rules: - id: generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key pattern-regex: rk_live_[0-9a-zA-Z]{24} languages: - regex message: Stripe Restricted API Key detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json category: security technology: - secrets - stripe confidence: MEDIUM owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key shortlink: https://sg.run/ZvdL semgrep.dev: rule: r_id: 9079 rv_id: 1262900 rule_id: 5rUOWq version_id: K3TKkKj url: https://semgrep.dev/playground/r/K3TKkKj/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key origin: community - id: generic.secrets.security.detected-username-and-password-in-uri.detected-username-and-password-in-uri patterns: - pattern: $PROTOCOL://$...USERNAME:$...PASSWORD@$END - metavariable-regex: metavariable: $...USERNAME regex: \A({?)([A-Za-z])([A-Za-z0-9_-]){5,31}(}?)\Z - metavariable-regex: metavariable: $...PASSWORD regex: (?!.*[\s])(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~]){6,32} - metavariable-regex: metavariable: $PROTOCOL regex: (.*http.*)|(.*sql.*)|(.*ftp.*)|(.*smtp.*) languages: - generic message: Username and password in URI detected severity: ERROR metadata: owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures cwe: - 'CWE-798: Use of Hard-coded Credentials' references: - https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go category: security technology: - secrets confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-username-and-password-in-uri.detected-username-and-password-in-uri shortlink: https://sg.run/8yA4 semgrep.dev: rule: r_id: 9084 rv_id: 1262903 rule_id: DbUple version_id: YDTZeZE url: https://semgrep.dev/playground/r/YDTZeZE/generic.secrets.security.detected-username-and-password-in-uri.detected-username-and-password-in-uri origin: community - id: go.jwt-go.security.jwt.hardcoded-jwt-key message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). options: interfile: true metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' references: - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures category: security technology: - jwt - secrets confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key shortlink: https://sg.run/Rod2 semgrep.dev: rule: r_id: 9093 rv_id: 1262920 rule_id: GdU7Ny version_id: pZT0305 url: https://semgrep.dev/playground/r/pZT0305/go.jwt-go.security.jwt.hardcoded-jwt-key origin: community severity: WARNING languages: - go mode: taint pattern-sources: - patterns: - pattern-inside: | []byte("$F") pattern-sinks: - patterns: - pattern-either: - pattern-inside: | $TOKEN.SignedString($F) - focus-metavariable: $F - id: go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd patterns: - pattern-either: - patterns: - pattern: | exec.Cmd {...,Path: $CMD,...} - pattern-not: | exec.Cmd {...,Path: "...",...} - pattern-not-inside: | $CMD,$ERR := exec.LookPath("..."); ... - pattern-not-inside: | $CMD = "..."; ... - patterns: - pattern: | exec.Cmd {...,Args: $ARGS,...} - pattern-not: | exec.Cmd {...,Args: []string{...},...} - pattern-not-inside: | $ARGS = []string{"...",...}; ... - pattern-not-inside: | $CMD = "..."; ... $ARGS = []string{$CMD,...}; ... - pattern-not-inside: | $CMD = exec.LookPath("..."); ... $ARGS = []string{$CMD,...}; ... - patterns: - pattern: | exec.Cmd {...,Args: []string{$CMD,...},...} - pattern-not: | exec.Cmd {...,Args: []string{"...",...},...} - pattern-not-inside: | $CMD,$ERR := exec.LookPath("..."); ... - pattern-not-inside: | $CMD = "..."; ... - patterns: - pattern-either: - pattern: | exec.Cmd {...,Args: []string{"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$EXE,...},...} - patterns: - pattern: | exec.Cmd {...,Args: []string{$CMD,"-c",$EXE,...},...} - pattern-inside: | $CMD,$ERR := exec.LookPath("=~/(sh|bash|ksh|csh|tcsh|zsh)/"); ... - pattern-not: | exec.Cmd {...,Args: []string{"...","...","...",...},...} - pattern-not-inside: | $EXE = "..."; ... - pattern-inside: | import "os/exec" ... message: Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. metadata: cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' owasp: - A03:2021 - Injection - A05:2025 - Injection category: security technology: - go confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd shortlink: https://sg.run/Dorj semgrep.dev: rule: r_id: 9108 rv_id: 1262934 rule_id: 2ZUb8l version_id: e1Tyjeg url: https://semgrep.dev/playground/r/e1Tyjeg/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd origin: community severity: ERROR languages: - go - id: go.lang.security.audit.net.formatted-template-string.formatted-template-string message: Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://golang.org/pkg/html/template/#HTML category: security technology: - go confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string shortlink: https://sg.run/weE0 semgrep.dev: rule: r_id: 9129 rv_id: 1262943 rule_id: 8GUjDW version_id: gETB7Pe url: https://semgrep.dev/playground/r/gETB7Pe/go.lang.security.audit.net.formatted-template-string.formatted-template-string origin: community languages: - go severity: WARNING patterns: - pattern-not: template.HTML("..." + "...") - pattern-either: - pattern: template.HTML($T + $X, ...) - pattern: template.HTML(fmt.$P("...", ...), ...) - pattern: | $T = "..." ... $T = $FXN(..., $T, ...) ... template.HTML($T, ...) - pattern: | $T = fmt.$P("...", ...) ... template.HTML($T, ...) - pattern: | $T, $ERR = fmt.$P("...", ...) ... template.HTML($T, ...) - pattern: | $T = $X + $Y ... template.HTML($T, ...) - pattern: |- $T = "..." ... $OTHER, $ERR = fmt.$P(..., $T, ...) ... template.HTML($OTHER, ...) - id: go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf patterns: - pattern-inside: | func $FUNC(..., $W http.ResponseWriter, ...) { ... var $TEMPLATE = "..." ... $W.Write([]byte(fmt.$PRINTF($TEMPLATE, ...)), ...) ... } - pattern-either: - pattern: | $PARAMS = r.URL.Query() ... $DATA, $ERR := $PARAMS[...] ... $INTERM = $ANYTHING(..., $DATA, ...) ... $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) - pattern: | $PARAMS = r.URL.Query() ... $DATA, $ERR := $PARAMS[...] ... $INTERM = $DATA[...] ... $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) - pattern: | $DATA, $ERR := r.URL.Query()[...] ... $INTERM = $DATA[...] ... $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) - pattern: | $DATA, $ERR := r.URL.Query()[...] ... $INTERM = $ANYTHING(..., $DATA, ...) ... $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...))) - pattern: | $PARAMS = r.URL.Query() ... $DATA, $ERR := $PARAMS[...] ... $W.Write([]byte(fmt.$PRINTF(..., $DATA, ...))) message: Found data going from url query parameters into formatted data written to ResponseWriter. This could be XSS and should not be done. If you must do this, ensure your data is sanitized or escaped. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection category: security technology: - go confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf shortlink: https://sg.run/Zvon semgrep.dev: rule: r_id: 9135 rv_id: 1262949 rule_id: JDUyXB version_id: 5PTo1qr url: https://semgrep.dev/playground/r/5PTo1qr/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf origin: community severity: WARNING languages: - go - id: java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' references: - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures technology: - java - secrets - jwt category: security cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret shortlink: https://sg.run/RoDK semgrep.dev: rule: r_id: 9149 rv_id: 1262980 rule_id: oqUeAn version_id: d6Tyx8j url: https://semgrep.dev/playground/r/d6Tyx8j/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret origin: community languages: - java severity: WARNING patterns: - pattern-either: - pattern: | (Algorithm $ALG) = $ALGO.$HMAC("$Y"); - pattern: | $SECRET = "$Y"; ... (Algorithm $ALG) = $ALGO.$HMAC($SECRET); - pattern: | class $CLASS { ... $TYPE $SECRET = "$Y"; ... $RETURNTYPE $FUNC (...) { ... (Algorithm $ALG) = $ALGO.$HMAC($SECRET); ... } ... } - focus-metavariable: $Y - metavariable-regex: metavariable: $HMAC regex: (HMAC384|HMAC256|HMAC512) - id: java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal metadata: owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control cwe: - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN references: - https://www.owasp.org/index.php/Path_Traversal category: security technology: - jax-rs cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: LOW confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Path Traversal source: https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal shortlink: https://sg.run/DoWj semgrep.dev: rule: r_id: 9152 rv_id: 1262984 rule_id: 2ZUb9l version_id: 7ZTE3KW url: https://semgrep.dev/playground/r/7ZTE3KW/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal origin: community message: Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path. severity: WARNING languages: - java pattern-either: - pattern: | $RETURNTYPE $FUNC (..., @PathParam(...) $TYPE $VAR, ...) { ... new File(..., $VAR, ...); ... } - pattern: |- $RETURNTYPE $FUNC (..., @javax.ws.rs.PathParam(...) $TYPE $VAR, ...) { ... new File(..., $VAR, ...); ... } - id: java.jboss.security.session_sqli.find-sql-string-concatenation message: In $METHOD, $X is used to construct a SQL query via string concatenation. languages: - java severity: ERROR pattern-either: - pattern: | $RETURN $METHOD(...,String $X,...){ ... Session $SESSION = ...; ... String $QUERY = ... + $X + ...; ... PreparedStatement $PS = $SESSION.connection().prepareStatement($QUERY); ... ResultSet $RESULT = $PS.executeQuery(); ... } - pattern: | $RETURN $METHOD(...,String $X,...){ ... String $QUERY = ... + $X + ...; ... Session $SESSION = ...; ... PreparedStatement $PS = $SESSION.connection().prepareStatement($QUERY); ... ResultSet $RESULT = $PS.executeQuery(); ... } metadata: category: security technology: - jboss confidence: MEDIUM cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/java.jboss.security.session_sqli.find-sql-string-concatenation shortlink: https://sg.run/W8kA semgrep.dev: rule: r_id: 9153 rv_id: 1262986 rule_id: X5U8rQ version_id: 8KT5r3v url: https://semgrep.dev/playground/r/8KT5r3v/java.jboss.security.session_sqli.find-sql-string-concatenation origin: community - id: java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal metadata: cwe: - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN references: - https://www.owasp.org/index.php/Path_Traversal category: security technology: - java cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Path Traversal source: https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal shortlink: https://sg.run/oxXN semgrep.dev: rule: r_id: 9160 rv_id: 1263064 rule_id: NbUk7X version_id: zyTb2rq url: https://semgrep.dev/playground/r/zyTb2rq/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal origin: community message: Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path. mode: taint pattern-sources: - patterns: - pattern-either: - pattern: | (HttpServletRequest $REQ) - patterns: - pattern-inside: | (javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...); ... for (javax.servlet.http.Cookie $COOKIE: $COOKIES) { ... } - pattern: | $COOKIE.getValue(...) - patterns: - pattern-inside: | $TYPE[] $VALS = (HttpServletRequest $REQ).$GETFUNC(...); ... - pattern: | $PARAM = $VALS[$INDEX]; pattern-sanitizers: - pattern: org.apache.commons.io.FilenameUtils.getName(...) pattern-sinks: - patterns: - pattern-either: - pattern: | (java.io.File $FILE) = ... - pattern: | (java.io.FileOutputStream $FOS) = ... - pattern: | new java.io.FileInputStream(...) severity: ERROR languages: - java - id: java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization severity: WARNING languages: - java metadata: cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.3 Insecue Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' references: - https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf category: security technology: - java cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization shortlink: https://sg.run/zvO1 semgrep.dev: rule: r_id: 9161 rv_id: 1263065 rule_id: kxUk12 version_id: pZT03A1 url: https://semgrep.dev/playground/r/pZT03A1/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization origin: community message: JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when ObjectMessage.getObject() is called. Deserialization of untrusted data can lead to security flaws; a remote attacker could via a crafted JMS ObjectMessage to execute arbitrary code with the permissions of the application listening/consuming JMS Messages. In this case, the JMS MessageListener consume an ObjectMessage type received inside the onMessage method, which may lead to arbitrary code execution when calling the $Y.getObject method. patterns: - pattern-inside: | public class $JMS_LISTENER implements MessageListener { ... public void onMessage(Message $JMS_MSG) { ... } } - pattern-either: - pattern-inside: $X = $Y.getObject(...); - pattern-inside: $X = ($Z) $Y.getObject(...); - id: java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss message: 'Cross-site scripting detected in HttpServletResponse writer with variable ''$VAR''. