/px8N semgrep.dev: rule: r_id: 9118 rv_id: 1262927 rule_id: wdUJYk version_id: rxTAKAZ url: https://semgrep.dev/playground/r/rxTAKAZ/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher origin: community languages: - go severity: WARNING pattern-either: - pattern: | tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_RC4_128_SHA, ...}} - pattern: | tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...}} - pattern: | tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_AES_128_CBC_SHA256, ...}} - pattern: | tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...}} - pattern: | tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...}} - pattern: | tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...}} - pattern: | tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...}} - pattern: | tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...}} - pattern: | tls.CipherSuite{..., TLS_RSA_WITH_RC4_128_SHA, ...} - pattern: | tls.CipherSuite{..., TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...} - pattern: | tls.CipherSuite{..., TLS_RSA_WITH_AES_128_CBC_SHA256, ...} - pattern: | tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...} - pattern: | tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...} - pattern: | tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...} - pattern: | tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...} - pattern: | tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...} - id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES message: Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use AES instead. languages: - go severity: WARNING metadata: owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' source-rule-url: https://github.com/securego/gosec#available-rules category: security technology: - go references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES shortlink: https://sg.run/jREA semgrep.dev: rule: r_id: 9121 rv_id: 1262930 rule_id: eqU8B3 version_id: kbTzGzA url: https://semgrep.dev/playground/r/kbTzGzA/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES origin: community patterns: - pattern-inside: | import "crypto/des" ... - pattern-either: - pattern: | des.NewTripleDESCipher(...) - pattern: | des.NewCipher(...) - id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. languages: - go severity: WARNING metadata: owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures cwe: - 'CWE-328: Use of Weak Hash' source-rule-url: https://github.com/securego/gosec#available-rules category: security technology: - go confidence: MEDIUM references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - vuln likelihood: MEDIUM impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Insecure Hashing Algorithm source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 shortlink: https://sg.run/2xB5 semgrep.dev: rule: r_id: 9119 rv_id: 1262928 rule_id: x8Un6q version_id: bZT535Y url: https://semgrep.dev/playground/r/bZT535Y/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 origin: community patterns: - pattern-inside: | import "crypto/md5" ... - pattern-either: - pattern: | md5.New() - pattern: | md5.Sum(...) - id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 message: Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead. languages: - go severity: WARNING metadata: owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' source-rule-url: https://github.com/securego/gosec#available-rules category: security technology: - go references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 shortlink: https://sg.run/1ZAD semgrep.dev: rule: r_id: 9122 rv_id: 1262931 rule_id: v8Unl0 version_id: w8TRoRQ url: https://semgrep.dev/playground/r/w8TRoRQ/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 origin: community patterns: - pattern-inside: | import "crypto/rc4" ... - pattern: rc4.NewCipher(...) - id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1 message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. languages: - go severity: WARNING metadata: owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures cwe: - 'CWE-328: Use of Weak Hash' source-rule-url: https://github.com/securego/gosec#available-rules category: security technology: - go references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Insecure Hashing Algorithm source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1 shortlink: https://sg.run/XBYA semgrep.dev: rule: r_id: 9120 rv_id: 1262929 rule_id: OrU31O version_id: NdTzyz1 url: https://semgrep.dev/playground/r/NdTzyz1/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1 origin: community patterns: - pattern-inside: | import "crypto/sha1" ... - pattern-either: - pattern: | sha1.New() - pattern: | sha1.Sum(...) - id: go.lang.security.audit.database.string-formatted-query.string-formatted-query languages: - go message: String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data. severity: WARNING metadata: owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' source-rule-url: https://github.com/securego/gosec category: security technology: - go confidence: LOW references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/go.lang.security.audit.database.string-formatted-query.string-formatted-query shortlink: https://sg.run/ydEr semgrep.dev: rule: r_id: 9124 rv_id: 1262937 rule_id: ZqU5bD version_id: ZRTKA2q url: https://semgrep.dev/playground/r/ZRTKA2q/go.lang.security.audit.database.string-formatted-query.string-formatted-query origin: community patterns: - metavariable-regex: metavariable: $OBJ regex: (?i).*(db|database) - pattern-not-inside: | $VAR = "..." + "..." ... $OBJ.$SINK(..., $VAR, ...) - pattern-not: $OBJ.Exec("...") - pattern-not: $OBJ.ExecContext($CTX, "...") - pattern-not: $OBJ.Query("...") - pattern-not: $OBJ.QueryContext($CTX, "...") - pattern-not: $OBJ.QueryRow("...") - pattern-not: $OBJ.QueryRow($CTX, "...") - pattern-not: $OBJ.QueryRowContext($CTX, "...") - pattern-either: - pattern: $OBJ.Exec($X + ...) - pattern: $OBJ.ExecContext($CTX, $X + ...) - pattern: $OBJ.Query($X + ...) - pattern: $OBJ.QueryContext($CTX, $X + ...) - pattern: $OBJ.QueryRow($X + ...) - pattern: $OBJ.QueryRow($CTX, $X + ...) - pattern: $OBJ.QueryRowContext($CTX, $X + ...) - pattern: $OBJ.Exec(fmt.$P("...", ...)) - pattern: $OBJ.ExecContext($CTX, fmt.$P("...", ...)) - pattern: $OBJ.Query(fmt.$P("...", ...)) - pattern: $OBJ.QueryContext($CTX, fmt.$P("...", ...)) - pattern: $OBJ.QueryRow(fmt.$P("...", ...)) - pattern: $OBJ.QueryRow($CTX, fmt.$U("...", ...)) - pattern: $OBJ.QueryRowContext($CTX, fmt.$P("...", ...)) - patterns: - pattern-either: - pattern: $QUERY = fmt.Fprintf($F, "$SQLSTR", ...) - pattern: $QUERY = fmt.Sprintf("$SQLSTR", ...) - pattern: $QUERY = fmt.Printf("$SQLSTR", ...) - pattern: $QUERY = $X + ... - pattern-either: - pattern-inside: | func $FUNC(...) { ... $OBJ.Query($QUERY, ...) ... } - pattern-inside: | func $FUNC(...) { ... $OBJ.ExecContext($CTX, $QUERY, ...) ... } - pattern-inside: | func $FUNC(...) { ... $OBJ.Exec($QUERY, ...) ... } - pattern-inside: | func $FUNC(...) { ... $OBJ.QueryRow($CTX, $QUERY) ... } - pattern-inside: | func $FUNC(...) { ... $OBJ.QueryRow($QUERY) ... } - pattern-inside: | func $FUNC(...) { ... $OBJ.QueryContext($CTX, $QUERY) ... } - pattern-inside: | func $FUNC(...) { ... $OBJ.QueryRowContext($CTX, $QUERY, ...) ... } - id: go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces message: Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string. languages: - go severity: WARNING metadata: cwe: - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control source-rule-url: https://github.com/securego/gosec category: security technology: - go confidence: HIGH references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Mishandled Sensitive Information source: https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces shortlink: https://sg.run/rdE0 semgrep.dev: rule: r_id: 9125 rv_id: 1262939 rule_id: nJUz3J version_id: ExTExoK url: https://semgrep.dev/playground/r/ExTExoK/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces origin: community pattern-either: - pattern: tls.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...) - pattern: net.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...) - pattern: tls.Listen($NETWORK, "=~/^:.*$/", ...) - pattern: net.Listen($NETWORK, "=~/^:.*$/", ...) - id: go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace message: Detected a potentially dynamic ClientTrace. This occurred because semgrep could not find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous because they deserialize function code to run when certain Request events occur, which could lead to code being run without your knowledge. Ensure that your ClientTrace is statically defined. metadata: cwe: - 'CWE-913: Improper Control of Dynamically-Managed Code Resources' owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://github.com/returntocorp/semgrep-rules/issues/518 category: security technology: - go confidence: MEDIUM subcategory: - vuln likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace shortlink: https://sg.run/kXEK semgrep.dev: rule: r_id: 9128 rv_id: 1262942 rule_id: L1Uyjp version_id: 8KT5rNv url: https://semgrep.dev/playground/r/8KT5rNv/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace origin: community patterns: - pattern-not-inside: | package $PACKAGE ... &httptrace.ClientTrace { ... } ... - pattern: httptrace.WithClientTrace($ANY, $TRACE) severity: WARNING languages: - go - id: go.lang.security.audit.net.formatted-template-string.formatted-template-string message: Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://golang.org/pkg/html/template/#HTML category: security technology: - go confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string shortlink: https://sg.run/weE0 semgrep.dev: rule: r_id: 9129 rv_id: 1262943 rule_id: 8GUjDW version_id: gETB7Pe url: https://semgrep.dev/playground/r/gETB7Pe/go.lang.security.audit.net.formatted-template-string.formatted-template-string origin: community languages: - go severity: WARNING patterns: - pattern-not: template.HTML("..." + "...") - pattern-either: - pattern: template.HTML($T + $X, ...) - pattern: template.HTML(fmt.$P("...", ...), ...) - pattern: | $T = "..." ... $T = $FXN(..., $T, ...) ... template.HTML($T, ...) - pattern: | $T = fmt.$P("...", ...) ... template.HTML($T, ...) - pattern: | $T, $ERR = fmt.$P("...", ...) ... template.HTML($T, ...) - pattern: | $T = $X + $Y ... template.HTML($T, ...) - pattern: |- $T = "..." ... $OTHER, $ERR = fmt.$P(..., $T, ...) ... template.HTML($OTHER, ...) - id: go.lang.security.audit.net.pprof.pprof-debug-exposure metadata: cwe: - 'CWE-489: Active Debug Code' owasp: A06:2017 - Security Misconfiguration source-rule-url: https://github.com/securego/gosec#available-rules references: - https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ category: security technology: - go confidence: LOW subcategory: - audit likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Active Debug Code source: https://semgrep.dev/r/go.lang.security.audit.net.pprof.pprof-debug-exposure shortlink: https://sg.run/x1Ep semgrep.dev: rule: r_id: 9130 rv_id: 945583 rule_id: gxU1Kp version_id: 9lTy168 url: https://semgrep.dev/playground/r/9lTy168/go.lang.security.audit.net.pprof.pprof-debug-exposure origin: community message: The profiling 'pprof' endpoint is automatically exposed on /debug/pprof. This could leak information about the server. Instead, use `import "net/http/pprof"`. See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ for more information and mitigation. languages: - go severity: WARNING patterns: - pattern-inside: | import _ "net/http/pprof" ... - pattern-inside: | func $ANY(...) { ... } - pattern-not-inside: | $MUX = http.NewServeMux(...) ... http.ListenAndServe($ADDR, $MUX) - pattern-not: http.ListenAndServe("=~/^localhost.*/", ...) - pattern-not: http.ListenAndServe("=~/^127[.]0[.]0[.]1.*/", ...) - pattern: http.ListenAndServe(...) - id: go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr message: Found a formatted template string passed to 'template. HTMLAttr()'. 'template.HTMLAttr()' does not escape contents. Be absolutely sure there is no user-controlled data in this template or validate and sanitize the data before passing it into the template. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://golang.org/pkg/html/template/#HTMLAttr category: security technology: - go confidence: LOW cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr shortlink: https://sg.run/OPRp semgrep.dev: rule: r_id: 9131 rv_id: 1262945 rule_id: QrUz9R version_id: 3ZT4XRr url: https://semgrep.dev/playground/r/3ZT4XRr/go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr origin: community languages: - go severity: WARNING pattern-either: - pattern: template.HTMLAttr($T + $X, ...) - pattern: template.HTMLAttr(fmt.$P("...", ...), ...) - pattern: | $T = "..." ... $T = $FXN(..., $T, ...) ... template.HTMLAttr($T, ...) - pattern: | $T = fmt.