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: ''Encode.forHtml($VAR)''.' metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XSS_SERVLET category: security technology: - java references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss shortlink: https://sg.run/pxjN semgrep.dev: rule: r_id: 9162 rv_id: 1263066 rule_id: wdUJOk version_id: 2KTv2EG url: https://semgrep.dev/playground/r/2KTv2EG/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss origin: community severity: ERROR patterns: - pattern-inside: $TYPE $FUNC(..., HttpServletResponse $RESP, ...) { ... } - pattern-inside: $VAR = $REQ.getParameter(...); ... - pattern-either: - pattern: $RESP.getWriter(...).write(..., $VAR, ...); - pattern: | $WRITER = $RESP.getWriter(...); ... $WRITER.write(..., $VAR, ...); languages: - java - id: java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe severity: WARNING metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser category: security technology: - java cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe shortlink: https://sg.run/XBwA semgrep.dev: rule: r_id: 9164 rv_id: 1263069 rule_id: OrU35O version_id: 1QTypQZ url: https://semgrep.dev/playground/r/1QTypQZ/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe origin: community message: XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting "javax.xml.stream.isSupportingExternalEntities" to false. patterns: - pattern-not-inside: | $METHOD(...) { ... $XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", false); ... } - pattern-not-inside: | $METHOD(...) { ... $XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); ... } - pattern-not-inside: | $METHOD(...) { ... $XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", Boolean.FALSE); ... } - pattern-not-inside: | $METHOD(...) { ... $XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE); ... } - pattern-either: - pattern: javax.xml.stream.XMLInputFactory.newFactory(...) - pattern: new XMLInputFactory(...) languages: - java - id: java.lang.security.audit.formatted-sql-string.formatted-sql-string metadata: cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SQL_INJECTION asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.5 Injection control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements version: '4' references: - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html - https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps - https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement category: security technology: - java cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string shortlink: https://sg.run/OPXp semgrep.dev: rule: r_id: 9175 rv_id: 1409389 rule_id: QrUzxR version_id: ExTeyBP url: https://semgrep.dev/playground/r/ExTeyBP/java.lang.security.audit.formatted-sql-string.formatted-sql-string origin: community options: taint_assume_safe_numbers: true taint_assume_safe_booleans: true message: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'. mode: taint pattern-sources: - patterns: - pattern-either: - pattern: | (HttpServletRequest $REQ) - patterns: - pattern-inside: | $ANNOT $FUNC (..., $INPUT, ...) { ... } - pattern: (String $INPUT) - focus-metavariable: $INPUT label: INPUT - patterns: - pattern-either: - pattern: $X + $INPUT - pattern: $X += $INPUT - pattern: String.format(..., $INPUT, ...) - pattern: String.join(..., $INPUT, ...) - pattern: (String $STR).concat($INPUT) - pattern: $INPUT.concat(...) - patterns: - pattern-either: - pattern: $STRB.append($INPUT) - pattern: new $STRB(..., $INPUT, ...) - metavariable-type: metavariable: $STRB type: StringBuilder label: CONCAT requires: INPUT pattern-propagators: - pattern: (StringBuffer $S).append($X) from: $X to: $S - pattern: (StringBuilder $S).append($X) from: $X to: $S pattern-sinks: - patterns: - pattern-not: $S.$SQLFUNC(<... "=~/.*TABLE *$/" ...>) - pattern-not: $S.$SQLFUNC(<... "=~/.*TABLE %s$/" ...>) - pattern-either: - pattern: (Statement $S).$SQLFUNC(...) - pattern: (PreparedStatement $P).$SQLFUNC(...) - pattern: (Connection $C).createStatement(...).$SQLFUNC(...) - pattern: (Connection $C).prepareStatement(...).$SQLFUNC(...) - pattern: (EntityManager $EM).$SQLFUNC(...) - metavariable-regex: metavariable: $SQLFUNC regex: execute|executeQuery|createQuery|query|addBatch|nativeSQL|create|prepare requires: CONCAT pattern-sanitizers: - patterns: - pattern: (CriteriaBuilder $CB).$ANY(...) severity: ERROR languages: - java - id: java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer message: Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views. severity: WARNING options: interfile: true metadata: likelihood: HIGH impact: MEDIUM confidence: MEDIUM category: security cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' cwe2021-top25: true cwe2022-top25: true owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html subcategory: - vuln technology: - java - servlets interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer shortlink: https://sg.run/KlRL semgrep.dev: rule: r_id: 9211 rv_id: 1263055 rule_id: j2Uv7B version_id: DkTRbXy url: https://semgrep.dev/playground/r/DkTRbXy/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer origin: community languages: - java mode: taint pattern-sources: - patterns: - pattern-either: - pattern: | (HttpServletRequest $REQ).$REQFUNC(...) - pattern: "(ServletRequest $REQ).$REQFUNC(...) \n" - metavariable-regex: metavariable: $REQFUNC regex: (getInputStream|getParameter|getParameterMap|getParameterValues|getReader|getCookies|getHeader|getHeaderNames|getHeaders|getPart|getParts|getQueryString) pattern-sinks: - patterns: - pattern-either: - pattern: | (HttpServletResponse $RESPONSE).getWriter(...).$WRITE(...) - pattern: | (HttpServletResponse $RESPONSE).getOutputStream(...).$WRITE(...) - pattern: | (java.io.PrintWriter $WRITER).$WRITE(...) - pattern: | (PrintWriter $WRITER).$WRITE(...) - pattern: | (javax.servlet.ServletOutputStream $WRITER).$WRITE(...) - pattern: | (ServletOutputStream $WRITER).$WRITE(...) - pattern: | (java.io.OutputStream $WRITER).$WRITE(...) - pattern: | (OutputStream $WRITER).$WRITE(...) pattern-sanitizers: - pattern-either: - pattern: Encode.forHtml(...) - pattern: (PolicyFactory $POLICY).sanitize(...) - pattern: (AntiSamy $AS).scan(...) - pattern: JSoup.clean(...) - pattern: org.apache.commons.lang.StringEscapeUtils.escapeHtml(...) - pattern: org.springframework.web.util.HtmlUtils.htmlEscape(...) - pattern: org.owasp.esapi.ESAPI.encoder().encodeForHTML(...) - id: java.spring.security.audit.spring-sqli.spring-sqli mode: taint pattern-sources: - patterns: - pattern: $ARG - pattern-inside: | public $T $M (..., String $ARG,...){...} pattern-sanitizers: - not_conflicting: true pattern-either: - patterns: - focus-metavariable: $A - pattern-inside: | new $TYPE(...,$A,...); pattern-sinks: - patterns: - pattern-either: - patterns: - focus-metavariable: $A - pattern: | new PreparedStatementCreatorFactory($A,...); - patterns: - focus-metavariable: $A - pattern: | (JdbcTemplate $T).$M($A,...) - patterns: - pattern: (String $A) - pattern-inside: | (JdbcTemplate $T).batchUpdate(...) - patterns: - focus-metavariable: $A - pattern: | NamedParameterBatchUpdateUtils.$M($A,...) - patterns: - focus-metavariable: $A - pattern: | BatchUpdateUtils.$M($A,...) message: Detected a string argument from a public method contract in a raw SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'. languages: - java severity: WARNING options: taint_assume_safe_numbers: true taint_assume_safe_booleans: true metadata: cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' category: security technology: - spring owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/java.spring.security.audit.spring-sqli.spring-sqli shortlink: https://sg.run/1Z3x semgrep.dev: rule: r_id: 9222 rv_id: 1263082 rule_id: eqU8N2 version_id: ZRTKAWW url: https://semgrep.dev/playground/r/ZRTKAWW/java.spring.security.audit.spring-sqli.spring-sqli origin: community - id: javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled message: $sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could provide additional attack surface for XSS vulnerabilities. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' references: - https://docs.angularjs.org/api/ng/service/$sce - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf category: security technology: - angular owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled shortlink: https://sg.run/N4DG semgrep.dev: rule: r_id: 9227 rv_id: 1263094 rule_id: EwU20Z version_id: 5PTo1EW url: https://semgrep.dev/playground/r/5PTo1EW/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled origin: community languages: - javascript - typescript severity: ERROR pattern: | $sceProvider.enabled(false); - id: javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method message: The use of $sce.trustAs can be dangerous if unsanitized user input flows through this API. metadata: references: - https://docs.angularjs.org/api/ng/service/$sce - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf category: security cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' technology: - angular owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method shortlink: https://sg.run/OPW2 semgrep.dev: rule: r_id: 9231 rv_id: 1263098 rule_id: gxU1QX version_id: BjTkZv0 url: https://semgrep.dev/playground/r/BjTkZv0/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method origin: community languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-inside: | app.controller(..., function($scope,$sce) { ... }); - pattern: $scope.$X pattern-sinks: - pattern: $sce.trustAs(...) - pattern: $sce.trustAsHtml(...) - id: javascript.browser.security.raw-html-concat.raw-html-concat message: User controlled data in a HTML string may result in XSS metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/www-community/attacks/xss/ category: security technology: - browser cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/javascript.browser.security.raw-html-concat.raw-html-concat shortlink: https://sg.run/4xAx semgrep.dev: rule: r_id: 9244 rv_id: 1263123 rule_id: 0oU5b5 version_id: 2KTv2wp url: https://semgrep.dev/playground/r/2KTv2wp/javascript.browser.security.raw-html-concat.raw-html-concat origin: community languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern: location.href - pattern: location.hash - pattern: location.search - pattern: $WINDOW. ... .location.href - pattern: $WINDOW. ... .location.hash - pattern: $WINDOW. ... .location.search pattern-sinks: - patterns: - pattern-either: - patterns: - pattern: $STRING + $EXPR - pattern-not: $STRING + "..." - metavariable-pattern: patterns: - pattern: <$TAG ... - pattern-not: <$TAG ...>...... metavariable: $STRING language: generic - patterns: - pattern: $EXPR + $STRING - pattern-not: '"..." + $STRING' - metavariable-pattern: patterns: - pattern: '... {...} - pattern-inside: | ({ $REQ }: Request,$RES: Response) => {...} - focus-metavariable: $REQ - pattern-either: - pattern: params - pattern: query - pattern: cookies - pattern: headers - pattern: body pattern-sinks: - patterns: - pattern-either: - pattern-inside: | $XML = require('node-expat') ... - pattern-inside: | import $XML from 'node-expat' ... - pattern-inside: | import * as $XML from 'node-expat' ... - pattern-either: - pattern-inside: | $PARSER = new $XML.Parser(...); ... - pattern-either: - pattern: $PARSER.parse($QUERY) - pattern: $PARSER.write($QUERY) - focus-metavariable: $QUERY - id: javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). options: interfile: true metadata: interfile: true cwe: - 'CWE-798: Use of Hard-coded Credentials' references: - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures category: security technology: - express - secrets cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: HIGH impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret shortlink: https://sg.run/Do1d semgrep.dev: rule: r_id: 9252 rv_id: 1263166 rule_id: pKUOjy version_id: pZT03Q0 url: https://semgrep.dev/playground/r/pZT03Q0/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret origin: community languages: - javascript - typescript severity: WARNING patterns: - pattern-either: - pattern-inside: | $JWT = require('express-jwt'); ... - pattern-inside: | import $JWT from 'express-jwt'; ... - pattern-inside: | import * as $JWT from 'express-jwt'; ... - pattern-inside: | import { ..., $JWT, ... } from 'express-jwt'; ... - pattern-either: - pattern: | $JWT({...,secret: "$Y",...},...) - pattern: | $OPTS = "$Y"; ... $JWT({...,secret: $OPTS},...); - focus-metavariable: $Y - id: javascript.express.security.express-phantom-injection.express-phantom-injection message: If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities metadata: owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' category: security technology: - express references: - https://phantomjs.org/page-automation.html cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Server-Side Request Forgery (SSRF) source: https://semgrep.dev/r/javascript.express.security.express-phantom-injection.express-phantom-injection shortlink: https://sg.run/W8BL semgrep.dev: rule: r_id: 9253 rv_id: 1263167 rule_id: 2ZUbx3 version_id: 2KTv26p url: https://semgrep.dev/playground/r/2KTv26p/javascript.express.security.express-phantom-injection.express-phantom-injection origin: community languages: - javascript - typescript severity: ERROR mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: function ... ($REQ, $RES) {...} - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - patterns: - pattern-either: - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|head|delete|options)$ - pattern-either: - pattern: $REQ.query - pattern: $REQ.body - pattern: $REQ.params - pattern: $REQ.cookies - pattern: $REQ.headers - patterns: - pattern-either: - pattern-inside: | ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...} - pattern-inside: | ({ $REQ }: Request,$RES: Response) => {...} - focus-metavariable: $REQ - pattern-either: - pattern: params - pattern: query - pattern: cookies - pattern: headers - pattern: body pattern-sinks: - patterns: - pattern-either: - pattern-inside: | require('phantom'); ... - pattern-inside: | import 'phantom'; ... - pattern-either: - pattern: $PAGE.open($SINK,...) - pattern: $PAGE.setContent($SINK,...) - pattern: $PAGE.openUrl($SINK,...) - pattern: $PAGE.evaluateJavaScript($SINK,...) - pattern: $PAGE.property("content",$SINK,...) - focus-metavariable: $SINK - id: javascript.express.security.express-puppeteer-injection.express-puppeteer-injection message: If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities metadata: owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' category: security technology: - express references: - https://pptr.dev/api/puppeteer.page cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Server-Side Request Forgery (SSRF) source: https://semgrep.dev/r/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection shortlink: https://sg.run/0QJB semgrep.dev: rule: r_id: 9254 rv_id: 1263168 rule_id: X5U8Nz version_id: X0TzyJY url: https://semgrep.dev/playground/r/X0TzyJY/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection origin: community languages: - javascript - typescript severity: ERROR mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: function ... ($REQ, $RES) {...} - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - patterns: - pattern-either: - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|head|delete|options)$ - pattern-either: - pattern: $REQ.query - pattern: $REQ.body - pattern: $REQ.params - pattern: $REQ.cookies - pattern: $REQ.headers - patterns: - pattern-either: - pattern-inside: | ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...} - pattern-inside: | ({ $REQ }: Request,$RES: Response) => {...} - focus-metavariable: $REQ - pattern-either: - pattern: params - pattern: query - pattern: cookies - pattern: headers - pattern: body pattern-sinks: - patterns: - pattern-either: - pattern-inside: | require('puppeteer'); ... - pattern-inside: | import 'puppeteer'; ... - pattern-either: - pattern: $PAGE.goto($SINK,...) - pattern: $PAGE.setContent($SINK,...) - pattern: $PAGE.evaluate($SINK,...) - pattern: $PAGE.evaluate($CODE,$SINK,...) - pattern: $PAGE.evaluateHandle($SINK,...) - pattern: $PAGE.evaluateHandle($CODE,$SINK,...) - pattern: $PAGE.evaluateOnNewDocument($SINK,...) - pattern: $PAGE.evaluateOnNewDocument($CODE,$SINK,...) - focus-metavariable: $SINK - id: javascript.express.security.express-sandbox-injection.express-sandbox-code-injection message: Make sure that unverified user data can not reach `sandbox`. metadata: owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' category: security technology: - express cwe2022-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection shortlink: https://sg.run/KlwL semgrep.dev: rule: r_id: 9255 rv_id: 1263169 rule_id: j2UvXB version_id: jQTn59D url: https://semgrep.dev/playground/r/jQTn59D/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection origin: community languages: - javascript - typescript severity: ERROR mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: function ... ($REQ, $RES) {...} - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - patterns: - pattern-either: - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|head|delete|options)$ - pattern-either: - pattern: $REQ.query - pattern: $REQ.body - pattern: $REQ.params - pattern: $REQ.cookies - pattern: $REQ.headers - patterns: - pattern-either: - pattern-inside: | ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...} - pattern-inside: | ({ $REQ }: Request,$RES: Response) => {...} - focus-metavariable: $REQ - pattern-either: - pattern: params - pattern: query - pattern: cookies - pattern: headers - pattern: body pattern-sinks: - patterns: - pattern-inside: | $SANDBOX = require('sandbox'); ... - pattern-either: - patterns: - pattern-inside: | $S = new $SANDBOX(...); ... - pattern: | $S.run(...) - pattern: | new $SANDBOX($OPTS).run(...) - pattern: new $SANDBOX().run(...) - id: javascript.express.security.express-xml2json-xxe.express-xml2json-xxe message: Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities metadata: owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' category: security technology: - express references: - https://www.npmjs.com/package/xml2json cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe shortlink: https://sg.run/XBD4 semgrep.dev: rule: r_id: 9264 rv_id: 1263174 rule_id: x8Uneb version_id: bZT534J url: https://semgrep.dev/playground/r/bZT534J/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe origin: community languages: - javascript - typescript severity: ERROR mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: function ... ($REQ, $RES) {...} - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - patterns: - pattern-either: - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|head|delete|options)$ - pattern-either: - pattern: $REQ.query - pattern: $REQ.body - pattern: $REQ.params - pattern: $REQ.cookies - pattern: $REQ.headers - pattern: $REQ.files.$ANYTHING.data.toString('utf8') - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') - patterns: - pattern-either: - pattern-inside: | ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...} - pattern-inside: | ({ $REQ }: Request,$RES: Response) => {...} - focus-metavariable: $REQ - pattern-either: - pattern: params - pattern: query - pattern: cookies - pattern: headers - pattern: body - pattern: files.$ANYTHING.data.toString('utf8') - pattern: files.$ANYTHING['data'].toString('utf8') pattern-sinks: - patterns: - pattern-either: - pattern-inside: | require('xml2json'); ... - pattern-inside: | import 'xml2json'; ... - pattern: $EXPAT.toJson($SINK,...) - focus-metavariable: $SINK - id: javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal message: Possible writing outside of the destination, make sure that the target path is nested in the intended destination metadata: owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control cwe: - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' category: security references: - https://owasp.org/www-community/attacks/Path_Traversal technology: - express - node.js cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Path Traversal source: https://semgrep.dev/r/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal shortlink: https://sg.run/weRn semgrep.dev: rule: r_id: 9273 rv_id: 1263141 rule_id: L1Uyb8 version_id: ExTExX0 url: https://semgrep.dev/playground/r/ExTExX0/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal origin: community languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: function ... ($REQ, $RES) {...} - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - patterns: - pattern-either: - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|head|delete|options)$ - pattern-either: - pattern: $REQ.query - pattern: $REQ.body - pattern: $REQ.params - pattern: $REQ.cookies - pattern: $REQ.headers - patterns: - pattern-either: - pattern-inside: | ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...} - pattern-inside: | ({ $REQ }: Request,$RES: Response) => {...} - focus-metavariable: $REQ - pattern-either: - pattern: params - pattern: query - pattern: cookies - pattern: headers - pattern: body pattern-sinks: - patterns: - focus-metavariable: $SINK - pattern-either: - pattern-inside: | $PATH = require('path'); ... - pattern-inside: | import $PATH from 'path'; ... - pattern-either: - pattern: $PATH.join(...,$SINK,...) - pattern: $PATH.resolve(...,$SINK,...) - patterns: - focus-metavariable: $SINK - pattern-inside: | import 'path'; ... - pattern-either: - pattern: path.join(...,$SINK,...) - pattern: path.resolve(...,$SINK,...) pattern-sanitizers: - pattern: $Y.replace(...) - pattern: $Y.indexOf(...) - pattern: | function ... (...) { ... <... $Y.indexOf(...) ...> ... } - patterns: - pattern: $FUNC(...) - metavariable-regex: metavariable: $FUNC regex: sanitize - id: javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event message: Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities metadata: owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' category: security technology: - express references: - https://www.npmjs.com/package/xml2json cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event shortlink: https://sg.run/x1AA semgrep.dev: rule: r_id: 9274 rv_id: 1263146 rule_id: 8GUjkk version_id: QkTGqgo url: https://semgrep.dev/playground/r/QkTGqgo/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event origin: community languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: function ... ($REQ, $RES) {...} - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - patterns: - pattern-either: - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|head|delete|options)$ - pattern-either: - pattern: $REQ.query - pattern: $REQ.body - pattern: $REQ.params - pattern: $REQ.cookies - pattern: $REQ.headers - patterns: - pattern-either: - pattern-inside: | ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...} - pattern-inside: | ({ $REQ }: Request,$RES: Response) => {...} - focus-metavariable: $REQ - pattern-either: - pattern: params - pattern: query - pattern: cookies - pattern: headers - pattern: body pattern-sinks: - patterns: - pattern-either: - pattern-inside: | require('xml2json'); ... - pattern-inside: | import 'xml2json'; ... - pattern: $REQ.on('...', function(...) { ... $EXPAT.toJson($INPUT,...); ... }) - focus-metavariable: $INPUT - id: javascript.express.security.audit.xss.direct-response-write.direct-response-write message: Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML. options: interfile: true metadata: interfile: true references: - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' category: security technology: - express cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM vulnerability_class: - Cross-Site-Scripting (XSS) license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license source: https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write shortlink: https://sg.run/vzGl semgrep.dev: rule: r_id: 9277 rv_id: 1263150 rule_id: 3qUPA1 version_id: JdTzxeg url: https://semgrep.dev/playground/r/JdTzxeg/javascript.express.security.audit.xss.direct-response-write.direct-response-write origin: community languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: function ... ($REQ, $RES) {...} - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - patterns: - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|head|delete|options) - pattern-not-inside: | function ... ($REQ, $RES) { ... $RES.$SET('Content-Type', '$TYPE') } - pattern-not-inside: | $APP.$METHOD(..., function $FUNC($REQ, $RES) { ... $RES.$SET('Content-Type', '$TYPE') }) - pattern-not-inside: | function ... ($REQ, $RES, $NEXT) { ... $RES.$SET('Content-Type', '$TYPE') } - pattern-not-inside: | function ... ($REQ, $RES) { ... $RES.set('$TYPE') } - pattern-not-inside: | $APP.$METHOD(..., function $FUNC($REQ, $RES) { ... $RES.set('$TYPE') }) - pattern-not-inside: | function ... ($REQ, $RES, $NEXT) { ... $RES.set('$TYPE') } - pattern-either: - pattern: $REQ.query - pattern: $REQ.body - pattern: $REQ.params - patterns: - pattern-either: - pattern-inside: | ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...} - pattern-inside: | ({ $REQ }: Request,$RES: Response) => {...} - pattern-not-inside: | ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => { ... $RES.$SET('Content-Type', '$TYPE') } - pattern-not-inside: | ({ $REQ }: Request,$RES: Response) => { ... $RES.$SET('Content-Type', '$TYPE') } - pattern-not-inside: | ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => { ... $RES.set('$TYPE') } - focus-metavariable: $REQ - pattern-either: - pattern: params - pattern: query - pattern: body pattern-sinks: - patterns: - pattern-inside: function ... (..., $RES,...) {...} - pattern-either: - pattern: $RES.write($ARG) - pattern: $RES.send($ARG) - pattern-not: $RES. ... .set('...'). ... .send($ARG) - pattern-not: $RES. ... .type('...'). ... .send($ARG) - pattern-not-inside: $RES.$METHOD({ ... }) - focus-metavariable: $ARG pattern-sanitizers: - patterns: - pattern-either: - pattern-inside: | import $S from "underscore.string" ... - pattern-inside: | import * as $S from "underscore.string" ... - pattern-inside: | import $S from "underscore.string" ... - pattern-inside: | $S = require("underscore.string") ... - pattern-either: - pattern: $S.escapeHTML(...) - patterns: - pattern-either: - pattern-inside: | import $S from "dompurify" ... - pattern-inside: | import { ..., $S,... } from "dompurify" ... - pattern-inside: | import * as $S from "dompurify" ... - pattern-inside: | $S = require("dompurify") ... - pattern-inside: | import $S from "isomorphic-dompurify" ... - pattern-inside: | import * as $S from "isomorphic-dompurify" ... - pattern-inside: | $S = require("isomorphic-dompurify") ... - pattern-either: - patterns: - pattern-inside: | $VALUE = $S(...) ... - pattern: $VALUE.sanitize(...) - patterns: - pattern-inside: | $VALUE = $S.sanitize ... - pattern: $S(...) - pattern: $S.sanitize(...) - pattern: $S(...) - patterns: - pattern-either: - pattern-inside: | import $S from 'xss'; ... - pattern-inside: | import * as $S from 'xss'; ... - pattern-inside: | $S = require("xss") ... - pattern: $S(...) - patterns: - pattern-either: - pattern-inside: | import $S from 'sanitize-html'; ... - pattern-inside: | import * as $S from "sanitize-html"; ... - pattern-inside: | $S = require("sanitize-html") ... - pattern: $S(...) - patterns: - pattern-either: - pattern-inside: | $S = new Remarkable() ... - pattern: $S.render(...) - patterns: - pattern-either: - pattern-inside: | import $S from 'express-xss-sanitizer'; ... - pattern-inside: | import * as $S from "express-xss-sanitizer"; ... - pattern-inside: | const { ..., $S, ... } = require('express-xss-sanitizer'); ... - pattern-inside: | var { ..., $S, ... } = require('express-xss-sanitizer'); ... - pattern-inside: | let { ...,$S,... } = require('express-xss-sanitizer'); ... - pattern-inside: | $S = require("express-xss-sanitizer") ... - pattern: $S(...) - patterns: - pattern: $RES. ... .type('$F'). ... .send(...) - metavariable-regex: metavariable: $F regex: (?!.*text/html) - patterns: - pattern-inside: | $X = [...]; ... - pattern: | if(<... !$X.includes($SOURCE)...