$P("...", ...) ... template.HTMLAttr($T, ...) - pattern: | $T, $ERR = fmt.$P("...", ...) ... template.HTMLAttr($T, ...) - pattern: | $T = $X + $Y ... template.HTMLAttr($T, ...) - pattern: |- $T = "..." ... $OTHER, $ERR = fmt.$P(..., $T, ...) ... template.HTMLAttr($OTHER, ...) - id: go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js message: Found a formatted template string passed to 'template.JS()'. 'template.JS()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://golang.org/pkg/html/template/#JS category: security technology: - go confidence: LOW cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js shortlink: https://sg.run/eLNl semgrep.dev: rule: r_id: 9132 rv_id: 1262946 rule_id: 3qUP8K version_id: 44TEj9E url: https://semgrep.dev/playground/r/44TEj9E/go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js origin: community languages: - go severity: WARNING pattern-either: - pattern: template.JS($T + $X, ...) - pattern: template.JS(fmt.$P("...", ...), ...) - pattern: | $T = "..." ... $T = $FXN(..., $T, ...) ... template.JS($T, ...) - pattern: | $T = fmt.$P("...", ...) ... template.JS($T, ...) - pattern: | $T, $ERR = fmt.$P("...", ...) ... template.JS($T, ...) - pattern: | $T = $X + $Y ... template.JS($T, ...) - pattern: | $T = "..." ... $OTHER, $ERR = fmt.$P(..., $T, ...) ... template.JS($OTHER, ...) - id: go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url message: Found a formatted template string passed to 'template.URL()'. 'template.URL()' does not escape contents, and this could result in XSS (cross-site scripting) and therefore confidential data being stolen. Sanitize data coming into this function or make sure that no user-controlled input is coming into the function. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://golang.org/pkg/html/template/#URL category: security technology: - go confidence: LOW cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url shortlink: https://sg.run/vzE4 semgrep.dev: rule: r_id: 9133 rv_id: 1262947 rule_id: 4bUkDW version_id: PkTR3zz url: https://semgrep.dev/playground/r/PkTR3zz/go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url origin: community languages: - go severity: WARNING pattern-either: - pattern: template.URL($T + $X, ...) - pattern: template.URL(fmt.$P("...", ...), ...) - pattern: | $T = "..." ... $T = $FXN(..., $T, ...) ... template.URL($T, ...) - pattern: | $T = fmt.$P("...", ...) ... template.URL($T, ...) - pattern: | $T, $ERR = fmt.$P("...", ...) ... template.URL($T, ...) - pattern: | $T = $X + $Y ... template.URL($T, ...) - pattern: |- $T = "..." ... $OTHER, $ERR = fmt.$P(..., $T, ...) ... template.URL($OTHER, ...) - id: go.lang.security.audit.net.use-tls.use-tls pattern: http.ListenAndServe($ADDR, $HANDLER) fix: http.ListenAndServeTLS($ADDR, certFile, keyFile, $HANDLER) metadata: cwe: - 'CWE-319: Cleartext Transmission of Sensitive Information' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://golang.org/pkg/net/http/#ListenAndServeTLS category: security technology: - go confidence: MEDIUM subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Mishandled Sensitive Information source: https://semgrep.dev/r/go.lang.security.audit.net.use-tls.use-tls shortlink: https://sg.run/dKbY semgrep.dev: rule: r_id: 9134 rv_id: 1262948 rule_id: PeUZ8X version_id: JdTzxkn url: https://semgrep.dev/playground/r/JdTzxkn/go.lang.security.audit.net.use-tls.use-tls origin: community message: Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information. languages: - go severity: WARNING - id: go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf patterns: - pattern-inside: | func $FUNC(..., $W http.ResponseWriter, ...) { ... var $TEMPLATE = "..." ... $W.Write([]byte(fmt.$PRINTF($TEMPLATE, ...)), ...) ... } - pattern-either: - pattern: | $PARAMS = r.URL.Query() ... $DATA, $ERR := $PARAMS[...] ... $INTERM = $ANYTHING(..., $DATA, ...) ... $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) - pattern: | $PARAMS = r.URL.Query() ... $DATA, $ERR := $PARAMS[...] ... $INTERM = $DATA[...] ... $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) - pattern: | $DATA, $ERR := r.URL.Query()[...] ... $INTERM = $DATA[...] ... $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) - pattern: | $DATA, $ERR := r.URL.Query()[...] ... $INTERM = $ANYTHING(..., $DATA, ...) ... $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) - pattern: | $PARAMS = r.URL.Query() ... $DATA, $ERR := $PARAMS[...] ... $W.Write([]byte(fmt.$PRINTF(..., $DATA, ...))) message: Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and should not be done. If you must do this, ensure your data is sanitized or escaped. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection category: security technology: - go confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf shortlink: https://sg.run/Zvon semgrep.dev: rule: r_id: 9135 rv_id: 1262949 rule_id: JDUyXB version_id: 5PTo1qr url: https://semgrep.dev/playground/r/5PTo1qr/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf origin: community severity: WARNING languages: - go - id: go.lang.security.audit.reflect-makefunc.reflect-makefunc message: '''reflect.MakeFunc'' detected. This will sidestep protections that are normally afforded by Go''s type system. Audit this call and be sure that user input cannot be used to affect the code generated by MakeFunc; otherwise, you will have a serious security vulnerability.' metadata: owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control cwe: - 'CWE-913: Improper Control of Dynamically-Managed Code Resources' category: security technology: - go confidence: LOW references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control subcategory: - audit likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/go.lang.security.audit.reflect-makefunc.reflect-makefunc shortlink: https://sg.run/KlPd semgrep.dev: rule: r_id: 9111 rv_id: 1262950 rule_id: 10UKGb version_id: GxTkeqB url: https://semgrep.dev/playground/r/GxTkeqB/go.lang.security.audit.reflect-makefunc.reflect-makefunc origin: community severity: ERROR pattern: reflect.MakeFunc(...) languages: - go - id: go.lang.security.audit.unsafe.use-of-unsafe-block message: Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing. languages: - go severity: WARNING metadata: cwe: - 'CWE-242: Use of Inherently Dangerous Function' source_rule_url: https://github.com/securego/gosec/blob/master/rules/unsafe.go category: security technology: - go confidence: LOW references: - https://cwe.mitre.org/data/definitions/242.html subcategory: - audit likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Dangerous Method or Function source: https://semgrep.dev/r/go.lang.security.audit.unsafe.use-of-unsafe-block shortlink: https://sg.run/qxEx semgrep.dev: rule: r_id: 9112 rv_id: 945595 rule_id: 9AU1p1 version_id: ZRT35Wd url: https://semgrep.dev/playground/r/ZRT35Wd/go.lang.security.audit.unsafe.use-of-unsafe-block origin: community pattern: unsafe.$FUNC(...) - id: go.lang.security.bad_tmp.bad-tmp-file-creation message: File creation in shared tmp directory without using `io.CreateTemp`. languages: - go severity: WARNING metadata: cwe: - 'CWE-377: Insecure Temporary File' source-rule-url: https://github.com/securego/gosec category: security technology: - go confidence: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - https://pkg.go.dev/io/ioutil#TempFile - https://pkg.go.dev/os#CreateTemp - https://github.com/securego/gosec/blob/5fd2a370447223541cddb35da8d1bc707b7bb153/rules/tempfiles.go#L67 subcategory: - audit likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Other source: https://semgrep.dev/r/go.lang.security.bad_tmp.bad-tmp-file-creation shortlink: https://sg.run/Gejn semgrep.dev: rule: r_id: 9104 rv_id: 1262965 rule_id: 6JUjnL version_id: 2KTv2pJ url: https://semgrep.dev/playground/r/2KTv2pJ/go.lang.security.bad_tmp.bad-tmp-file-creation origin: community pattern-either: - pattern: ioutil.WriteFile("=~//tmp/.*$/", ...) - pattern: os.Create("=~//tmp/.*$/", ...) - pattern: os.WriteFile("=~//tmp/.*$/", ...) - id: go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb message: 'Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. ' severity: WARNING languages: - go patterns: - pattern-either: - pattern: io.Copy(...) - pattern: io.CopyBuffer(...) - pattern-either: - pattern-inside: | gzip.NewReader(...) ... - pattern-inside: | zlib.NewReader(...) ... - pattern-inside: | zlib.NewReaderDict(...) ... - pattern-inside: | bzip2.NewReader(...) ... - pattern-inside: | flate.NewReader(...) ... - pattern-inside: | flate.NewReaderDict(...) ... - pattern-inside: | lzw.NewReader(...) ... - pattern-inside: | tar.NewReader(...) ... - pattern-inside: | zip.NewReader(...) ... - pattern-inside: | zip.OpenReader(...) ... fix-regex: regex: (.*)(Copy|CopyBuffer)\((.*?),(.*?)(\)|,.*\)) replacement: \1CopyN(\3, \4, 1024*1024*256) metadata: cwe: - 'CWE-400: Uncontrolled Resource Consumption' source-rule-url: https://github.com/securego/gosec references: - https://golang.org/pkg/io/#CopyN - https://github.com/securego/gosec/blob/master/rules/decompression-bomb.go category: security technology: - go confidence: LOW cwe2022-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Denial-of-Service (DoS) source: https://semgrep.dev/r/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb shortlink: https://sg.run/RodK semgrep.dev: rule: r_id: 9105 rv_id: 945606 rule_id: oqUeqn version_id: JdTDye5 url: https://semgrep.dev/playground/r/JdTDye5/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb origin: community - id: go.lang.security.zip.path-traversal-inside-zip-extraction message: File traversal when extracting zip archive metadata: cwe: - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' source_rule_url: https://github.com/securego/gosec/issues/205 category: security technology: - go confidence: LOW owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Path Traversal source: https://semgrep.dev/r/go.lang.security.zip.path-traversal-inside-zip-extraction shortlink: https://sg.run/Av64 semgrep.dev: rule: r_id: 9106 rv_id: 1262971 rule_id: zdUkoR version_id: rxTAK1Z url: https://semgrep.dev/playground/r/rxTAK1Z/go.lang.security.zip.path-traversal-inside-zip-extraction origin: community languages: - go severity: WARNING pattern: | reader, $ERR := zip.OpenReader($ARCHIVE) ... for _, $FILE := range reader.File { ... path := filepath.Join($TARGET, $FILE.Name) ... } - id: go.otto.security.audit.dangerous-execution.dangerous-execution message: Detected non-static script inside otto VM. Audit the input to 'VM.Run'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. metadata: cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' owasp: - A03:2021 - Injection - A05:2025 - Injection category: security technology: - otto - vm confidence: LOW references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/go.otto.security.audit.dangerous-execution.dangerous-execution shortlink: https://sg.run/4xWE semgrep.dev: rule: r_id: 9144 rv_id: 1262972 rule_id: KxUbxk version_id: bZT53ZY url: https://semgrep.dev/playground/r/bZT53ZY/go.otto.security.audit.dangerous-execution.dangerous-execution origin: community severity: ERROR patterns: - pattern-inside: | $VM = otto.New(...) ... - pattern-not: $VM.Run("...", ...) - pattern: $VM.Run(...) languages: - go - id: java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal metadata: owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control cwe: - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN references: - https://www.owasp.org/index.php/Path_Traversal category: security technology: - jax-rs cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: LOW confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Path Traversal source: https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal shortlink: https://sg.run/DoWj semgrep.dev: rule: r_id: 9152 rv_id: 1262984 rule_id: 2ZUb9l version_id: 7ZTE3KW url: https://semgrep.dev/playground/r/7ZTE3KW/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal origin: community message: Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path. severity: WARNING languages: - java pattern-either: - pattern: | $RETURNTYPE $FUNC (..., @PathParam(...) $TYPE $VAR, ...) { ... new File(..., $VAR, ...); ... } - pattern: |- $RETURNTYPE $FUNC (..., @javax.ws.rs.PathParam(...) $TYPE $VAR, ...) { ... new File(..., $VAR, ...); ... } - id: java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind metadata: cwe: - 'CWE-287: Improper Authentication' owasp: - A02:2017 - Broken Authentication - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#LDAP_ANONYMOUS category: security technology: - java references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind shortlink: https://sg.run/jR6A semgrep.dev: rule: r_id: 9165 rv_id: 1262988 rule_id: eqU8J3 version_id: QkTGqE0 url: https://semgrep.dev/playground/r/QkTGqE0/java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind origin: community message: Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information. severity: WARNING pattern: | $ENV.put($CTX.SECURITY_AUTHENTICATION, "none"); ... $DCTX = new InitialDirContext($ENV, ...); languages: - java - id: java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion metadata: cwe: - 'CWE-704: Incorrect Type Conversion or Cast' owasp: A03:2017 - Sensitive Data Exposure source-rule-url: https://find-sec-bugs.github.io/bugs.htm#BAD_HEXA_CONVERSION category: security technology: - java references: - https://cwe.mitre.org/data/definitions/704.html subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Validation source: https://semgrep.dev/r/java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion shortlink: https://sg.run/1Z7D semgrep.dev: rule: r_id: 9166 rv_id: 945646 rule_id: v8Uny0 version_id: QkTZzgy url: https://semgrep.dev/playground/r/QkTZzgy/java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion origin: community message: '''Integer.toHexString()'' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use ''String.format("%02X", ...)'' instead.' severity: WARNING languages: - java pattern: |- $X $METHOD(...) { ... MessageDigest $MD = ...; ... $MD.digest(...); ... Integer.toHexString(...); } - id: java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle message: Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' instead. metadata: cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PADDING_ORACLE references: - https://capec.mitre.org/data/definitions/463.html - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes - https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY category: security technology: - java subcategory: - audit likelihood: HIGH impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle shortlink: https://sg.run/ydxr semgrep.dev: rule: r_id: 9168 rv_id: 1262990 rule_id: ZqU5oD version_id: 44TEjbE url: https://semgrep.dev/playground/r/44TEjbE/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle origin: community severity: WARNING fix: | "AES/GCM/NoPadding" languages: - java patterns: - pattern-inside: Cipher.getInstance("=~/.*\/CBC\/PKCS5Padding/") - pattern: | "=~/.*\/CBC\/PKCS5Padding/" - id: java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call patterns: - metavariable-pattern: metavariable: $RUNTIME patterns: - pattern-either: - pattern: (java.lang.Runtime $R) - pattern: java.lang.Runtime.getRuntime(...) - pattern-either: - pattern: $RUNTIME.exec($X + $Y); - pattern: $RUNTIME.exec(String.format(...)); - pattern: $RUNTIME.loadLibrary($X + $Y); - pattern: $RUNTIME.loadLibrary(String.format(...)); - patterns: - pattern-either: - pattern: | $RUNTIME.exec("=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $ARG,...) - pattern: | $RUNTIME.exec(Arrays.asList("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$ARG,...),...) - pattern: | $RUNTIME.exec(new String[]{"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$ARG,...},...) - patterns: - pattern-either: - pattern: | $RUNTIME.exec($CMD,"-c",$ARG,...) - pattern: | $RUNTIME.exec(Arrays.asList($CMD,"-c",$ARG,...),...) - pattern: | $RUNTIME.exec(new String[]{$CMD,"-c",$ARG,...},...) - pattern-inside: | $CMD = "=~/(sh|bash|ksh|csh|tcsh|zsh)/"; ... - patterns: - pattern-either: - pattern: | $RUNTIME.exec($CMD, $EXECUTE, $ARG, ...) - pattern-inside: | $CMD = new String[]{"=~/(sh|bash|ksh|csh|tcsh|zsh)/", ...}; ... - patterns: - pattern-either: - pattern: | $RUNTIME.exec("=~/(sh|bash|ksh|csh|tcsh|zsh)/", $BASH, $ARG,...) - pattern: | $RUNTIME.exec(Arrays.asList("=~/(sh|bash|ksh|csh|tcsh|zsh)/",$BASH,$ARG,...),...) - pattern: | $RUNTIME.exec(new String[]{"=~/(sh|bash|ksh|csh|tcsh|zsh)/",$BASH,$ARG,...},...) - pattern-inside: | $BASH = new String[]{"=~/(-c)/", ...}; ... - pattern-not-inside: | $ARG = "..."; ... - pattern-not: | $RUNTIME.exec("...","...","...",...) - pattern-not: | $RUNTIME.exec(new String[]{"...","...","...",...},...) - pattern-not: | $RUNTIME.exec(Arrays.asList("...","...","...",...),...) message: A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized. metadata: cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection source-rule-url: https://find-sec-bugs.github.io/bugs.htm#COMMAND_INJECTION. category: security technology: - java references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call shortlink: https://sg.run/rd90 semgrep.dev: rule: r_id: 9169 rv_id: 1262991 rule_id: nJUzvJ version_id: PkTR3ez url: https://semgrep.dev/playground/r/PkTR3ez/java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call origin: community severity: ERROR languages: - java - id: java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly metadata: cwe: - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration source-rule-url: https://find-sec-bugs.github.io/bugs.htm#HTTPONLY_COOKIE asvs: section: 'V3: Session Management Verification Requirements' control_id: 3.4.2 Missing Cookie Attribute control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v34-cookie-based-session-management version: '4' category: security technology: - java references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cookie Security source: https://semgrep.dev/r/java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly shortlink: https://sg.run/b7Be semgrep.dev: rule: r_id: 9170 rv_id: 1262993 rule_id: EwU2z6 version_id: 5PTo17r url: https://semgrep.dev/playground/r/5PTo17r/java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly origin: community message: A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);' severity: WARNING languages: - java patterns: - pattern-not-inside: $COOKIE.setValue(""); ... - pattern-either: - pattern: $COOKIE.setHttpOnly(false); - patterns: - pattern-not-inside: $COOKIE.setHttpOnly(...); ... - pattern-not-inside: $COOKIE = ResponseCookie.from(...). ...; ... - pattern: $RESPONSE.addCookie($COOKIE); - id: java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag metadata: cwe: - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration source-rule-url: https://find-sec-bugs.github.io/bugs.htm#INSECURE_COOKIE asvs: section: 'V3: Session Management Verification Requirements' control_id: 3.4.1 Missing Cookie Attribute control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v34-cookie-based-session-management version: '4' category: security technology: - java references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cookie Security source: https://semgrep.dev/r/java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag shortlink: https://sg.run/kXoK semgrep.dev: rule: r_id: 9172 rv_id: 1262994 rule_id: L1Uyvp version_id: GxTkelB url: https://semgrep.dev/playground/r/GxTkelB/java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag origin: community message: A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);' severity: WARNING languages: - java patterns: - pattern-not-inside: $COOKIE.setValue(""); ... - pattern-either: - pattern: $COOKIE.setSecure(false); - patterns: - pattern-not-inside: $COOKIE.setSecure(...); ... - pattern-not-inside: $COOKIE = ResponseCookie.from(...). ...; ... - pattern: $RESPONSE.addCookie($COOKIE); - id: java.lang.security.audit.crlf-injection-logs.crlf-injection-logs message: When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content. metadata: cwe: - 'CWE-93: Improper Neutralization of CRLF Sequences (''CRLF Injection'')' owasp: - A03:2021 - Injection - A05:2025 - Injection source-rule-url: https://find-sec-bugs.github.io/bugs.htm#CRLF_INJECTION_LOGS category: security technology: - java references: - https://owasp.org/Top10/A03_2021-Injection subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Validation source: https://semgrep.dev/r/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs shortlink: https://sg.run/wek0 semgrep.dev: rule: r_id: 9173 rv_id: 1262995 rule_id: 8GUjwW version_id: RGT0LEr url: https://semgrep.dev/playground/r/RGT0LEr/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs origin: community severity: WARNING languages: - java patterns: - pattern-either: - patterns: - pattern-inside: | class $CLASS { ... Logger $LOG = ...; ... } - pattern-either: - pattern-inside: | $X $METHOD(...,HttpServletRequest $REQ,...) { ... } - pattern-inside: | $X $METHOD(...,ServletRequest $REQ,...) { ... } - pattern-inside: | $X $METHOD(...) { ... HttpServletRequest $REQ = ...; ... } - pattern-inside: | $X $METHOD(...) { ... ServletRequest $REQ = ...; ... } - pattern-inside: | $X $METHOD(...) { ... Logger $LOG = ...; ... HttpServletRequest $REQ = ...; ... } - pattern-inside: | $X $METHOD(...) { ... Logger $LOG = ...; ... ServletRequest $REQ = ...; ... } - pattern-either: - pattern: | String $VAL = $REQ.getParameter(...); ... $LOG.$LEVEL(<... $VAL ...>); - pattern: | String $VAL = $REQ.getParameter(...); ... $LOG.log($LEVEL,<... $VAL ...>); - pattern: | $LOG.$LEVEL(<... $REQ.getParameter(...) ...>); - pattern: | $LOG.log($LEVEL,<... $REQ.getParameter(...) ...>); - id: java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated message: DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information. metadata: functional-categories: - crypto::search::symmetric-algorithm::javax.crypto cwe: - 'CWE-326: Inadequate Encryption Strength' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#DES_USAGE asvs: section: V6 Stored Cryptography Verification Requirements control_id: 6.2.5 Insecure Algorithm control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms version: '4' references: - https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms category: security technology: - java subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated shortlink: https://sg.run/5Q73 semgrep.dev: rule: r_id: 9191 rv_id: 1262996 rule_id: PeUZNg version_id: A8TgdEn url: https://semgrep.dev/playground/r/A8TgdEn/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated origin: community severity: WARNING patterns: - pattern-either: - pattern-inside: $CIPHER.getInstance("=~/DES/.*/") - pattern-inside: $CIPHER.getInstance("DES") - pattern-either: - pattern: | "=~/DES/.*/" - pattern: | "DES" fix: | "AES/GCM/NoPadding" languages: - java - kt - id: java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated message: Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES. metadata: functional-categories: - crypto::search::symmetric-algorithm::javax.crypto cwe: - 'CWE-326: Inadequate Encryption Strength' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#TDES_USAGE references: - https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA category: security technology: - java subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated shortlink: https://sg.run/Geqn semgrep.dev: rule: r_id: 9192 rv_id: 1262997 rule_id: JDUy8J version_id: BjTkZyQ url: https://semgrep.dev/playground/r/BjTkZyQ/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated origin: community severity: WARNING patterns: - pattern-either: - pattern: | $CIPHER.getInstance("=~/DESede.*/") - pattern: | $CRYPTO.KeyGenerator.getInstance("DES") languages: - java - kt - id: java.lang.security.audit.crypto.no-null-cipher.no-null-cipher patterns: - pattern-either: - pattern: new NullCipher(...); - pattern: new javax.crypto.NullCipher(...); metadata: cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#NULL_CIPHER asvs: section: V6 Stored Cryptography Verification Requirements control_id: 6.2.5 Insecure Algorithm control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms version: '4' category: security technology: - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher shortlink: https://sg.run/AvA4 semgrep.dev: rule: r_id: 9194 rv_id: 1263001 rule_id: GdU7pw version_id: K3TKkgB url: https://semgrep.dev/playground/r/K3TKkgB/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher origin: community message: 'NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.' severity: WARNING languages: - java - id: java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector message: Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption. metadata: cwe: - 'CWE-329: Generation of Predictable IV with CBC Mode' owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#STATIC_IV asvs: section: V6 Stored Cryptography Verification Requirements control_id: 6.2.5 Insecure Algorithm control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms version: '4' references: - https://cwe.mitre.org/data/definitions/329.html category: security technology: - java subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector shortlink: https://sg.run/BkB5 semgrep.dev: rule: r_id: 9195 rv_id: 1263002 rule_id: ReUgj1 version_id: qkTR7vP url: https://semgrep.dev/playground/r/qkTR7vP/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector origin: community severity: WARNING languages: - java pattern-either: - pattern: | byte[] $IV = { ... }; ... new IvParameterSpec($IV, ...); - pattern: | class $CLASS { byte[] $IV = { ... }; ... $METHOD(...) { ... new IvParameterSpec($IV, ...); ... } } - id: java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding metadata: functional-categories: - crypto::search::mode::javax.crypto cwe: - 'CWE-326: Inadequate Encryption Strength' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#RSA_NO_PADDING references: - https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/ asvs: section: V6 Stored Cryptography Verification Requirements control_id: 6.2.5 Insecure Algorithm control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms version: '4' category: security technology: - java - kotlin subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding shortlink: https://sg.run/DoOj semgrep.dev: rule: r_id: 9196 rv_id: 1263003 rule_id: AbUzoj version_id: l4TJRpK url: https://semgrep.dev/playground/r/l4TJRpK/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding origin: community message: Using RSA without OAEP mode weakens the encryption. severity: WARNING languages: - java - kt pattern: $CIPHER.getInstance("=~/RSA/[Nn][Oo][Nn][Ee]/NoPadding/") - id: java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated metadata: cwe: - 'CWE-326: Inadequate Encryption Strength' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#DEFAULT_HTTP_CLIENT asvs: section: V9 Communications Verification Requirements control_id: 9.1.3 Weak TLS control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v91-client-communications-security-requirements version: '4' category: security technology: - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated shortlink: https://sg.run/J9Gj semgrep.dev: rule: r_id: 9202 rv_id: 1263005 rule_id: qNUj8b version_id: JdTzxnb url: https://semgrep.dev/playground/r/JdTzxnb/java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated origin: community message: DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use HttpClientBuilder instead. severity: WARNING languages: - java pattern: new DefaultHttpClient(...); fix-regex: regex: DefaultHttpClient replacement: HttpClientBuilder - id: java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier message: Insecure HostnameVerifier implementation detected. This will accept any SSL certificate with any hostname, which creates the possibility for man-in-the-middle attacks. metadata: cwe: - 'CWE-295: Improper Certificate Validation' owasp: - A03:2017 - Sensitive Data Exposure - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_HOSTNAME_VERIFIER asvs: section: V9 Communications Verification Requirements control_id: 9.2.1 Weak TLS control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements version: '4' category: security technology: - java references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier shortlink: https://sg.run/5QoD semgrep.dev: rule: r_id: 9203 rv_id: 1263006 rule_id: lBU9n8 version_id: 5PTo17W url: https://semgrep.dev/playground/r/5PTo17W/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier origin: community severity: WARNING languages: - java pattern-either: - pattern: | class $CLASS implements HostnameVerifier { ... public boolean verify(...) { return true; } } - pattern: |- new HostnameVerifier(...){ public boolean verify(...) { return true; } } - pattern: import org.apache.http.conn.ssl.NoopHostnameVerifier; - id: java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager metadata: cwe: - 'CWE-295: Improper Certificate Validation' owasp: - A03:2017 - Sensitive Data Exposure - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_TRUST_MANAGER asvs: section: V9 Communications Verification Requirements control_id: 9.2.1 Weak TLS control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements version: '4' references: - https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https category: security technology: - java subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager shortlink: https://sg.run/GePy semgrep.dev: rule: r_id: 9204 rv_id: 1263007 rule_id: YGUR9A version_id: GxTkel1 url: https://semgrep.dev/playground/r/GxTkel1/java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager origin: community message: Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for more information. severity: WARNING languages: - java patterns: - pattern-either: - pattern-inside: | class $CLASS implements X509TrustManager { ... } - pattern-inside: | new X509TrustManager() { ... } - pattern-inside: | class $CLASS implements X509ExtendedTrustManager { ... } - pattern-inside: | new X509ExtendedTrustManager() { ... } - pattern-not: public void checkClientTrusted(...) { $SOMETHING; } - pattern-not: public void checkServerTrusted(...) { $SOMETHING; } - pattern-either: - pattern: public void checkClientTrusted(...) {} - pattern: public void checkServerTrusted(...) {} - pattern: public X509Certificate[] getAcceptedIssuers(...) { return null; } - id: java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket metadata: functional-categories: - net::search::crypto-config::java.net cwe: - 'CWE-319: Cleartext Transmission of Sensitive Information' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNENCRYPTED_SOCKET asvs: section: V6 Stored Cryptography Verification Requirements control_id: 6.2.5 Insecure Algorithm control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms version: '4' category: security technology: - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Mishandled Sensitive Information source: https://semgrep.dev/r/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket shortlink: https://sg.run/W8zA semgrep.dev: rule: r_id: 9197 rv_id: 1263008 rule_id: BYUN3X version_id: RGT0LEj url: https://semgrep.dev/playground/r/RGT0LEj/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket origin: community message: Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead. severity: WARNING languages: - java pattern-either: - pattern: new ServerSocket(...) - pattern: new Socket(...) - id: java.lang.security.audit.el-injection.el-injection metadata: cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' owasp: - A03:2021 - Injection - A05:2025 - Injection source-rule-url: https://find-sec-bugs.github.io/bugs.htm#EL_INJECTION category: security technology: - java references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/java.lang.security.audit.el-injection.el-injection shortlink: https://sg.run/x1wp semgrep.dev: rule: r_id: 9174 rv_id: 1263021 rule_id: gxU1Np version_id: pZT03e1 url: https://semgrep.dev/playground/r/pZT03e1/java.lang.security.audit.el-injection.el-injection origin: community message: An expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation. severity: WARNING languages: - java patterns: - pattern-either: - pattern: | class $CLASS { ... ExpressionFactory $EF; ... $X $METHOD(...) { ... $EF.createValueExpression($CTX,$INPUT,...); ... } ... } - pattern: | class $CLASS { ... ExpressionFactory $EF = ...; ... $X $METHOD(...) { ... $EF.createValueExpression($CTX,$INPUT,...); ... } ... } - pattern: | $X $METHOD(...) { ... ExpressionFactory $EF = ...; ... $EF.createValueExpression($CTX,$INPUT,...); ... } - pattern: | $X $METHOD(...,ExpressionFactory $EF,...) { ... $EF.createValueExpression($CTX,$INPUT,...); ... } - pattern: | class $CLASS { ... ExpressionFactory $EF; ... $X $METHOD(...) { ... $EF.createMethodExpression($CTX,$INPUT,...); ... } ... } - pattern: | class $CLASS { ... ExpressionFactory $EF = ...; ... $X $METHOD(...) { ... $EF.createMethodExpression($CTX,$INPUT,...); ... } ... } - pattern: | $X $METHOD(...) { ... ExpressionFactory $EF = ...; ... $EF.createMethodExpression($CTX,$INPUT,...); ... } - pattern: | $X $METHOD(...,ExpressionFactory $EF,...) { ... $EF.createMethodExpression($CTX,$INPUT,...); ... } - pattern: | $X $METHOD(String $INPUT, ...) { ... $OBJECT.buildConstraintViolationWithTemplate($INPUT, ...); ... } - pattern-not: | $X $METHOD(...) { ... $EF.createValueExpression($CTX,"...",...); ... } - pattern-not: | $X $METHOD(...) { ... String $S = "..."; ... $EF.createValueExpression($CTX,$S,...); ... } - pattern-not: | $X $METHOD(...) { ... $EF.createMethodExpression($CTX,"...",...); ... } - pattern-not: | $X $METHOD(...) { ... String $S = "..."; ... $EF.createMethodExpression($CTX,$S,...); ... } - id: java.lang.security.audit.formatted-sql-string.formatted-sql-string metadata: cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SQL_INJECTION asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.5 Injection control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements version: '4' references: - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html - https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps - https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement category: security technology: - java cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string shortlink: https://sg.run/OPXp semgrep.dev: rule: r_id: 9175 rv_id: 1409389 rule_id: QrUzxR version_id: ExTeyBP url: https://semgrep.dev/playground/r/ExTeyBP/java.lang.security.audit.formatted-sql-string.formatted-sql-string origin: community options: taint_assume_safe_numbers: true taint_assume_safe_booleans: true message: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'. mode: taint pattern-sources: - patterns: - pattern-either: - pattern: | (HttpServletRequest $REQ) - patterns: - pattern-inside: | $ANNOT $FUNC (..., $INPUT, ...) { ... } - pattern: (String $INPUT) - focus-metavariable: $INPUT label: INPUT - patterns: - pattern-either: - pattern: $X + $INPUT - pattern: $X += $INPUT - pattern: String.format(..., $INPUT, ...) - pattern: String.join(..., $INPUT, ...) - pattern: (String $STR).concat($INPUT) - pattern: $INPUT.concat(...) - patterns: - pattern-either: - pattern: $STRB.append($INPUT) - pattern: new $STRB(..., $INPUT, ...) - metavariable-type: metavariable: $STRB type: StringBuilder label: CONCAT requires: INPUT pattern-propagators: - pattern: (StringBuffer $S).append($X) from: $X to: $S - pattern: (StringBuilder $S).append($X) from: $X to: $S pattern-sinks: - patterns: - pattern-not: $S.$SQLFUNC(<... "=~/.*TABLE *$/" ...>) - pattern-not: $S.$SQLFUNC(<... "=~/.*TABLE %s$/" ...>) - pattern-either: - pattern: (Statement $S).$SQLFUNC(...) - pattern: (PreparedStatement $P).$SQLFUNC(...) - pattern: (Connection $C).createStatement(...).$SQLFUNC(...) - pattern: (Connection $C).prepareStatement(...).$SQLFUNC(...) - pattern: (EntityManager $EM).$SQLFUNC(...) - metavariable-regex: metavariable: $SQLFUNC regex: execute|executeQuery|createQuery|query|addBatch|nativeSQL|create|prepare requires: CONCAT pattern-sanitizers: - patterns: - pattern: (CriteriaBuilder $CB).$ANY(...) severity: ERROR languages: - java - id: java.lang.security.audit.http-response-splitting.http-response-splitting metadata: cwe: - 'CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (''HTTP Request/Response Splitting'')' owasp: - A03:2021 - Injection - A05:2025 - Injection source-rule-url: https://find-sec-bugs.github.io/bugs.htm#HTTP_RESPONSE_SPLITTING references: - https://www.owasp.org/index.php/HTTP_Response_Splitting category: security technology: - java subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Validation source: https://semgrep.dev/r/java.lang.security.audit.http-response-splitting.http-response-splitting shortlink: https://sg.run/eL0l semgrep.dev: rule: r_id: 9176 rv_id: 1263023 rule_id: 3qUPyK version_id: X0Tzykw url: https://semgrep.dev/playground/r/X0Tzykw/java.lang.security.audit.http-response-splitting.http-response-splitting origin: community message: Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment is not affected by testing this yourself. severity: INFO languages: - java pattern-either: - pattern: | $VAR = $REQ.getParameter(...); ... $COOKIE = new Cookie(..., $VAR, ...); ... $RESP.addCookie($COOKIE, ...); - patterns: - pattern-inside: | $RETTYPE $FUNC(...,@PathVariable $TYPE $VAR, ...) { ... } - pattern: | $COOKIE = new Cookie(..., $VAR, ...); ... $RESP.addCookie($COOKIE, ...); - id: java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection metadata: cwe: - 'CWE-297: Improper Validation of Certificate with Host Mismatch' owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#INSECURE_SMTP_SSL category: security technology: - java references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection shortlink: https://sg.run/vzN4 semgrep.dev: rule: r_id: 9177 rv_id: 1263024 rule_id: 4bUkrW version_id: jQTn5Dv url: https://semgrep.dev/playground/r/jQTn5Dv/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection origin: community message: Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'. severity: WARNING patterns: - pattern-not-inside: | $EMAIL.setSSLCheckServerIdentity(true); ... - pattern-inside: | $EMAIL = new SimpleEmail(...); ... - pattern: $EMAIL.send(...); languages: - java - id: java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string metadata: cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SQL_INJECTION_SPRING_JDBC asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.5 Injection control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements version: '4' category: security technology: - jdbc references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string