>) { ... return ... } ... - pattern: $SOURCE - id: javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). metadata: interfile: true cwe: - 'CWE-798: Use of Hard-coded Credentials' references: - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures asvs: section: 'V3: Session Management Verification Requirements' control_id: 3.5.2 Static API keys or secret control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management version: '4' category: security technology: - jose - jwt - secrets cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret shortlink: https://sg.run/Ro1g semgrep.dev: rule: r_id: 9293 rv_id: 1263182 rule_id: JDUyRl version_id: d6TyxbX url: https://semgrep.dev/playground/r/d6TyxbX/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret origin: community languages: - javascript - typescript severity: WARNING patterns: - pattern-inside: | $JOSE = require("jose"); ... - pattern-either: - pattern-inside: | var {JWT} = $JOSE; ... - pattern-inside: | var {JWK, JWT} = $JOSE; ... - pattern-inside: | const {JWT} = $JOSE; ... - pattern-inside: | const {JWK, JWT} = $JOSE; ... - pattern-inside: | let {JWT} = $JOSE; ... - pattern-inside: | let {JWK, JWT} = $JOSE; ... - pattern-either: - pattern: | JWT.verify($P, "...", ...); - pattern: | JWT.sign($P, "...", ...); - pattern: "JWT.verify($P, JWK.asKey(\"...\"), ...); \n" - pattern: | $JWT.sign($P, JWK.asKey("..."), ...); options: symbolic_propagation: true interfile: true - id: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' references: - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures asvs: section: 'V3: Session Management Verification Requirements' control_id: 3.5.2 Static API keys or secret control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management version: '4' category: security technology: - jwt - javascript - secrets cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret shortlink: https://sg.run/4xN9 semgrep.dev: rule: r_id: 9300 rv_id: 1263189 rule_id: WAUon7 version_id: gETB75D url: https://semgrep.dev/playground/r/gETB75D/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret origin: community languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern: "$X = '...' \n" - pattern: "$X = '$Y' \n" - patterns: - pattern-either: - pattern-inside: | $JWT.sign($DATA,"...",...); - pattern-inside: | $JWT.verify($DATA,"...",...); pattern-sinks: - patterns: - pattern-either: - pattern-inside: | $JWT = require("jsonwebtoken") ... - pattern-inside: | import $JWT from "jsonwebtoken" ... - pattern-inside: | import * as $JWT from "jsonwebtoken" ... - pattern-inside: | import {...,$JWT,...} from "jsonwebtoken" ... - pattern-either: - pattern-inside: | $JWT.sign($DATA,$VALUE,...); - pattern-inside: | $JWT.verify($DATA,$VALUE,...); - focus-metavariable: $VALUE - id: javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' references: - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures asvs: section: 'V3: Session Management Verification Requirements' control_id: 3.5.2 Static API keys or secret control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management version: '4' category: security technology: - jwt - nodejs - secrets cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret shortlink: https://sg.run/vz70 semgrep.dev: rule: r_id: 9333 rv_id: 1263225 rule_id: QrUzq6 version_id: X0TzyoE url: https://semgrep.dev/playground/r/X0TzyoE/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret origin: community languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - by-side-effect: true patterns: - pattern-either: - pattern: | {..., clientSecret: "...", ...} - pattern: | {..., secretOrKey: "...", ...} - pattern: | {..., consumerSecret: "...", ...} - patterns: - pattern-inside: | $OBJ = {} ... - pattern-either: - pattern: | $OBJ.clientSecret = "..." - pattern: | $OBJ.secretOrKey = "..." - pattern: | $OBJ.consumerSecret = "..." - pattern: $OBJ - patterns: - pattern-inside: | $SECRET = '...' ... - pattern-either: - pattern: | {..., clientSecret: $SECRET, ...} - pattern: | {..., secretOrKey: $SECRET, ...} - pattern: | {..., consumerSecret: $SECRET, ...} - patterns: - pattern-inside: | $SECRET = '...' ... - pattern-either: - pattern-inside: | $VALUE = {..., clientSecret: $SECRET, ...} ... - pattern-inside: | $VALUE = {..., secretOrKey: $SECRET, ...} ... - pattern-inside: | $VALUE = {..., consumerSecret: $SECRET, ...} ... - pattern: $VALUE pattern-sinks: - patterns: - pattern-either: - pattern-inside: | $F = require("$I").Strategy ... - pattern-inside: | $F = require("$I") ... - pattern-inside: | import { $STRAT as $F } from '$I' ... - pattern-inside: | import $F from '$I' ... - metavariable-regex: metavariable: $I regex: (passport-.*) - pattern-inside: | new $F($VALUE,...) - focus-metavariable: $VALUE - id: python.boto3.security.hardcoded-token.hardcoded-token message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' references: - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html - https://bento.dev/checks/boto3/hardcoded-access-token/ - https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/ owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures category: security technology: - boto3 - secrets cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token shortlink: https://sg.run/LwQ6 semgrep.dev: rule: r_id: 9439 rv_id: 1263347 rule_id: 5rUOwK version_id: gETB78n url: https://semgrep.dev/playground/r/gETB78n/python.boto3.security.hardcoded-token.hardcoded-token origin: community languages: - python severity: WARNING mode: taint pattern-sources: - pattern: | "..." pattern-sinks: - patterns: - pattern-either: - pattern: $W(...,$TOKEN="$VALUE",...) - pattern: $BOTO. ... .$W(...,$TOKEN="$VALUE",...) - metavariable-regex: metavariable: $TOKEN regex: (aws_session_token|aws_access_key_id|aws_secret_access_key) - metavariable-pattern: language: generic metavariable: $VALUE patterns: - pattern-either: - pattern-regex: ^AKI - pattern-regex: ^[A-Za-z0-9/+=]+$ - metavariable-analysis: metavariable: $VALUE analyzer: entropy - id: python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization metadata: owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures cwe: - 'CWE-502: Deserialization of Untrusted Data' references: - https://docs.python.org/3/library/pickle.html category: security technology: - django cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization shortlink: https://sg.run/9oyr semgrep.dev: rule: r_id: 9467 rv_id: 1409400 rule_id: OrU3e6 version_id: GxTlb9e url: https://semgrep.dev/playground/r/GxTlb9e/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization origin: community message: Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code execution vulnerabilities. languages: - python severity: ERROR mode: taint pattern-sources: - pattern-either: - patterns: - pattern-inside: | def $INSIDE(..., $PARAM, ...): ... - pattern-either: - pattern: request.$REQFUNC(...) - pattern: request.$REQFUNC.get(...) - pattern: request.$REQFUNC[...] pattern-sinks: - pattern-either: - patterns: - pattern-either: - pattern: | pickle.$PICKLEFUNC(...) - pattern: | _pickle.$PICKLEFUNC(...) - pattern: | cPickle.$PICKLEFUNC(...) - pattern: | shelve.$PICKLEFUNC(...) - metavariable-regex: metavariable: $PICKLEFUNC regex: dumps|dump|load|loads - patterns: - pattern: dill.$DILLFUNC(...) - metavariable-regex: metavariable: $DILLFUNC regex: dump|dump_session|dumps|load|load_session|loads - patterns: - pattern: yaml.$YAMLFUNC(...) - pattern-not: yaml.$YAMLFUNC(..., Dumper=SafeDumper, ...) - pattern-not: yaml.$YAMLFUNC(..., Dumper=yaml.SafeDumper, ...) - pattern-not: yaml.$YAMLFUNC(..., Loader=SafeLoader, ...) - pattern-not: yaml.$YAMLFUNC(..., Loader=yaml.SafeLoader, ...) - metavariable-regex: metavariable: $YAMLFUNC regex: dump|dump_all|load|load_all - id: python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse message: Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss category: security technology: - django cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse shortlink: https://sg.run/BkvA semgrep.dev: rule: r_id: 9495 rv_id: 1263398 rule_id: JDUydR version_id: GxTke5K url: https://semgrep.dev/playground/r/GxTke5K/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse origin: community languages: - python severity: WARNING patterns: - pattern-inside: | def $FUNC(...): ... - pattern-either: - pattern: django.http.HttpResponse(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: django.http.HttpResponse(..., $S % request.$W.get(...), ...) - pattern: django.http.HttpResponse(..., f"...{request.$W.get(...)}...", ...) - pattern: django.http.HttpResponse(..., request.$W.get(...), ...) - pattern: | $DATA = request.$W.get(...) ... django.http.HttpResponse(..., $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $DATA ... django.http.HttpResponse(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR.format(..., $DATA, ...) ... django.http.HttpResponse(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... django.http.HttpResponse(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR % $DATA ... django.http.HttpResponse(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... django.http.HttpResponse(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = f"...{$DATA}..." ... django.http.HttpResponse(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... django.http.HttpResponse(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR + $DATA ... django.http.HttpResponse(..., $INTERM, ...) - pattern: $A = django.http.HttpResponse(..., request.$W.get(...), ...) - pattern: return django.http.HttpResponse(..., request.$W.get(...), ...) - pattern: django.http.HttpResponse(..., $S.format(..., request.$W(...), ...), ...) - pattern: django.http.HttpResponse(..., $S % request.$W(...), ...) - pattern: django.http.HttpResponse(..., f"...{request.$W(...)}...", ...) - pattern: django.http.HttpResponse(..., request.$W(...), ...) - pattern: | $DATA = request.$W(...) ... django.http.HttpResponse(..., $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $DATA ... django.http.HttpResponse(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR.format(..., $DATA, ...) ... django.http.HttpResponse(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... django.http.HttpResponse(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR % $DATA ... django.http.HttpResponse(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... django.http.HttpResponse(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W(...) ... $INTERM = f"...{$DATA}..." ... django.http.HttpResponse(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... django.http.HttpResponse(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR + $DATA ... django.http.HttpResponse(..., $INTERM, ...) - pattern: $A = django.http.HttpResponse(..., request.$W(...), ...) - pattern: return django.http.HttpResponse(..., request.$W(...), ...) - pattern: django.http.HttpResponse(..., $S.format(..., request.$W[...], ...), ...) - pattern: django.http.HttpResponse(..., $S % request.$W[...], ...) - pattern: django.http.HttpResponse(..., f"...{request.$W[...]}...", ...) - pattern: django.http.HttpResponse(..., request.$W[...], ...) - pattern: | $DATA = request.$W[...] ... django.http.HttpResponse(..., $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $DATA ... django.http.HttpResponse(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR.format(..., $DATA, ...) ... django.http.HttpResponse(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... django.http.HttpResponse(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR % $DATA ... django.http.HttpResponse(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... django.http.HttpResponse(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W[...] ... $INTERM = f"...{$DATA}..." ... django.http.HttpResponse(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... django.http.HttpResponse(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR + $DATA ... django.http.HttpResponse(..., $INTERM, ...) - pattern: $A = django.http.HttpResponse(..., request.$W[...], ...) - pattern: return django.http.HttpResponse(..., request.$W[...], ...) - pattern: django.http.HttpResponse(..., $S.format(..., request.$W, ...), ...) - pattern: django.http.HttpResponse(..., $S % request.$W, ...) - pattern: django.http.HttpResponse(..., f"...{request.$W}...", ...) - pattern: django.http.HttpResponse(..., request.$W, ...) - pattern: | $DATA = request.$W ... django.http.HttpResponse(..., $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $DATA ... django.http.HttpResponse(..., $INTERM, ...) - pattern: | $DATA = request.$W ... django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W ... $INTERM = $STR.format(..., $DATA, ...) ... django.http.HttpResponse(..., $INTERM, ...) - pattern: | $DATA = request.$W ... django.http.HttpResponse(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR % $DATA ... django.http.HttpResponse(..., $INTERM, ...) - pattern: | $DATA = request.$W ... django.http.HttpResponse(..., f"...{$DATA}...", ...) - pattern: $A = django.http.HttpResponse(..., request.$W, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR + $DATA ... $A = django.http.HttpResponse(..., $INTERM, ...) - pattern: return django.http.HttpResponse(..., request.$W, ...) - pattern: | $DATA = request.$W ... $INTERM = f"...{$DATA}..." ... django.http.HttpResponse(..., $INTERM, ...) - pattern: | $DATA = request.$W ... django.http.HttpResponse(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR + $DATA ... django.http.HttpResponse(..., $INTERM, ...) - id: python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest message: Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss category: security technology: - django cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest shortlink: https://sg.run/DoZP semgrep.dev: rule: r_id: 9496 rv_id: 1263399 rule_id: 5rUOX1 version_id: RGT0LY6 url: https://semgrep.dev/playground/r/RGT0LY6/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest origin: community languages: - python severity: WARNING patterns: - pattern-inside: | def $FUNC(...): ... - pattern-either: - pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W.get(...), ...) - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W.get(...)}...", ...) - pattern: django.http.HttpResponseBadRequest(..., request.$W.get(...), ...) - pattern: | $DATA = request.$W.get(...) ... django.http.HttpResponseBadRequest(..., $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $DATA ... django.http.HttpResponseBadRequest(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR.format(..., $DATA, ...) ... django.http.HttpResponseBadRequest(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... django.http.HttpResponseBadRequest(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR % $DATA ... django.http.HttpResponseBadRequest(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = f"...{$DATA}..." ... django.http.HttpResponseBadRequest(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... django.http.HttpResponseBadRequest(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR + $DATA ... django.http.HttpResponseBadRequest(..., $INTERM, ...) - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W.get(...), ...) - pattern: return django.http.HttpResponseBadRequest(..., request.$W.get(...), ...) - pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W(...), ...), ...) - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W(...), ...) - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W(...)}...", ...) - pattern: django.http.HttpResponseBadRequest(..., request.$W(...), ...) - pattern: | $DATA = request.$W(...) ... django.http.HttpResponseBadRequest(..., $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $DATA ... django.http.HttpResponseBadRequest(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR.format(..., $DATA, ...) ... django.http.HttpResponseBadRequest(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... django.http.HttpResponseBadRequest(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR % $DATA ... django.http.HttpResponseBadRequest(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W(...) ... $INTERM = f"...{$DATA}..." ... django.http.HttpResponseBadRequest(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... django.http.HttpResponseBadRequest(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR + $DATA ... django.http.HttpResponseBadRequest(..., $INTERM, ...) - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W(...), ...) - pattern: return django.http.HttpResponseBadRequest(..., request.$W(...), ...) - pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W[...], ...), ...) - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W[...], ...) - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W[...]}...", ...) - pattern: django.http.HttpResponseBadRequest(..., request.$W[...], ...) - pattern: | $DATA = request.$W[...] ... django.http.HttpResponseBadRequest(..., $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $DATA ... django.http.HttpResponseBadRequest(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR.format(..., $DATA, ...) ... django.http.HttpResponseBadRequest(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... django.http.HttpResponseBadRequest(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR % $DATA ... django.http.HttpResponseBadRequest(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W[...] ... $INTERM = f"...{$DATA}..." ... django.http.HttpResponseBadRequest(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... django.http.HttpResponseBadRequest(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR + $DATA ... django.http.HttpResponseBadRequest(..., $INTERM, ...) - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W[...], ...) - pattern: return django.http.HttpResponseBadRequest(..., request.$W[...], ...) - pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W, ...), ...) - pattern: django.http.HttpResponseBadRequest(..., $S % request.$W, ...) - pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W}...", ...) - pattern: django.http.HttpResponseBadRequest(..., request.$W, ...) - pattern: | $DATA = request.$W ... django.http.HttpResponseBadRequest(..., $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $DATA ... django.http.HttpResponseBadRequest(..., $INTERM, ...) - pattern: | $DATA = request.$W ... django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W ... $INTERM = $STR.format(..., $DATA, ...) ... django.http.HttpResponseBadRequest(..., $INTERM, ...) - pattern: | $DATA = request.$W ... django.http.HttpResponseBadRequest(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR % $DATA ... django.http.HttpResponseBadRequest(..., $INTERM, ...) - pattern: | $DATA = request.$W ... django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W ... $INTERM = f"...{$DATA}..." ... django.http.HttpResponseBadRequest(..., $INTERM, ...) - pattern: | $DATA = request.$W ... django.http.HttpResponseBadRequest(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR + $DATA ... django.http.HttpResponseBadRequest(..., $INTERM, ...) - pattern: $A = django.http.HttpResponseBadRequest(..., request.$W, ...) - pattern: return django.http.HttpResponseBadRequest(..., request.$W, ...) - id: python.django.security.injection.request-data-fileresponse.request-data-fileresponse message: Found user-controlled request data being passed into a file open, which is them passed as an argument into the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse. metadata: cwe: - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss category: security technology: - django cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Path Traversal source: https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse shortlink: https://sg.run/W862 semgrep.dev: rule: r_id: 9497 rv_id: 1263400 rule_id: GdU7QR version_id: A8Tgd1K url: https://semgrep.dev/playground/r/A8Tgd1K/python.django.security.injection.request-data-fileresponse.request-data-fileresponse origin: community languages: - python severity: WARNING patterns: - pattern-inside: | def $FUNC(...): ... - pattern-either: - pattern: django.http.FileResponse(..., request.$W.get(...), ...) - pattern: | $DATA = request.$W.get(...) ... django.http.FileResponse(..., open($DATA, ...), ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = open($DATA, ...) ... django.http.FileResponse(..., $INTERM, ...) - pattern: $A = django.http.FileResponse(..., request.$W.get(...), ...) - pattern: return django.http.FileResponse(..., request.$W.get(...), ...) - pattern: django.http.FileResponse(..., request.$W(...), ...) - pattern: | $DATA = request.$W(...) ... django.http.FileResponse(..., open($DATA, ...), ...) - pattern: | $DATA = request.$W(...) ... $INTERM = open($DATA, ...) ... django.http.FileResponse(..., $INTERM, ...) - pattern: $A = django.http.FileResponse(..., request.$W(...), ...) - pattern: return django.http.FileResponse(..., request.$W(...), ...) - pattern: django.http.FileResponse(..., request.$W[...], ...) - pattern: | $DATA = request.$W[...] ... django.http.FileResponse(..., open($DATA, ...), ...) - pattern: | $DATA = request.$W[...] ... $INTERM = open($DATA, ...) ... django.http.FileResponse(..., $INTERM, ...) - pattern: $A = django.http.FileResponse(..., request.$W[...], ...) - pattern: return django.http.FileResponse(..., request.$W[...], ...) - pattern: django.http.FileResponse(..., request.$W, ...) - pattern: | $DATA = request.$W ... django.http.FileResponse(..., open($DATA, ...), ...) - pattern: | $DATA = request.$W ... $INTERM = open($DATA, ...) ... django.http.FileResponse(..., $INTERM, ...) - pattern: $A = django.http.FileResponse(..., request.$W, ...) - pattern: return django.http.FileResponse(..., request.$W, ...) - id: python.django.security.injection.command.command-injection-os-system.command-injection-os-system message: Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection for more information. metadata: cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/www-community/attacks/Command_Injection category: security technology: - django cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system shortlink: https://sg.run/Gen2 semgrep.dev: rule: r_id: 9504 rv_id: 1263387 rule_id: KxUbp2 version_id: ExTExPo url: https://semgrep.dev/playground/r/ExTExPo/python.django.security.injection.command.command-injection-os-system.command-injection-os-system origin: community languages: - python severity: ERROR patterns: - pattern-inside: | def $FUNC(...): ... - pattern-either: - pattern: os.system(..., request.$W.get(...), ...) - pattern: os.system(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: os.system(..., $S % request.$W.get(...), ...) - pattern: os.system(..., f"...{request.$W.get(...)}...", ...) - pattern: | $DATA = request.$W.get(...) ... os.system(..., $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $DATA ... os.system(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... os.system(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR.format(..., $DATA, ...) ... os.system(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... os.system(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR % $DATA ... os.system(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... os.system(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = f"...{$DATA}..." ... os.system(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... os.system(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR + $DATA ... os.system(..., $INTERM, ...) - pattern: $A = os.system(..., request.$W.get(...), ...) - pattern: $A = os.system(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: $A = os.system(..., $S % request.$W.get(...), ...) - pattern: $A = os.system(..., f"...{request.$W.get(...)}...", ...) - pattern: return os.system(..., request.$W.get(...), ...) - pattern: return os.system(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: return os.system(..., $S % request.$W.get(...), ...) - pattern: return os.system(..., f"...{request.$W.get(...)}...", ...) - pattern: os.system(..., request.$W(...), ...) - pattern: os.system(..., $S.format(..., request.$W(...), ...), ...) - pattern: os.system(..., $S % request.$W(...), ...) - pattern: os.system(..., f"...{request.$W(...)}...", ...) - pattern: | $DATA = request.$W(...) ... os.system(..., $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $DATA ... os.system(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... os.system(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR.format(..., $DATA, ...) ... os.system(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... os.system(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR % $DATA ... os.system(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... os.system(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W(...) ... $INTERM = f"...{$DATA}..." ... os.system(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... os.system(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR + $DATA ... os.system(..., $INTERM, ...) - pattern: $A = os.system(..., request.$W(...), ...) - pattern: $A = os.system(..., $S.format(..., request.$W(...), ...), ...) - pattern: $A = os.system(..., $S % request.$W(...), ...) - pattern: $A = os.system(..., f"...{request.$W(...)}...", ...) - pattern: return os.system(..., request.$W(...), ...) - pattern: return os.system(..., $S.format(..., request.$W(...), ...), ...) - pattern: return os.system(..., $S % request.$W(...), ...) - pattern: return os.system(..., f"...{request.$W(...)}...", ...) - pattern: os.system(..., request.$W[...], ...) - pattern: os.system(..., $S.format(..., request.$W[...], ...), ...) - pattern: os.system(..., $S % request.$W[...], ...) - pattern: os.system(..., f"...{request.$W[...]}...", ...) - pattern: | $DATA = request.$W[...] ... os.system(..., $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $DATA ... os.system(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... os.system(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR.format(..., $DATA, ...) ... os.system(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... os.system(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR % $DATA ... os.system(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... os.system(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W[...] ... $INTERM = f"...{$DATA}..." ... os.system(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... os.system(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR + $DATA ... os.system(..., $INTERM, ...) - pattern: $A = os.system(..., request.$W[...], ...) - pattern: $A = os.system(..., $S.format(..., request.$W[...], ...), ...) - pattern: $A = os.system(..., $S % request.$W[...], ...) - pattern: $A = os.system(..., f"...{request.$W[...]}...", ...) - pattern: return os.system(..., request.$W[...], ...) - pattern: return os.system(..., $S.format(..., request.$W[...], ...), ...) - pattern: return os.system(..., $S % request.$W[...], ...) - pattern: return os.system(..., f"...{request.$W[...]}...", ...) - pattern: os.system(..., request.$W, ...) - pattern: os.system(..., $S.format(..., request.$W, ...), ...) - pattern: os.system(..., $S % request.$W, ...) - pattern: os.system(..., f"...{request.$W}...", ...) - pattern: | $DATA = request.$W ... os.system(..., $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $DATA ... os.system(..., $INTERM, ...) - pattern: | $DATA = request.$W ... os.system(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W ... $INTERM = $STR.format(..., $DATA, ...) ... os.system(..., $INTERM, ...) - pattern: | $DATA = request.$W ... os.system(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR % $DATA ... os.system(..., $INTERM, ...) - pattern: | $DATA = request.$W ... os.system(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W ... $INTERM = f"...{$DATA}..." ... os.system(..., $INTERM, ...) - pattern: | $DATA = request.$W ... os.system(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR + $DATA ... os.system(..., $INTERM, ...) - pattern: $A = os.system(..., request.$W, ...) - pattern: $A = os.system(..., $S.format(..., request.$W, ...), ...) - pattern: $A = os.system(..., $S % request.$W, ...) - pattern: $A = os.system(..., f"...{request.$W}...", ...) - pattern: return os.system(..., request.$W, ...) - pattern: return os.system(..., $S.format(..., request.