shortlink: https://sg.run/dKWY semgrep.dev: rule: r_id: 9178 rv_id: 1263026 rule_id: PeUZNX version_id: 9lT4bqk url: https://semgrep.dev/playground/r/9lT4bqk/java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string origin: community message: 'Possible JDBC injection detected. Use the parameterized query feature available in queryForObject instead of concatenating or formatting strings: ''jdbc.queryForObject("select * from table where name = ?", Integer.class, parameterName);''' patterns: - pattern-inside: | $JDBC = new JdbcTemplate(...); ... - pattern-either: - pattern: $JDBC.queryForObject($STR + $VAR, ...); - pattern: $JDBC.queryForObject(String.format(...), ...); - pattern: | String $Q = $STR + $VAR; ... $JDBC.queryForObject($Q, ...); - pattern: | String $Q = String.format(...); ... $JDBC.queryForObject($Q, ...); - pattern: | StringBuilder $Q = new StringBuilder(...); ... $Q.append($STR + $VAR); ... $JDBC.queryForObject($Q, ...); - pattern: $JDBC.queryForList($STR + $VAR); - pattern: $JDBC.queryForList(String.format(...)); - pattern: | String $Q = $STR + $VAR; ... $JDBC.queryForList($Q); - pattern: | String $Q = String.format(...); ... $JDBC.queryForList($Q); - pattern: | StringBuilder $Q = new StringBuilder(...); ... $Q.append($STR + $VAR); ... $JDBC.queryForList($Q, ...); - pattern: $JDBC.update($STR + $VAR); - pattern: $JDBC.update(String.format(...)); - pattern: | String $Q = $STR + $VAR; ... $JDBC.update($Q); - pattern: | String $Q = String.format(...); ... $JDBC.update($Q); - pattern: | StringBuilder $Q = new StringBuilder(...); ... $Q.append($STR + $VAR); ... $JDBC.update($Q, ...); - pattern: $JDBC.execute($STR + $VAR); - pattern: $JDBC.execute(String.format(...)); - pattern: | String $Q = $STR + $VAR; ... $JDBC.execute($Q); - pattern: | String $Q = String.format(...); ... $JDBC.execute($Q); - pattern: | StringBuilder $Q = new StringBuilder(...); ... $Q.append($STR + $VAR); ... $JDBC.execute($Q, ...); - pattern: $JDBC.insert($STR + $VAR); - pattern: $JDBC.insert(String.format(...)); - pattern: | String $Q = $STR + $VAR; ... $JDBC.insert($Q); - pattern: | String $Q = String.format(...); ... $JDBC.insert($Q); - pattern: | StringBuilder $Q = new StringBuilder(...); ... $Q.append($STR + $VAR); ... $JDBC.insert($Q, ...); severity: WARNING languages: - java - id: java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning metadata: owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (''LDAP Injection'')' source-rule-url: https://find-sec-bugs.github.io/bugs.htm#LDAP_ENTRY_POISONING asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.7 Injection control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements version: '4' references: - https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf - https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html category: security technology: - java subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - LDAP Injection source: https://semgrep.dev/r/java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning shortlink: https://sg.run/ZvOn semgrep.dev: rule: r_id: 9179 rv_id: 1263027 rule_id: JDUy8B version_id: yeTxpGP url: https://semgrep.dev/playground/r/yeTxpGP/java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning origin: community message: An object-returning LDAP search will allow attackers to control the LDAP response. This could lead to Remote Code Execution. severity: WARNING pattern-either: - pattern: | new SearchControls($S, $CL, $TL, $AT, true, $DEREF) - pattern: | SearchControls $VAR = new SearchControls(); ... $VAR.setReturningObjFlag(true); languages: - java - id: java.lang.security.audit.ldap-injection.ldap-injection message: Detected non-constant data passed into an LDAP query. If this data can be controlled by an external user, this is an LDAP injection. Ensure data passed to an LDAP query is not controllable; or properly sanitize the data. metadata: cwe: - 'CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (''LDAP Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection source-rule-url: https://find-sec-bugs.github.io/bugs.htm#LDAP_INJECTION asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.7 Injection control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements version: '4' category: security technology: - java references: - https://owasp.org/Top10/A03_2021-Injection subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - LDAP Injection source: https://semgrep.dev/r/java.lang.security.audit.ldap-injection.ldap-injection shortlink: https://sg.run/nd2O semgrep.dev: rule: r_id: 9180 rv_id: 1263028 rule_id: 5rUObQ version_id: rxTAKl2 url: https://semgrep.dev/playground/r/rxTAKl2/java.lang.security.audit.ldap-injection.ldap-injection origin: community severity: WARNING languages: - java patterns: - pattern-either: - pattern-inside: | $X $METHOD(...) { ... InitialDirContext $CTX = ...; ... } - pattern-inside: | $X $METHOD(...) { ... DirContext $CTX = ...; ... } - pattern-inside: | $X $METHOD(...) { ... InitialLdapContext $CTX = ...; ... } - pattern-inside: | $X $METHOD(...) { ... LdapContext $CTX = ...; ... } - pattern-inside: | $X $METHOD(...) { ... LdapCtx $CTX = ...; ... } - pattern-inside: | $X $METHOD(...) { ... EventDirContext $CTX = ...; ... } - pattern: | $X $METHOD(...) { ... $CTX.search($Y,$INPUT,...); ... } - pattern-not: | $X $METHOD(...) { ... $CTX.search($Y,"...",...); ... } - id: java.lang.security.audit.object-deserialization.object-deserialization metadata: cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#OBJECT_DESERIALIZATION references: - https://www.owasp.org/index.php/Deserialization_of_untrusted_data - https://www.oracle.com/java/technologies/javase/seccodeguide.html#8 category: security technology: - java cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/java.lang.security.audit.object-deserialization.object-deserialization shortlink: https://sg.run/Ek0A semgrep.dev: rule: r_id: 9181 rv_id: 1263030 rule_id: GdU7py version_id: NdTzyGe url: https://semgrep.dev/playground/r/NdTzyGe/java.lang.security.audit.object-deserialization.object-deserialization origin: community message: Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are not user-controlled. If this must be done, consider using HMACs to sign the data stream to make sure it is not tampered with, or consider only transmitting object fields and populating a new object. severity: WARNING languages: - java pattern: new ObjectInputStream(...); - id: java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission message: Detected file permissions that are overly permissive (read, write, and execute). It is generally a bad practices to set overly permissive file permission such as read+write+exec for all users. If the file affected is a configuration, a binary, a script or sensitive data, it can lead to privilege escalation or information leakage. Instead, follow the principle of least privilege and give users only the permissions they need. severity: WARNING languages: - java metadata: cwe: - 'CWE-276: Incorrect Default Permissions' owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control source-rule-url: https://find-sec-bugs.github.io/bugs.htm#OVERLY_PERMISSIVE_FILE_PERMISSION category: security technology: - java references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authorization source: https://semgrep.dev/r/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission shortlink: https://sg.run/LwzJ semgrep.dev: rule: r_id: 9183 rv_id: 1263032 rule_id: AbUzwB version_id: w8TRoNn url: https://semgrep.dev/playground/r/w8TRoNn/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission origin: community pattern-either: - pattern: java.nio.file.Files.setPosixFilePermissions($FILE, java.nio.file.attribute.PosixFilePermissions.fromString("=~/(^......r..$)|(^.......w.$)|(^........x$)/")); - pattern: | $TYPE $P = java.nio.file.attribute.PosixFilePermissions.fromString("=~/(^......r..$)|(^.......w.$)|(^........x$)/"); ... java.nio.file.Files.setPosixFilePermissions($FILE, $P); - pattern: | $P.add(java.nio.file.attribute.PosixFilePermission.OTHERS_READ); ... java.nio.file.Files.setPosixFilePermissions($FILE, $P); - pattern: | $P.add(java.nio.file.attribute.PosixFilePermission.OTHERS_WRITE); ... java.nio.file.Files.setPosixFilePermissions($FILE, $P); - pattern: |- $P.add(java.nio.file.attribute.PosixFilePermission.OTHERS_EXECUTE); ... java.nio.file.Files.setPosixFilePermissions($FILE, $P); - id: java.lang.security.audit.permissive-cors.permissive-cors message: https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS Permissive CORS policy will allow a malicious application to communicate with the victim application in an inappropriate way, leading to spoofing, data theft, relay and other attacks. metadata: cwe: - 'CWE-183: Permissive List of Allowed Inputs' asvs: section: 'V14: Configuration Verification Requirements' control_id: 14.4.8 Permissive CORS control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x22-V14-Config.md#v144-http-security-headers-requirements version: '4' category: security technology: - java owasp: - A04:2021 - Insecure Design - A06:2025 - Insecure Design references: - https://owasp.org/Top10/A04_2021-Insecure_Design subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Validation source: https://semgrep.dev/r/java.lang.security.audit.permissive-cors.permissive-cors shortlink: https://sg.run/8y77 semgrep.dev: rule: r_id: 9184 rv_id: 1263033 rule_id: BYUN66 version_id: xyTjz0p url: https://semgrep.dev/playground/r/xyTjz0p/java.lang.security.audit.permissive-cors.permissive-cors origin: community severity: WARNING languages: - java pattern-either: - pattern: | HttpServletResponse $RES = ...; ... $RES.addHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i"); - pattern: | HttpServletResponse $RES = ...; ... $RES.setHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i"); - pattern: | ServerHttpResponse $RES = ...; ... $RES.getHeaders().add("=~/access-control-allow-origin/i", "=~/^\*|null$/i"); - pattern: | HttpHeaders $HEADERS = ...; ... $HEADERS.set("=~/access-control-allow-origin/i", "=~/^\*|null$/i"); - pattern: | ServerWebExchange $SWE = ...; ... $SWE.getResponse().getHeaders().add("Access-Control-Allow-Origin", "*"); - pattern: | $X $METHOD(...,HttpServletResponse $RES,...) { ... $RES.addHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i"); ... } - pattern: | $X $METHOD(...,HttpServletResponse $RES,...) { ... $RES.setHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i"); ... } - pattern: | $X $METHOD(...,ServerHttpResponse $RES,...) { ... $RES.getHeaders().add("=~/access-control-allow-origin/i", "=~/^\*|null$/i"); ... } - pattern: | $X $METHOD(...,ServerWebExchange $SWE,...) { ... $SWE.getResponse().getHeaders().add("=~/access-control-allow-origin/i", "=~/^\*|null$/i"); ... } - pattern: ResponseEntity.$RES().header("=~/access-control-allow-origin/i", "=~/^\*|null$/i") - pattern: ServerResponse.$RES().header("=~/access-control-allow-origin/i", "=~/^\*|null$/i") - id: java.lang.security.audit.script-engine-injection.script-engine-injection message: Detected potential code injection using ScriptEngine. Ensure user-controlled data cannot enter '.eval()', otherwise, this is a code injection vulnerability. metadata: cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' owasp: - A03:2021 - Injection - A05:2025 - Injection source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SCRIPT_ENGINE_INJECTION category: security technology: - java references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/java.lang.security.audit.script-engine-injection.script-engine-injection shortlink: https://sg.run/gLqn semgrep.dev: rule: r_id: 9185 rv_id: 1263034 rule_id: DbUpAr version_id: O9TpxEp url: https://semgrep.dev/playground/r/O9TpxEp/java.lang.security.audit.script-engine-injection.script-engine-injection origin: community severity: WARNING languages: - java patterns: - pattern-either: - pattern-inside: | class $CLASS { ... ScriptEngine $SE; ... } - pattern-inside: | class $CLASS { ... ScriptEngine $SE = ...; ... } - pattern-inside: | $X $METHOD(...) { ... ScriptEngine $SE = ...; ... } - pattern: | $X $METHOD(...) { ... $SE.eval(...); ... } - pattern-not: | $X $METHOD(...) { ... $SE.eval("..."); ... } - pattern-not: | $X $METHOD(...) { ... String $S = "..."; ... $SE.eval($S); ... } - id: java.lang.security.audit.unvalidated-redirect.unvalidated-redirect message: Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could direct users to malicious locations. Consider using an allowlist to validate URLs. metadata: cwe: - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNVALIDATED_REDIRECT asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.1.5 Open Redirect control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation-requirements version: '4' category: security technology: - java references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control subcategory: - vuln impact: LOW