$W, ...), ...) - pattern: return os.system(..., $S % request.$W, ...) - pattern: return os.system(..., f"...{request.$W}...", ...) - id: python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open message: Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library. metadata: cwe: - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://owasp.org/www-community/attacks/Path_Traversal category: security technology: - django cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Path Traversal source: https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open shortlink: https://sg.run/W8qg semgrep.dev: rule: r_id: 9509 rv_id: 1263396 rule_id: oqUe7z version_id: JdTzxAw url: https://semgrep.dev/playground/r/JdTzxAw/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open origin: community languages: - python severity: WARNING patterns: - pattern-inside: | def $FUNC(...): ... - pattern-either: - pattern: open(..., request.$W.get(...), ...) - pattern: open(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: open(..., $S % request.$W.get(...), ...) - pattern: open(..., f"...{request.$W.get(...)}...", ...) - pattern: | $DATA = request.$W.get(...) ... open(..., $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $DATA ... open(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $DATA ... with open(..., $INTERM, ...) as $FD: ... - pattern: | $DATA = request.$W.get(...) ... open(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR.format(..., $DATA, ...) ... open(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR.format(..., $DATA, ...) ... with open(..., $INTERM, ...) as $FD: ... - pattern: | $DATA = request.$W.get(...) ... open(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR % $DATA ... open(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR % $DATA ... with open(..., $INTERM, ...) as $FD: ... - pattern: | $DATA = request.$W.get(...) ... open(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = f"...{$DATA}..." ... open(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = f"...{$DATA}..." ... with open(..., $INTERM, ...) as $FD: ... - pattern: | $DATA = request.$W.get(...) ... open(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR + $DATA ... open(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR + $DATA ... with open(..., $INTERM, ...) as $FD: ... - pattern: $A = open(..., request.$W.get(...), ...) - pattern: $A = open(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: $A = open(..., $S % request.$W.get(...), ...) - pattern: $A = open(..., f"...{request.$W.get(...)}...", ...) - pattern: return open(..., request.$W.get(...), ...) - pattern: return open(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: return open(..., $S % request.$W.get(...), ...) - pattern: return open(..., f"...{request.$W.get(...)}...", ...) - pattern: | $DATA = request.$W.get(...) ... with open(..., $DATA, ...) as $FD: ... - pattern: open(..., request.$W(...), ...) - pattern: open(..., $S.format(..., request.$W(...), ...), ...) - pattern: open(..., $S % request.$W(...), ...) - pattern: open(..., f"...{request.$W(...)}...", ...) - pattern: | $DATA = request.$W(...) ... open(..., $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $DATA ... open(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $DATA ... with open(..., $INTERM, ...) as $FD: ... - pattern: | $DATA = request.$W(...) ... open(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR.format(..., $DATA, ...) ... open(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR.format(..., $DATA, ...) ... with open(..., $INTERM, ...) as $FD: ... - pattern: | $DATA = request.$W(...) ... open(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR % $DATA ... open(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR % $DATA ... with open(..., $INTERM, ...) as $FD: ... - pattern: | $DATA = request.$W(...) ... open(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W(...) ... $INTERM = f"...{$DATA}..." ... open(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = f"...{$DATA}..." ... with open(..., $INTERM, ...) as $FD: ... - pattern: | $DATA = request.$W(...) ... open(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR + $DATA ... open(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR + $DATA ... with open(..., $INTERM, ...) as $FD: ... - pattern: $A = open(..., request.$W(...), ...) - pattern: $A = open(..., $S.format(..., request.$W(...), ...), ...) - pattern: $A = open(..., $S % request.$W(...), ...) - pattern: $A = open(..., f"...{request.$W(...)}...", ...) - pattern: return open(..., request.$W(...), ...) - pattern: return open(..., $S.format(..., request.$W(...), ...), ...) - pattern: return open(..., $S % request.$W(...), ...) - pattern: return open(..., f"...{request.$W(...)}...", ...) - pattern: | $DATA = request.$W(...) ... with open(..., $DATA, ...) as $FD: ... - pattern: open(..., request.$W[...], ...) - pattern: open(..., $S.format(..., request.$W[...], ...), ...) - pattern: open(..., $S % request.$W[...], ...) - pattern: open(..., f"...{request.$W[...]}...", ...) - pattern: | $DATA = request.$W[...] ... open(..., $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $DATA ... open(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $DATA ... with open(..., $INTERM, ...) as $FD: ... - pattern: | $DATA = request.$W[...] ... open(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR.format(..., $DATA, ...) ... open(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR.format(..., $DATA, ...) ... with open(..., $INTERM, ...) as $FD: ... - pattern: | $DATA = request.$W[...] ... open(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR % $DATA ... open(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR % $DATA ... with open(..., $INTERM, ...) as $FD: ... - pattern: | $DATA = request.$W[...] ... open(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W[...] ... $INTERM = f"...{$DATA}..." ... open(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = f"...{$DATA}..." ... with open(..., $INTERM, ...) as $FD: ... - pattern: | $DATA = request.$W[...] ... open(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR + $DATA ... open(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR + $DATA ... with open(..., $INTERM, ...) as $FD: ... - pattern: $A = open(..., request.$W[...], ...) - pattern: $A = open(..., $S.format(..., request.$W[...], ...), ...) - pattern: $A = open(..., $S % request.$W[...], ...) - pattern: $A = open(..., f"...{request.$W[...]}...", ...) - pattern: return open(..., request.$W[...], ...) - pattern: return open(..., $S.format(..., request.$W[...], ...), ...) - pattern: return open(..., $S % request.$W[...], ...) - pattern: return open(..., f"...{request.$W[...]}...", ...) - pattern: | $DATA = request.$W[...] ... with open(..., $DATA, ...) as $FD: ... - pattern: open(..., request.$W, ...) - pattern: open(..., $S.format(..., request.$W, ...), ...) - pattern: open(..., $S % request.$W, ...) - pattern: open(..., f"...{request.$W}...", ...) - pattern: | $DATA = request.$W ... open(..., $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $DATA ... open(..., $INTERM, ...) - pattern: | $DATA = request.$W ... $INTERM = $DATA ... with open(..., $INTERM, ...) as $FD: ... - pattern: | $DATA = request.$W ... open(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W ... $INTERM = $STR.format(..., $DATA, ...) ... open(..., $INTERM, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR.format(..., $DATA, ...) ... with open(..., $INTERM, ...) as $FD: ... - pattern: | $DATA = request.$W ... open(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR % $DATA ... open(..., $INTERM, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR % $DATA ... with open(..., $INTERM, ...) as $FD: ... - pattern: | $DATA = request.$W ... open(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W ... $INTERM = f"...{$DATA}..." ... open(..., $INTERM, ...) - pattern: | $DATA = request.$W ... $INTERM = f"...{$DATA}..." ... with open(..., $INTERM, ...) as $FD: ... - pattern: | $DATA = request.$W ... open(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR + $DATA ... open(..., $INTERM, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR + $DATA ... with open(..., $INTERM, ...) as $FD: ... - pattern: $A = open(..., request.$W, ...) - pattern: $A = open(..., $S.format(..., request.$W, ...), ...) - pattern: $A = open(..., $S % request.$W, ...) - pattern: $A = open(..., f"...{request.$W}...", ...) - pattern: return open(..., request.$W, ...) - pattern: return open(..., $S.format(..., request.$W, ...), ...) - pattern: return open(..., $S % request.$W, ...) - pattern: return open(..., f"...{request.$W}...", ...) - pattern: | $DATA = request.$W ... with open(..., $DATA, ...) as $FD: ... - id: python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where message: User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string. metadata: cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.djangoproject.com/en/3.0/ref/models/expressions/#.objects.extra category: security technology: - django cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where shortlink: https://sg.run/0Ql5 semgrep.dev: rule: r_id: 9510 rv_id: 1263402 rule_id: zdUkx1 version_id: DkTRb4l url: https://semgrep.dev/playground/r/DkTRb4l/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where origin: community languages: - python severity: WARNING patterns: - pattern-inside: | def $FUNC(...): ... - pattern-either: - pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W.get(...), ...), ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W.get(...), ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W.get(...)}...", ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...) - pattern: | $DATA = request.$W.get(...) ... $MODEL.objects.extra(..., where=[..., $DATA, ...], ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $DATA ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - pattern: | $DATA = request.$W.get(...) ... $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR.format(..., $DATA, ...) ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - pattern: | $DATA = request.$W.get(...) ... $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR % $DATA ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - pattern: | $DATA = request.$W.get(...) ... $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = f"...{$DATA}..." ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - pattern: | $DATA = request.$W.get(...) ... $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR + $DATA ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...) - pattern: return $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W(...), ...), ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W(...), ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W(...)}...", ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...) - pattern: | $DATA = request.$W(...) ... $MODEL.objects.extra(..., where=[..., $DATA, ...], ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $DATA ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - pattern: | $DATA = request.$W(...) ... $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR.format(..., $DATA, ...) ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - pattern: | $DATA = request.$W(...) ... $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR % $DATA ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - pattern: | $DATA = request.$W(...) ... $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...) - pattern: | $DATA = request.$W(...) ... $INTERM = f"...{$DATA}..." ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - pattern: | $DATA = request.$W(...) ... $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR + $DATA ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...) - pattern: return $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W[...], ...), ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W[...], ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W[...]}...", ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...) - pattern: | $DATA = request.$W[...] ... $MODEL.objects.extra(..., where=[..., $DATA, ...], ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $DATA ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - pattern: | $DATA = request.$W[...] ... $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR.format(..., $DATA, ...) ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - pattern: | $DATA = request.$W[...] ... $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR % $DATA ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - pattern: | $DATA = request.$W[...] ... $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...) - pattern: | $DATA = request.$W[...] ... $INTERM = f"...{$DATA}..." ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - pattern: | $DATA = request.$W[...] ... $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR + $DATA ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...) - pattern: return $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W, ...), ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W, ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W}...", ...], ...) - pattern: $MODEL.objects.extra(..., where=[..., request.$W, ...], ...) - pattern: | $DATA = request.$W ... $MODEL.objects.extra(..., where=[..., $DATA, ...], ...) - pattern: | $DATA = request.$W ... $INTERM = $DATA ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - pattern: | $DATA = request.$W ... $MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...) - pattern: | $DATA = request.$W ... $INTERM = $STR.format(..., $DATA, ...) ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - pattern: | $DATA = request.$W ... $MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...) - pattern: | $DATA = request.$W ... $INTERM = $STR % $DATA ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - pattern: | $DATA = request.$W ... $MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...) - pattern: | $DATA = request.$W ... $INTERM = f"...{$DATA}..." ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - pattern: | $DATA = request.$W ... $MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...) - pattern: | $DATA = request.$W ... $INTERM = $STR + $DATA ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W, ...], ...) - pattern: return $MODEL.objects.extra(..., where=[..., request.$W, ...], ...) - pattern: | $DATA = request.$W.get(...) ... $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...) - pattern: | $DATA = request.$W[...] ... $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...) - pattern: | $DATA = request.$W(...) ... $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...) - pattern: | $DATA = request.$W ... $MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR % (..., $DATA, ...) ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR % (..., $DATA, ...) ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR % (..., $DATA, ...) ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - pattern: | $DATA = request.$W ... $INTERM = $STR % (..., $DATA, ...) ... $MODEL.objects.extra(..., where=[..., $INTERM, ...], ...) - id: python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql message: User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string. metadata: cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.expressions.RawSQL category: security technology: - django cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql shortlink: https://sg.run/Kl4X semgrep.dev: rule: r_id: 9511 rv_id: 1263403 rule_id: pKUOBp version_id: WrTqK2L url: https://semgrep.dev/playground/r/WrTqK2L/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql origin: community languages: - python severity: WARNING patterns: - pattern-inside: | def $FUNC(...): ... - pattern-either: - pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W.get(...), ...) - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W.get(...)}...", ...) - pattern: django.db.models.expressions.RawSQL(..., request.$W.get(...), ...) - pattern: | $DATA = request.$W.get(...) ... django.db.models.expressions.RawSQL(..., $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $DATA ... django.db.models.expressions.RawSQL(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR.format(..., $DATA, ...) ... django.db.models.expressions.RawSQL(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... django.db.models.expressions.RawSQL(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR % $DATA ... django.db.models.expressions.RawSQL(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = f"...{$DATA}..." ... django.db.models.expressions.RawSQL(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... django.db.models.expressions.RawSQL(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR + $DATA ... django.db.models.expressions.RawSQL(..., $INTERM, ...) - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W.get(...), ...) - pattern: return django.db.models.expressions.RawSQL(..., request.$W.get(...), ...) - pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W(...), ...), ...) - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W(...), ...) - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W(...)}...", ...) - pattern: django.db.models.expressions.RawSQL(..., request.$W(...), ...) - pattern: | $DATA = request.$W(...) ... django.db.models.expressions.RawSQL(..., $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $DATA ... django.db.models.expressions.RawSQL(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR.format(..., $DATA, ...) ... django.db.models.expressions.RawSQL(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... django.db.models.expressions.RawSQL(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR % $DATA ... django.db.models.expressions.RawSQL(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W(...) ... $INTERM = f"...{$DATA}..." ... django.db.models.expressions.RawSQL(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... django.db.models.expressions.RawSQL(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR + $DATA ... django.db.models.expressions.RawSQL(..., $INTERM, ...) - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W(...), ...) - pattern: return django.db.models.expressions.RawSQL(..., request.$W(...), ...) - pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W[...], ...), ...) - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W[...], ...) - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W[...]}...", ...) - pattern: django.db.models.expressions.RawSQL(..., request.$W[...], ...) - pattern: | $DATA = request.$W[...] ... django.db.models.expressions.RawSQL(..., $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $DATA ... django.db.models.expressions.RawSQL(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR.format(..., $DATA, ...) ... django.db.models.expressions.RawSQL(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... django.db.models.expressions.RawSQL(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR % $DATA ... django.db.models.expressions.RawSQL(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W[...] ... $INTERM = f"...{$DATA}..." ... django.db.models.expressions.RawSQL(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... django.db.models.expressions.RawSQL(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR + $DATA ... django.db.models.expressions.RawSQL(..., $INTERM, ...) - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W[...], ...) - pattern: return django.db.models.expressions.RawSQL(..., request.$W[...], ...) - pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W, ...), ...) - pattern: django.db.models.expressions.RawSQL(..., $S % request.$W, ...) - pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W}...", ...) - pattern: django.db.models.expressions.RawSQL(..., request.$W, ...) - pattern: | $DATA = request.$W ... django.db.models.expressions.RawSQL(..., $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $DATA ... django.db.models.expressions.RawSQL(..., $INTERM, ...) - pattern: | $DATA = request.$W ... django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W ... $INTERM = $STR.format(..., $DATA, ...) ... django.db.models.expressions.RawSQL(..., $INTERM, ...) - pattern: | $DATA = request.$W ... django.db.models.expressions.RawSQL(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR % $DATA ... django.db.models.expressions.RawSQL(..., $INTERM, ...) - pattern: | $DATA = request.$W ... django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W ... $INTERM = f"...{$DATA}..." ... django.db.models.expressions.RawSQL(..., $INTERM, ...) - pattern: | $DATA = request.$W ... django.db.models.expressions.RawSQL(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR + $DATA ... django.db.models.expressions.RawSQL(..., $INTERM, ...) - pattern: $A = django.db.models.expressions.RawSQL(..., request.$W, ...) - pattern: return django.db.models.expressions.RawSQL(..., request.$W, ...) - pattern: | $DATA = request.$W.get(...) ... django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...) - pattern: | $DATA = request.$W[...] ... django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...) - pattern: | $DATA = request.$W(...) ... django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...) - pattern: | $DATA = request.$W ... django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR % (..., $DATA, ...) ... django.db.models.expressions.RawSQL($INTERM, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR % (..., $DATA, ...) ... django.db.models.expressions.RawSQL($INTERM, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR % (..., $DATA, ...) ... django.db.models.expressions.RawSQL($INTERM, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR % (..., $DATA, ...) ... django.db.models.expressions.RawSQL($INTERM, ...) - id: python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute message: User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`. metadata: cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection category: security technology: - django cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute shortlink: https://sg.run/qx7y semgrep.dev: rule: r_id: 9512 rv_id: 1263404 rule_id: 2ZUbDL version_id: 0bTKzRj url: https://semgrep.dev/playground/r/0bTKzRj/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute origin: community languages: - python severity: WARNING patterns: - pattern-inside: | def $FUNC(...): ... - pattern-either: - pattern: $CURSOR.execute(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: $CURSOR.execute(..., $S % request.$W.get(...), ...) - pattern: $CURSOR.execute(..., f"...{request.$W.get(...)}...", ...) - pattern: $CURSOR.execute(..., request.$W.get(...), ...) - pattern: | $DATA = request.$W.get(...) ... $CURSOR.execute(..., $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $DATA ... $CURSOR.execute(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR.format(..., $DATA, ...) ... $CURSOR.execute(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... $CURSOR.execute(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR % $DATA ... $CURSOR.execute(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... $CURSOR.execute(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = f"...{$DATA}..." ... $CURSOR.execute(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... $CURSOR.execute(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR + $DATA ... $CURSOR.execute(..., $INTERM, ...) - pattern: $A = $CURSOR.execute(..., request.$W.get(...), ...) - pattern: return $CURSOR.execute(..., request.$W.get(...), ...) - pattern: $CURSOR.execute(..., $S.format(..., request.$W(...), ...), ...) - pattern: $CURSOR.execute(..., $S % request.$W(...), ...) - pattern: $CURSOR.execute(..., f"...{request.$W(...)}...", ...) - pattern: $CURSOR.execute(..., request.$W(...), ...) - pattern: | $DATA = request.$W(...) ... $CURSOR.execute(..., $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $DATA ... $CURSOR.execute(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR.format(..., $DATA, ...) ... $CURSOR.execute(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... $CURSOR.execute(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR % $DATA ... $CURSOR.execute(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... $CURSOR.execute(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W(...) ... $INTERM = f"...{$DATA}..." ... $CURSOR.execute(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... $CURSOR.execute(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR + $DATA ... $CURSOR.execute(..., $INTERM, ...) - pattern: $A = $CURSOR.execute(..., request.$W(...), ...) - pattern: return $CURSOR.execute(..., request.$W(...), ...) - pattern: $CURSOR.execute(..., $S.format(..., request.$W[...], ...), ...) - pattern: $CURSOR.execute(..., $S % request.$W[...], ...) - pattern: $CURSOR.execute(..., f"...{request.$W[...]}...", ...) - pattern: $CURSOR.execute(..., request.$W[...], ...) - pattern: | $DATA = request.$W[...] ... $CURSOR.execute(..., $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $DATA ... $CURSOR.execute(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR.format(..., $DATA, ...) ... $CURSOR.execute(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... $CURSOR.execute(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR % $DATA ... $CURSOR.execute(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... $CURSOR.execute(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W[...] ... $INTERM = f"...{$DATA}..." ... $CURSOR.execute(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... $CURSOR.execute(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR + $DATA ... $CURSOR.execute(..., $INTERM, ...) - pattern: $A = $CURSOR.execute(..., request.$W[...], ...) - pattern: return $CURSOR.execute(..., request.$W[...], ...) - pattern: $CURSOR.execute(..., $S.format(..., request.$W, ...), ...) - pattern: $CURSOR.execute(..., $S % request.$W, ...) - pattern: $CURSOR.execute(..., f"...{request.$W}...", ...) - pattern: $CURSOR.execute(..., request.$W, ...) - pattern: | $DATA = request.$W ... $CURSOR.execute(..., $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $DATA ... $CURSOR.execute(..., $INTERM, ...) - pattern: | $DATA = request.$W ... $CURSOR.execute(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W ... $INTERM = $STR.format(..., $DATA, ...) ... $CURSOR.execute(..., $INTERM, ...) - pattern: | $DATA = request.$W ... $CURSOR.execute(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR % $DATA ... $CURSOR.execute(..., $INTERM, ...) - pattern: | $DATA = request.$W ... $CURSOR.execute(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W ... $INTERM = f"...{$DATA}..." ... $CURSOR.execute(..., $INTERM, ...) - pattern: | $DATA = request.$W ... $CURSOR.execute(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR + $DATA ... $CURSOR.execute(..., $INTERM, ...) - pattern: $A = $CURSOR.execute(..., request.$W, ...) - pattern: return $CURSOR.execute(..., request.$W, ...) - pattern: | $DATA = request.$W.get(...) ... $CURSOR.execute($STR % (..., $DATA, ...), ...) - pattern: | $DATA = request.$W[...] ... $CURSOR.execute($STR % (..., $DATA, ...), ...) - pattern: | $DATA = request.$W(...) ... $CURSOR.execute($STR % (..., $DATA, ...), ...) - pattern: | $DATA = request.$W ... $CURSOR.execute($STR % (..., $DATA, ...), ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR % (..., $DATA, ...) ... $CURSOR.execute($INTERM, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR % (..., $DATA, ...) ... $CURSOR.execute($INTERM, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR % (..., $DATA, ...) ... $CURSOR.execute($INTERM, ...) - pattern: |- $DATA = request.