likelihood: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Open Redirect source: https://semgrep.dev/r/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect shortlink: https://sg.run/Q51P semgrep.dev: rule: r_id: 9186 rv_id: 1263048 rule_id: WAUo0p version_id: PkTR329 url: https://semgrep.dev/playground/r/PkTR329/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect origin: community severity: WARNING languages: - java pattern-either: - pattern: | $X $METHOD(...,HttpServletResponse $RES,...,String $URL,...) { ... $RES.sendRedirect($URL); ... } - pattern: | $X $METHOD(...,String $URL,...,HttpServletResponse $RES,...) { ... $RES.sendRedirect($URL); ... } - pattern: | $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) { ... String $URL = $REQ.getParameter(...); ... $RES.sendRedirect($URL); ... } - pattern: | $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) { ... String $URL = $REQ.getParameter(...); ... $RES.sendRedirect($URL); ... } - pattern: | $X $METHOD(...,String $URL,...) { ... HttpServletResponse $RES = ...; ... $RES.sendRedirect($URL); ... } - pattern: | $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) { ... $RES.sendRedirect($REQ.getParameter(...)); ... } - pattern: | $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) { ... $RES.sendRedirect($REQ.getParameter(...)); ... } - pattern: | $X $METHOD(...,HttpServletResponse $RES,...,String $URL,...) { ... $RES.addHeader("Location",$URL); ... } - pattern: | $X $METHOD(...,String $URL,...,HttpServletResponse $RES,...) { ... $RES.addHeader("Location",$URL); ... } - pattern: | $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) { ... String $URL = $REQ.getParameter(...); ... $RES.addHeader("Location",$URL); ... } - pattern: | $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) { ... String $URL = $REQ.getParameter(...); ... $RES.addHeader("Location",$URL); ... } - pattern: | $X $METHOD(...,String $URL,...) { ... HttpServletResponse $RES = ...; ... $RES.addHeader("Location",$URL); ... } - pattern: | $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) { ... $RES.addHeader("Location",$REQ.getParameter(...)); ... } - pattern: |- $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) { ... $RES.addHeader("Location",$REQ.getParameter(...)); ... } - id: java.lang.security.audit.url-rewriting.url-rewriting message: URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties. metadata: cwe: - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor' owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control source-rule-url: https://find-sec-bugs.github.io/bugs.htm#URL_REWRITING category: security technology: - java references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Mishandled Sensitive Information source: https://semgrep.dev/r/java.lang.security.audit.url-rewriting.url-rewriting shortlink: https://sg.run/3x7b semgrep.dev: rule: r_id: 9187 rv_id: 1263049 rule_id: 0oU5j3 version_id: JdTzxGb url: https://semgrep.dev/playground/r/JdTzxGb/java.lang.security.audit.url-rewriting.url-rewriting origin: community severity: WARNING languages: - java pattern-either: - pattern: | $X $METHOD(...,HttpServletResponse $RES,...) { ... $RES.encodeURL(...); ... } - pattern: | $X $METHOD(...,HttpServletResponse $RES,...) { ... $RES.encodeUrl(...); ... } - pattern: | $X $METHOD(...,HttpServletResponse $RES,...) { ... $RES.encodeRedirectURL(...); ... } - pattern: | $X $METHOD(...,HttpServletResponse $RES,...) { ... $RES.encodeRedirectUrl(...); ... } - pattern: | $X $METHOD(...) { ... HttpServletResponse $RES = ...; ... $RES.encodeURL(...); ... } - pattern: | $X $METHOD(...) { ... HttpServletResponse $RES = ...; ... $RES.encodeUrl(...); ... } - pattern: | $X $METHOD(...) { ... HttpServletResponse $RES = ...; ... $RES.encodeRedirectURL(...); ... } - pattern: |- $X $METHOD(...) { ... HttpServletResponse $RES = ...; ... $RES.encodeRedirectUrl(...); ... } - id: java.lang.security.audit.weak-ssl-context.weak-ssl-context metadata: cwe: - 'CWE-326: Inadequate Encryption Strength' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source_rule_url: https://find-sec-bugs.github.io/bugs.htm#SSL_CONTEXT references: - https://tools.ietf.org/html/rfc7568 - https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html category: security technology: - java subcategory: - audit likelihood: LOW impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.weak-ssl-context.weak-ssl-context shortlink: https://sg.run/4x7E semgrep.dev: rule: r_id: 9188 rv_id: 1263050 rule_id: KxUb1k version_id: 5PTo1rW url: https://semgrep.dev/playground/r/5PTo1rW/java.lang.security.audit.weak-ssl-context.weak-ssl-context origin: community message: An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance("TLSv1.2") for the best security. severity: WARNING languages: - java patterns: - pattern-not: SSLContext.getInstance("TLSv1.3") - pattern-not: SSLContext.getInstance("TLSv1.2") - pattern: SSLContext.getInstance("...") fix-regex: regex: (.*?)\.getInstance\(.*?\) replacement: \1.getInstance("TLSv1.2") - id: java.lang.security.audit.xml-decoder.xml-decoder message: XMLDecoder should not be used to parse untrusted data. Deserializing user input can lead to arbitrary code execution. Use an alternative and explicitly disable external entities. See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html for alternatives and vulnerability prevention. metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XML_DECODER references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html category: security technology: - java cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/java.lang.security.audit.xml-decoder.xml-decoder shortlink: https://sg.run/PJjq semgrep.dev: rule: r_id: 9189 rv_id: 1263051 rule_id: qNUj3y version_id: GxTkeY1 url: https://semgrep.dev/playground/r/GxTkeY1/java.lang.security.audit.xml-decoder.xml-decoder origin: community severity: WARNING languages: - java patterns: - pattern: | $X $METHOD(...) { ... new XMLDecoder(...); ... } - pattern-not: | $X $METHOD(...) { ... new XMLDecoder("..."); ... } - pattern-not: |- $X $METHOD(...) { ... String $STR = "..."; ... new XMLDecoder($STR); ... } - id: java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure metadata: owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XSS_REQUEST_WRAPPER category: security technology: - java references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure shortlink: https://sg.run/J96Q semgrep.dev: rule: r_id: 9190 rv_id: 1263056 rule_id: lBU9Gj version_id: WrTqKGK url: https://semgrep.dev/playground/r/WrTqKGK/java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure origin: community message: It looks like you're using an implementation of XSSRequestWrapper from dzone. (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html) The XSS filtering in this code is not secure and can be bypassed by malicious actors. It is recommended to use a stack that automatically escapes in your view or templates instead of filtering yourself. severity: WARNING languages: - java pattern-either: - pattern: | class XSSRequestWrapper extends HttpServletRequestWrapper { ... } - pattern: |- $P = $X.compile("", $X.CASE_INSENSITIVE); $V = $P.matcher(...).replaceAll(""); - id: java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal metadata: cwe: - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN references: - https://www.owasp.org/index.php/Path_Traversal category: security technology: - java cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Path Traversal source: https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal shortlink: https://sg.run/oxXN semgrep.dev: rule: r_id: 9160 rv_id: 1263064 rule_id: NbUk7X version_id: zyTb2rq url: https://semgrep.dev/playground/r/zyTb2rq/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal origin: community message: Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path. mode: taint pattern-sources: - patterns: - pattern-either: - pattern: | (HttpServletRequest $REQ) - patterns: - pattern-inside: | (javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...); ... for (javax.servlet.http.Cookie $COOKIE: $COOKIES) { ... } - pattern: | $COOKIE.getValue(...) - patterns: - pattern-inside: | $TYPE[] $VALS = (HttpServletRequest $REQ).$GETFUNC(...); ... - pattern: | $PARAM = $VALS[$INDEX]; pattern-sanitizers: - pattern: org.apache.commons.io.FilenameUtils.getName(...) pattern-sinks: - patterns: - pattern-either: - pattern: | (java.io.File $FILE) = ... - pattern: | (java.io.FileOutputStream $FOS) = ... - pattern: | new java.io.FileInputStream(...) severity: ERROR languages: - java - id: java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss message: 'Cross-site scripting detected in HttpServletResponse writer with variable ''$VAR''. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: ''Encode.forHtml($VAR)''.' metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XSS_SERVLET category: security technology: - java references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss shortlink: https://sg.run/pxjN semgrep.dev: rule: r_id: 9162 rv_id: 1263066 rule_id: wdUJOk version_id: 2KTv2EG url: https://semgrep.dev/playground/r/2KTv2EG/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss origin: community severity: ERROR patterns: - pattern-inside: $TYPE $FUNC(..., HttpServletResponse $RESP, ...) { ... } - pattern-inside: $VAR = $REQ.getParameter(...); ... - pattern-either: - pattern: $RESP.getWriter(...).write(..., $VAR, ...); - pattern: | $WRITER = $RESP.getWriter(...); ... $WRITER.write(..., $VAR, ...); languages: - java - id: java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled severity: ERROR metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf category: security technology: - java cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled shortlink: https://sg.run/2x75 semgrep.dev: rule: r_id: 9163 rv_id: 1263068 rule_id: x8Unkq version_id: jQTn5Jv url: https://semgrep.dev/playground/r/jQTn5Jv/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled origin: community message: XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity attacks. Disable external entities by setting "javax.xml.stream.isSupportingExternalEntities" to false. patterns: - pattern-either: - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty("javax.xml.stream.isSupportingExternalEntities", true); - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, true); - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.SUPPORT_DTD, true); - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty("javax.xml.stream.isSupportingExternalEntities", Boolean.TRUE); - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.TRUE); - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.SUPPORT_DTD, Boolean.TRUE); languages: - java - id: java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe severity: WARNING metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser category: security technology: - java cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe shortlink: https://sg.run/XBwA semgrep.dev: rule: r_id: 9164 rv_id: 1263069 rule_id: OrU35O version_id: 1QTypQZ url: https://semgrep.dev/playground/r/1QTypQZ/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe origin: community message: XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting "javax.xml.stream.isSupportingExternalEntities" to false. patterns: - pattern-not-inside: | $METHOD(...) { ... $XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", false); ... } - pattern-not-inside: | $METHOD(...) { ... $XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); ... } - pattern-not-inside: | $METHOD(...) { ... $XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", Boolean.FALSE); ... } - pattern-not-inside: | $METHOD(...) { ... $XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE); ... } - pattern-either: - pattern: javax.xml.stream.XMLInputFactory.newFactory(...) - pattern: new XMLInputFactory(...) languages: - java - id: java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization severity: ERROR metadata: cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://frohoff.github.io/appseccali-marshalling-pickles/ - https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi - https://youtu.be/t_aw1mDNhzI - https://github.com/qtc-de/remote-method-guesser - https://github.com/openjdk/jdk/blob/master/src/java.rmi/share/classes/sun/rmi/server/UnicastRef.java#L303C4-L331 category: security technology: - rmi cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization shortlink: https://sg.run/zvnl semgrep.dev: rule: r_id: 9217 rv_id: 1263072 rule_id: NbUkw5 version_id: rxTAKN2 url: https://semgrep.dev/playground/r/rxTAKN2/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization origin: community message: Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure deserialization vulnerability. This object can be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON. languages: - java patterns: - pattern: | interface $INTERFACE extends Remote { $RETURNTYPE $METHOD($PARAMTYPE $PARAM) throws RemoteException; } - metavariable-pattern: metavariable: $PARAMTYPE language: generic patterns: - pattern-not: String - pattern-not: java.lang.String - pattern-not: boolean - pattern-not: Boolean - pattern-not: java.lang.Boolean - pattern-not: byte - pattern-not: Byte - pattern-not: java.lang.Byte - pattern-not: char - pattern-not: Character - pattern-not: java.lang.Character - pattern-not: double - pattern-not: Double - pattern-not: java.lang.Double - pattern-not: float - pattern-not: Float - pattern-not: java.lang.Float - pattern-not: int - pattern-not: Integer - pattern-not: java.lang.Integer - pattern-not: long - pattern-not: Long - pattern-not: java.lang.Long - pattern-not: short - pattern-not: Short - pattern-not: java.lang.Short - id: java.spring.security.audit.spel-injection.spel-injection message: A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation. metadata: cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' owasp: - A03:2021 - Injection - A05:2025 - Injection source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SPEL_INJECTION category: security technology: - spring references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/java.spring.security.audit.spel-injection.spel-injection shortlink: https://sg.run/XBp4 semgrep.dev: rule: r_id: 9220 rv_id: 1263075 rule_id: x8Un7b version_id: kbTzG5Y url: https://semgrep.dev/playground/r/kbTzG5Y/java.spring.security.audit.spel-injection.spel-injection origin: community severity: WARNING languages: - java patterns: - pattern-either: - pattern-inside: | class $CLASS { ... ExpressionParser $PARSER; ... } - pattern-inside: | class $CLASS { ... ExpressionParser $PARSER = ...; ... } - pattern-inside: | $X $METHOD(...) { ... ExpressionParser $PARSER = ...; ... } - pattern-inside: | class $CLASS { ... SpelExpressionParser $PARSER; ... } - pattern-inside: | class $CLASS { ... SpelExpressionParser $PARSER = ...; ... } - pattern-inside: | $X $METHOD(...) { ... SpelExpressionParser $PARSER = ...; ... } - pattern-inside: | class $CLASS { ... TemplateAwareExpressionParser $PARSER; ... } - pattern-inside: | class $CLASS { ... TemplateAwareExpressionParser $PARSER = ...; ... } - pattern-inside: | $X $METHOD(...) { ... TemplateAwareExpressionParser $PARSER = ...; ... } - pattern: | $X $METHOD(...) { ... $PARSER.parseExpression(...); ... } - pattern-not: | $X $METHOD(...) { ... $PARSER.parseExpression("..."); ... } - pattern-not: | $X $METHOD(...) { ... String $S = "..."; ... $PARSER.parseExpression($S); ... } - id: java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled message: CSRF protection is disabled for this configuration. This is a security risk. metadata: cwe: - 'CWE-352: Cross-Site Request Forgery (CSRF)' owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_PROTECTION_DISABLED asvs: section: V4 Access Control control_id: 4.2.2 CSRF control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V4-Access-Control.md#v42-operation-level-access-control version: '4' category: security technology: - spring references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site Request Forgery (CSRF) source: https://semgrep.dev/r/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled shortlink: https://sg.run/jRnl semgrep.dev: rule: r_id: 9221 rv_id: 1263080 rule_id: OrU3gK version_id: vdT06dL url: https://semgrep.dev/playground/r/vdT06dL/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled origin: community severity: WARNING languages: - java pattern: $OBJ.csrf(...).disable(...) - id: java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect message: Application redirects a user to a destination URL specified by a user supplied parameter that is not validated. metadata: cwe: - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNVALIDATED_REDIRECT category: security technology: - spring references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Open Redirect source: https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect shortlink: https://sg.run/9oXz semgrep.dev: rule: r_id: 9223 rv_id: 1263083 rule_id: v8Un7w version_id: nWT2Lk0 url: https://semgrep.dev/playground/r/nWT2Lk0/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect origin: community severity: WARNING languages: - java pattern-either: - pattern: | $X $METHOD(...,String $URL,...) { return "redirect:" + $URL; } - pattern: | $X $METHOD(...,String $URL,...) { ... String $REDIR = "redirect:" + $URL; ... return $REDIR; ... } - pattern: | $X $METHOD(...,String $URL,...) { ... new ModelAndView("redirect:" + $URL); ... } - pattern: |- $X $METHOD(...,String $URL,...) { ... String $REDIR = "redirect:" + $URL; ... new ModelAndView($REDIR); ... } - id: java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping patterns: - pattern-inside: | @RequestMapping(...) $RETURNTYPE $METHOD(...) { ... } - pattern-not-inside: | @RequestMapping(..., method = $X, ...) $RETURNTYPE $METHOD(...) { ... } - pattern: | RequestMapping message: Detected a method annotated with 'RequestMapping' that does not specify the HTTP method. CSRF protections are not enabled for GET, HEAD, TRACE, or OPTIONS, and by default all HTTP methods are allowed when the HTTP method is not explicitly specified. This means that a method that performs state changes could be vulnerable to CSRF attacks. To mitigate, add the 'method' field and specify the HTTP method (such as 'RequestMethod.POST'). severity: WARNING metadata: cwe: - 'CWE-352: Cross-Site Request Forgery (CSRF)' owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING references: - https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING category: security technology: - spring cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site Request Forgery (CSRF) source: https://semgrep.dev/r/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping shortlink: https://sg.run/2xlq semgrep.dev: rule: r_id: 9219 rv_id: 1263089 rule_id: wdUJ7q version_id: QkTGq2l url: https://semgrep.dev/playground/r/QkTGq2l/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping origin: community languages: - java - id: javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection message: Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. metadata: owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures cwe: - 'CWE-502: Deserialization of Untrusted Data' category: security technology: - grpc references: - https://blog.gopheracademy.com/advent-2017/go-grpc-beyond-basics/#:~:text=disables%20transport%20security cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection shortlink: https://sg.run/5QkD semgrep.dev: rule: r_id: 9291 rv_id: 1263180 rule_id: lBU9D8 version_id: e1TyjAl url: https://semgrep.dev/playground/r/e1TyjAl/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection origin: community languages: - javascript - typescript severity: ERROR pattern-either: - pattern: | require('grpc'); ... $GRPC($ADDR,...,$CREDENTIALS.createInsecure(),...); - pattern: | require('grpc'); ... new $GRPC($ADDR,...,$CREDENTIALS.createInsecure(),...); - pattern: |- require('grpc'); ... $CREDS = <... $CREDENTIALS.createInsecure() ...>; ... $GRPC($ADDR,...,$CREDS,...); - pattern: |- require('grpc'); ... $CREDS = <... $CREDENTIALS.createInsecure() ...>; ... new $GRPC($ADDR,...,$CREDS,...); - id: javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). metadata: interfile: true cwe: - 'CWE-798: Use of Hard-coded Credentials' references: - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures asvs: section: 'V3: Session Management Verification Requirements' control_id: 3.5.2 Static API keys or secret control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management version: '4' category: security technology: - jose - jwt - secrets cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret shortlink: https://sg.run/Ro1g semgrep.dev: rule: r_id: 9293 rv_id: 1263182 rule_id: JDUyRl version_id: d6TyxbX url: https://semgrep.dev/playground/r/d6TyxbX/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret origin: community languages: - javascript - typescript severity: WARNING patterns: - pattern-inside: | $JOSE = require("jose"); ... - pattern-either: - pattern-inside: | var {JWT} = $JOSE; ... - pattern-inside: | var {JWK, JWT} = $JOSE; ... - pattern-inside: | const {JWT} = $JOSE; ... - pattern-inside: | const {JWK, JWT} = $JOSE; ... - pattern-inside: | let {JWT} = $JOSE; ... - pattern-inside: | let {JWK, JWT} = $JOSE; ... - pattern-either: - pattern: | JWT.verify($P, "...", ...); - pattern: | JWT.sign($P, "...", ...); - pattern: "JWT.verify($P, JWK.asKey(\"...\"), ...); \n" - pattern: | $JWT.sign($P, JWK.asKey("..."), ...); options: symbolic_propagation: true interfile: true - id: javascript.jose.security.jwt-none-alg.jwt-none-alg message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. metadata: cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ asvs: section: 'V3: Session Management Verification Requirements' control_id: 3.5.3 Insecue Stateless Session Tokens control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management version: '4' category: security technology: - jose - jwt subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: HIGH references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg shortlink: https://sg.run/AvRL semgrep.dev: rule: r_id: 9294 rv_id: 1263183 rule_id: 5rUOGN version_id: ZRTKAyb url: https://semgrep.dev/playground/r/ZRTKAyb/javascript.jose.security.jwt-none-alg.jwt-none-alg origin: community languages: - javascript - typescript severity: ERROR pattern-either: - pattern: | var $JOSE = require("jose"); ... var { JWK, JWT } = $JOSE; ... var $T = JWT.verify($P, JWK.None,...); - pattern: | var $JOSE = require("jose"); ... var { JWK, JWT } = $JOSE; ... $T = JWT.verify($P, JWK.None,...); - pattern: | var $JOSE = require("jose"); ... var { JWK, JWT } = $JOSE; ... JWT.verify($P, JWK.None,...); - id: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' references: - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures asvs: section: 'V3: Session Management Verification Requirements' control_id: 3.5.2 Static API keys or secret control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management version: '4' category: security technology: - jwt - javascript - secrets cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret shortlink: https://sg.run/4xN9 semgrep.dev: rule: r_id: 9300 rv_id: 1263189 rule_id: WAUon7 version_id: gETB75D url: https://semgrep.dev/playground/r/gETB75D/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret origin: community languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern: "$X = '...' \n" - pattern: "$X = '$Y' \n" - patterns: - pattern-either: - pattern-inside: | $JWT.sign($DATA,"...",...); - pattern-inside: | $JWT.verify($DATA,"...",...); pattern-sinks: - patterns: - pattern-either: - pattern-inside: | $JWT = require("jsonwebtoken") ... - pattern-inside: | import $JWT from "jsonwebtoken" ... - pattern-inside: | import * as $JWT from "jsonwebtoken" ... - pattern-inside: | import {...,$JWT,...} from "jsonwebtoken" ... - pattern-either: - pattern-inside: | $JWT.sign($DATA,$VALUE,...); - pattern-inside: | $JWT.verify($DATA,$VALUE,...); - focus-metavariable: $VALUE - id: javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. metadata: cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ asvs: section: 'V3: Session Management Verification Requirements' control_id: 3.5.3 Insecue Stateless Session Tokens control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management version: '4' category: security technology: - jwt subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg shortlink: https://sg.run/PJXv semgrep.dev: rule: r_id: 9301 rv_id: 1263190 rule_id: 0oU53g version_id: QkTGqQo url: https://semgrep.dev/playground/r/QkTGqQo/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg origin: community languages: - javascript - typescript severity: ERROR patterns: - pattern-inside: | $JWT = require("jsonwebtoken"); ... - pattern: $JWT.verify($P, $X, {algorithms:[...,'none',...]},...) - id: javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert message: Detected usage of noassert in Buffer API, which allows the offset the be beyond the end of the buffer. This could result in writing or reading beyond the end of the buffer. metadata: cwe: - 'CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer' source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-buffer-noassert.js category: security technology: - javascript cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW references: - https://cwe.mitre.org/data/definitions/119.html license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Memory Issues source: https://semgrep.dev/r/javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert shortlink: https://sg.run/qxpO semgrep.dev: rule: r_id: 9312 rv_id: 945886 rule_id: j2Uvj8 version_id: 9lTy1Y6 url: https://semgrep.dev/playground/r/9lTy1Y6/javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert origin: community languages: - javascript - typescript severity: WARNING patterns: - pattern: $OBJ.