$W ... $INTERM = $STR % (..., $DATA, ...) ... $CURSOR.execute($INTERM, ...) - id: python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw message: Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`. metadata: cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection category: security technology: - django cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw shortlink: https://sg.run/l2v9 semgrep.dev: rule: r_id: 9513 rv_id: 1263405 rule_id: X5U8v5 version_id: K3TKkBW url: https://semgrep.dev/playground/r/K3TKkBW/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw origin: community languages: - python severity: WARNING patterns: - pattern-inside: | def $FUNC(...): ... - pattern-either: - pattern: $MODEL.objects.raw(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: $MODEL.objects.raw(..., $S % request.$W.get(...), ...) - pattern: $MODEL.objects.raw(..., f"...{request.$W.get(...)}...", ...) - pattern: $MODEL.objects.raw(..., request.$W.get(...), ...) - pattern: | $DATA = request.$W.get(...) ... $MODEL.objects.raw(..., $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $DATA ... $MODEL.objects.raw(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR.format(..., $DATA, ...) ... $MODEL.objects.raw(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... $MODEL.objects.raw(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR % $DATA ... $MODEL.objects.raw(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... $MODEL.objects.raw(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = f"...{$DATA}..." ... $MODEL.objects.raw(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... $MODEL.objects.raw(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR + $DATA ... $MODEL.objects.raw(..., $INTERM, ...) - pattern: $A = $MODEL.objects.raw(..., request.$W.get(...), ...) - pattern: return $MODEL.objects.raw(..., request.$W.get(...), ...) - pattern: $MODEL.objects.raw(..., $S.format(..., request.$W(...), ...), ...) - pattern: $MODEL.objects.raw(..., $S % request.$W(...), ...) - pattern: $MODEL.objects.raw(..., f"...{request.$W(...)}...", ...) - pattern: $MODEL.objects.raw(..., request.$W(...), ...) - pattern: | $DATA = request.$W(...) ... $MODEL.objects.raw(..., $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $DATA ... $MODEL.objects.raw(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR.format(..., $DATA, ...) ... $MODEL.objects.raw(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... $MODEL.objects.raw(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR % $DATA ... $MODEL.objects.raw(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... $MODEL.objects.raw(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W(...) ... $INTERM = f"...{$DATA}..." ... $MODEL.objects.raw(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... $MODEL.objects.raw(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR + $DATA ... $MODEL.objects.raw(..., $INTERM, ...) - pattern: $A = $MODEL.objects.raw(..., request.$W(...), ...) - pattern: return $MODEL.objects.raw(..., request.$W(...), ...) - pattern: $MODEL.objects.raw(..., $S.format(..., request.$W[...], ...), ...) - pattern: $MODEL.objects.raw(..., $S % request.$W[...], ...) - pattern: $MODEL.objects.raw(..., f"...{request.$W[...]}...", ...) - pattern: $MODEL.objects.raw(..., request.$W[...], ...) - pattern: | $DATA = request.$W[...] ... $MODEL.objects.raw(..., $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $DATA ... $MODEL.objects.raw(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR.format(..., $DATA, ...) ... $MODEL.objects.raw(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... $MODEL.objects.raw(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR % $DATA ... $MODEL.objects.raw(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... $MODEL.objects.raw(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W[...] ... $INTERM = f"...{$DATA}..." ... $MODEL.objects.raw(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... $MODEL.objects.raw(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR + $DATA ... $MODEL.objects.raw(..., $INTERM, ...) - pattern: $A = $MODEL.objects.raw(..., request.$W[...], ...) - pattern: return $MODEL.objects.raw(..., request.$W[...], ...) - pattern: $MODEL.objects.raw(..., $S.format(..., request.$W, ...), ...) - pattern: $MODEL.objects.raw(..., $S % request.$W, ...) - pattern: $MODEL.objects.raw(..., f"...{request.$W}...", ...) - pattern: $MODEL.objects.raw(..., request.$W, ...) - pattern: | $DATA = request.$W ... $MODEL.objects.raw(..., $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $DATA ... $MODEL.objects.raw(..., $INTERM, ...) - pattern: | $DATA = request.$W ... $MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W ... $INTERM = $STR.format(..., $DATA, ...) ... $MODEL.objects.raw(..., $INTERM, ...) - pattern: | $DATA = request.$W ... $MODEL.objects.raw(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR % $DATA ... $MODEL.objects.raw(..., $INTERM, ...) - pattern: | $DATA = request.$W ... $MODEL.objects.raw(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W ... $INTERM = f"...{$DATA}..." ... $MODEL.objects.raw(..., $INTERM, ...) - pattern: | $DATA = request.$W ... $MODEL.objects.raw(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR + $DATA ... $MODEL.objects.raw(..., $INTERM, ...) - pattern: $A = $MODEL.objects.raw(..., request.$W, ...) - pattern: return $MODEL.objects.raw(..., request.$W, ...) - pattern: | $DATA = request.$W.get(...) ... $MODEL.objects.raw($STR % (..., $DATA, ...), ...) - pattern: | $DATA = request.$W[...] ... $MODEL.objects.raw($STR % (..., $DATA, ...), ...) - pattern: | $DATA = request.$W(...) ... $MODEL.objects.raw($STR % (..., $DATA, ...), ...) - pattern: | $DATA = request.$W ... $MODEL.objects.raw($STR % (..., $DATA, ...), ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR % (..., $DATA, ...) ... $MODEL.objects.raw($INTERM, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR % (..., $DATA, ...) ... $MODEL.objects.raw($INTERM, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR % (..., $DATA, ...) ... $MODEL.objects.raw($INTERM, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR % (..., $DATA, ...) ... $MODEL.objects.raw($INTERM, ...) - id: python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests message: Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities. metadata: cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery category: security technology: - django cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Server-Side Request Forgery (SSRF) source: https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests shortlink: https://sg.run/YvY4 semgrep.dev: rule: r_id: 9514 rv_id: 1263406 rule_id: j2UvEw version_id: qkTR7zn url: https://semgrep.dev/playground/r/qkTR7zn/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests origin: community languages: - python severity: ERROR patterns: - pattern-inside: | def $FUNC(...): ... - pattern-either: - pattern: requests.$METHOD(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: requests.$METHOD(..., $S % request.$W.get(...), ...) - pattern: requests.$METHOD(..., f"...{request.$W.get(...)}...", ...) - pattern: requests.$METHOD(..., request.$W.get(...), ...) - pattern: | $DATA = request.$W.get(...) ... requests.$METHOD(..., $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $DATA ... requests.$METHOD(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... requests.$METHOD(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR.format(..., $DATA, ...) ... requests.$METHOD(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... requests.$METHOD(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR % $DATA ... requests.$METHOD(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... requests.$METHOD(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = f"...{$DATA}..." ... requests.$METHOD(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... requests.$METHOD(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR + $DATA ... requests.$METHOD(..., $INTERM, ...) - pattern: $A = requests.$METHOD(..., request.$W.get(...), ...) - pattern: return requests.$METHOD(..., request.$W.get(...), ...) - pattern: requests.$METHOD(..., $S.format(..., request.$W(...), ...), ...) - pattern: requests.$METHOD(..., $S % request.$W(...), ...) - pattern: requests.$METHOD(..., f"...{request.$W(...)}...", ...) - pattern: requests.$METHOD(..., request.$W(...), ...) - pattern: | $DATA = request.$W(...) ... requests.$METHOD(..., $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $DATA ... requests.$METHOD(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... requests.$METHOD(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR.format(..., $DATA, ...) ... requests.$METHOD(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... requests.$METHOD(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR % $DATA ... requests.$METHOD(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... requests.$METHOD(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W(...) ... $INTERM = f"...{$DATA}..." ... requests.$METHOD(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... requests.$METHOD(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR + $DATA ... requests.$METHOD(..., $INTERM, ...) - pattern: $A = requests.$METHOD(..., request.$W(...), ...) - pattern: return requests.$METHOD(..., request.$W(...), ...) - pattern: requests.$METHOD(..., $S.format(..., request.$W[...], ...), ...) - pattern: requests.$METHOD(..., $S % request.$W[...], ...) - pattern: requests.$METHOD(..., f"...{request.$W[...]}...", ...) - pattern: requests.$METHOD(..., request.$W[...], ...) - pattern: | $DATA = request.$W[...] ... requests.$METHOD(..., $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $DATA ... requests.$METHOD(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... requests.$METHOD(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR.format(..., $DATA, ...) ... requests.$METHOD(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... requests.$METHOD(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR % $DATA ... requests.$METHOD(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... requests.$METHOD(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W[...] ... $INTERM = f"...{$DATA}..." ... requests.$METHOD(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... requests.$METHOD(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR + $DATA ... requests.$METHOD(..., $INTERM, ...) - pattern: $A = requests.$METHOD(..., request.$W[...], ...) - pattern: return requests.$METHOD(..., request.$W[...], ...) - pattern: requests.$METHOD(..., $S.format(..., request.$W, ...), ...) - pattern: requests.$METHOD(..., $S % request.$W, ...) - pattern: requests.$METHOD(..., f"...{request.$W}...", ...) - pattern: requests.$METHOD(..., request.$W, ...) - pattern: | $DATA = request.$W ... requests.$METHOD(..., $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $DATA ... requests.$METHOD(..., $INTERM, ...) - pattern: | $DATA = request.$W ... requests.$METHOD(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W ... $INTERM = $STR.format(..., $DATA, ...) ... requests.$METHOD(..., $INTERM, ...) - pattern: | $DATA = request.$W ... requests.$METHOD(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR % $DATA ... requests.$METHOD(..., $INTERM, ...) - pattern: | $DATA = request.$W ... requests.$METHOD(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W ... $INTERM = f"...{$DATA}..." ... requests.$METHOD(..., $INTERM, ...) - pattern: | $DATA = request.$W ... requests.$METHOD(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR + $DATA ... requests.$METHOD(..., $INTERM, ...) - pattern: $A = requests.$METHOD(..., request.$W, ...) - pattern: return requests.$METHOD(..., request.$W, ...) - id: python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib message: Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. metadata: cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery category: security technology: - django cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Server-Side Request Forgery (SSRF) source: https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib shortlink: https://sg.run/6n2B semgrep.dev: rule: r_id: 9515 rv_id: 1263407 rule_id: 10UKDo version_id: l4TJRwD url: https://semgrep.dev/playground/r/l4TJRwD/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib origin: community languages: - python severity: ERROR patterns: - pattern-inside: | def $FUNC(...): ... - pattern-either: - pattern: urllib.request.urlopen(..., $S.format(..., request.$W.get(...), ...), ...) - pattern: urllib.request.urlopen(..., $S % request.$W.get(...), ...) - pattern: urllib.request.urlopen(..., f"...{request.$W.get(...)}...", ...) - pattern: urllib.request.urlopen(..., request.$W.get(...), ...) - pattern: | $DATA = request.$W.get(...) ... urllib.request.urlopen(..., $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $DATA ... urllib.request.urlopen(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR.format(..., $DATA, ...) ... urllib.request.urlopen(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... urllib.request.urlopen(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR % $DATA ... urllib.request.urlopen(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... urllib.request.urlopen(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = f"...{$DATA}..." ... urllib.request.urlopen(..., $INTERM, ...) - pattern: | $DATA = request.$W.get(...) ... urllib.request.urlopen(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W.get(...) ... $INTERM = $STR + $DATA ... urllib.request.urlopen(..., $INTERM, ...) - pattern: $A = urllib.request.urlopen(..., request.$W.get(...), ...) - pattern: return urllib.request.urlopen(..., request.$W.get(...), ...) - pattern: urllib.request.urlopen(..., $S.format(..., request.$W(...), ...), ...) - pattern: urllib.request.urlopen(..., $S % request.$W(...), ...) - pattern: urllib.request.urlopen(..., f"...{request.$W(...)}...", ...) - pattern: urllib.request.urlopen(..., request.$W(...), ...) - pattern: | $DATA = request.$W(...) ... urllib.request.urlopen(..., $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $DATA ... urllib.request.urlopen(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