$API(..., true) - metavariable-regex: metavariable: $API regex: (read|write)(U?Int8|(U?Int(16|32)|Float|Double)(LE|BE)) - id: javascript.lang.security.detect-child-process.detect-child-process message: 'Detected calls to child_process from a function argument `$FUNC`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. ' metadata: cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-child-process.js category: security technology: - javascript cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/javascript.lang.security.detect-child-process.detect-child-process shortlink: https://sg.run/l2lo semgrep.dev: rule: r_id: 9313 rv_id: 1409399 rule_id: 10UKNB version_id: 5PT7KnG url: https://semgrep.dev/playground/r/5PT7KnG/javascript.lang.security.detect-child-process.detect-child-process origin: community languages: - javascript - typescript severity: ERROR mode: taint pattern-sources: - patterns: - pattern-inside: | function ... (...,$FUNC,...) { ... } - focus-metavariable: $FUNC pattern-sinks: - patterns: - pattern-either: - pattern-inside: | $CP = require('child_process') ... - pattern-inside: | import * as $CP from 'child_process' ... - pattern-inside: | import $CP from 'child_process' ... - pattern-either: - pattern: $CP.exec($CMD,...) - pattern: $CP.execSync($CMD,...) - pattern: $CP.spawn($CMD,...) - pattern: $CP.spawnSync($CMD,...) - pattern-not-inside: $CP.$EXEC("...",...) - pattern-not-inside: $CP.$EXEC(["...",...],...) - pattern-not-inside: | $CMD = "..." ... - pattern-not-inside: | $CMD = ["...",...] ... - focus-metavariable: $CMD - patterns: - pattern-either: - pattern: child_process.exec($CMD,...) - pattern: child_process.execSync($CMD,...) - pattern: child_process.spawn($CMD,...) - pattern: child_process.spawnSync($CMD,...) - pattern-not-inside: child_process.$EXEC("...",...) - pattern-not-inside: child_process.$EXEC(["...",...],...) - pattern-not-inside: | $CMD = "..." ... - pattern-not-inside: | $CMD = ["...",...] ... - focus-metavariable: $CMD - id: javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape message: Markup escaping disabled. This can be used with some template engines to escape disabling of HTML entities, which can lead to XSS attacks. metadata: cwe: - 'CWE-116: Improper Encoding or Escaping of Output' owasp: - A03:2021 - Injection - A05:2025 - Injection source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-disable-mustache-escape.js category: security technology: - mustache subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW references: - https://owasp.org/Top10/A03_2021-Injection license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Encoding source: https://semgrep.dev/r/javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape shortlink: https://sg.run/Yvwd semgrep.dev: rule: r_id: 9314 rv_id: 1263213 rule_id: 9AU17r version_id: DkTRb3X url: https://semgrep.dev/playground/r/DkTRb3X/javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape origin: community languages: - javascript - typescript severity: WARNING pattern: $OBJ.escapeMarkup = false - id: javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression message: Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input. metadata: cwe: - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' owasp: - A03:2021 - Injection - A05:2025 - Injection source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-eval-with-expression.js references: - https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval! category: security technology: - javascript subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression shortlink: https://sg.run/6nwK semgrep.dev: rule: r_id: 9315 rv_id: 1263214 rule_id: yyUngo version_id: WrTqKkJ url: https://semgrep.dev/playground/r/WrTqKkJ/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression origin: community languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: | $PROP = new URLSearchParams($WINDOW. ... .location.search).get('...') ... - pattern-inside: | $PROP = new URLSearchParams(location.search).get('...') ... - pattern-inside: | $PROP = new URLSearchParams($WINDOW. ... .location.hash.substring(1)).get('...') ... - pattern-inside: | $PROP = new URLSearchParams(location.hash.substring(1)).get('...') ... - focus-metavariable: $PROP - patterns: - pattern-either: - pattern-inside: | $PROPS = new URLSearchParams($WINDOW. ... .location.search) ... - pattern-inside: | $PROPS = new URLSearchParams(location.search) ... - pattern-inside: | $PROPS = new URLSearchParams($WINDOW. ... .location.hash.substring(1)) ... - pattern-inside: | $PROPS = new URLSearchParams(location.hash.substring(1)) ... - pattern: $PROPS.get('...') - focus-metavariable: $PROPS - patterns: - pattern-either: - pattern: location.href - pattern: location.hash - pattern: location.search - pattern: $WINDOW. ... .location.href - pattern: $WINDOW. ... .location.hash - pattern: $WINDOW. ... .location.search pattern-sinks: - patterns: - pattern-either: - pattern: eval(<... $SINK ...>) - pattern: window.eval(<... $SINK ...>) - pattern: new Function(<... $SINK ...>) - pattern: new Function(<... $SINK ...>)(...) - pattern: setTimeout(<... $SINK ...>,...) - pattern: setInterval(<... $SINK ...>,...) - focus-metavariable: $SINK pattern-sanitizers: - patterns: - pattern-either: - pattern: location.href = $FUNC(...) - pattern: location.hash = $FUNC(...) - pattern: location.search = $FUNC(...) - pattern: $WINDOW. ... .location.href = $FUNC(...) - pattern: $WINDOW. ... .location.hash = $FUNC(...) - pattern: $WINDOW. ... .location.search = $FUNC(...) - id: javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override message: Detected use of express.csrf() middleware before express.methodOverride(). This can allow GET requests (which are not checked by csrf) to turn into POST requests later. metadata: cwe: - 'CWE-352: Cross-Site Request Forgery (CSRF)' source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-no-csrf-before-method-override.js references: - https://github.com/nodesecurity/eslint-plugin-security/blob/master/docs/bypass-connect-csrf-protection-by-abusing.md category: security technology: - javascript owasp: - A01:2021 - Broken Access Control - A05:2017 - Broken Access Control - A01:2025 - Broken Access Control cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site Request Forgery (CSRF) source: https://semgrep.dev/r/javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override shortlink: https://sg.run/oxoX semgrep.dev: rule: r_id: 9316 rv_id: 1263216 rule_id: r6UrvQ version_id: K3TKkPO url: https://semgrep.dev/playground/r/K3TKkPO/javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override origin: community languages: - javascript - typescript severity: WARNING pattern: | express.csrf(); ... express.methodOverride(); - id: javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes message: Detected usage of crypto.pseudoRandomBytes, which does not produce secure random numbers. metadata: cwe: - 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)' owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-pseudoRandomBytes.js asvs: section: 'V6: Stored Cryptography Verification Requirements' control_id: 6.3.1 Insecure Randomness control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v63-random-values version: '4' category: security technology: - javascript subcategory: - audit likelihood: LOW impact: LOW confidence: LOW references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes shortlink: https://sg.run/pxze semgrep.dev: rule: r_id: 9318 rv_id: 1263217 rule_id: NbUkR2 version_id: qkTR799 url: https://semgrep.dev/playground/r/qkTR799/javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes origin: community languages: - javascript - typescript severity: WARNING pattern: crypto.pseudoRandomBytes - id: javascript.lang.security.spawn-git-clone.spawn-git-clone message: Git allows shell commands to be specified in ext URLs for remote repositories. For example, git clone 'ext::sh -c whoami% >&2' will execute the whoami command to try to connect to a remote repository. Make sure that the URL is not controlled by external input. metadata: cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection category: security technology: - git cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: LOW confidence: LOW references: - https://owasp.org/Top10/A03_2021-Injection license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/javascript.lang.security.spawn-git-clone.spawn-git-clone shortlink: https://sg.run/2xrr semgrep.dev: rule: r_id: 9319 rv_id: 1263220 rule_id: kxUkPP version_id: 6xT29A7 url: https://semgrep.dev/playground/r/6xT29A7/javascript.lang.security.spawn-git-clone.spawn-git-clone origin: community languages: - javascript - typescript severity: ERROR patterns: - pattern-either: - pattern: spawn('git', ['clone',...,$F]) - pattern: $X.spawn('git', ['clone',...,$F]) - pattern: spawn('git', ['clone',...,$P,$F]) - pattern: $X.spawn('git', ['clone',...,$P,$F]) - pattern-not: spawn('git', ['clone',...,"..."]) - pattern-not: $X.spawn('git', ['clone',...,"..."]) - pattern-not: spawn('git', ['clone',...,"...","..."]) - pattern-not: $X.spawn('git', ['clone',...,"...","..."]) - id: javascript.node-expat.security.audit.expat-xxe.expat-xxe message: If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities metadata: owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' category: security technology: - node-expat cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/javascript.node-expat.security.audit.expat-xxe.expat-xxe shortlink: https://sg.run/eLdL semgrep.dev: rule: r_id: 9332 rv_id: 1263224 rule_id: gxU171 version_id: 2KTv2AZ url: https://semgrep.dev/playground/r/2KTv2AZ/javascript.node-expat.security.audit.expat-xxe.expat-xxe origin: community languages: - javascript - typescript severity: WARNING patterns: - pattern-either: - pattern: | var $EXPAT = require('node-expat'); ... new $EXPAT.Parser(...); ... $PARSER.parse(...); - pattern: | var $EXPAT = require('node-expat'); ... new $EXPAT.Parser(...); ... $PARSER.write(...); - pattern: | require('node-expat'); ... new Parser(...); ... $PARSER.parse(...); - pattern: | require('node-expat'); ... new Parser(...); ... $PARSER.write(...); - pattern-not: | var $EXPAT = require('node-expat'); ... new $EXPAT.Parser(...); ... $PARSER.parse("..."); - pattern-not: | var $EXPAT = require('node-expat'); ... new $EXPAT.Parser(...); ... $PARSER.write("..."); - pattern-not: | require('node-expat'); ... new Parser(...); ... $PARSER.parse("..."); - pattern-not: | require('node-expat'); ... new Parser(...); ... $PARSER.write("..."); - pattern-not: | $X = "..."; ... $PARSER.parse($X); - pattern-not: |- $X = "..."; ... $PARSER.write($X); - id: javascript.sax.security.audit.sax-xxe.sax-xxe message: Use of 'ondoctype' in 'sax' library detected. By default, 'sax' won't do anything with custom DTD entity definitions. If you're implementing a custom DTD entity definition, be sure not to introduce XML External Entity (XXE) vulnerabilities, or be absolutely sure that external entities received from a trusted source while processing XML. metadata: owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' references: - https://github.com/Leonidas-from-XIV/node-xml2js/issues/415 - https://github.com/isaacs/sax-js category: security technology: - sax cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/javascript.sax.security.audit.sax-xxe.sax-xxe shortlink: https://sg.run/5QEj semgrep.dev: rule: r_id: 9347 rv_id: 1263239 rule_id: qNUj7e version_id: d6Tyxn9 url: https://semgrep.dev/playground/r/d6Tyxn9/javascript.sax.security.audit.sax-xxe.sax-xxe origin: community languages: - javascript - typescript severity: WARNING pattern-either: - pattern: | require('sax'); ... $PARSER.ondoctype = ...; - pattern: |- require('sax'); ... $PARSER.on('doctype',...); - id: javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe message: If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities metadata: owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' category: security technology: - xml2json cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: LOW confidence: LOW references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe shortlink: https://sg.run/l27o semgrep.dev: rule: r_id: 9357 rv_id: 1263253 rule_id: 10UKpB version_id: GxTkeg8 url: https://semgrep.dev/playground/r/GxTkeg8/javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe origin: community languages: - javascript - typescript severity: WARNING patterns: - pattern: | var $XML = require('xml2json'); ... $XML.toJson(...); - pattern-not: | var $XML = require('xml2json'); ... $XML.toJson("...",...); - pattern-not: |- var $XML = require('xml2json'); ... var $S = "..."; ... $XML.toJson($S,...); - id: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag message: Cannot determine what '$UNK' is and it is used with a ' - pattern-not-inside: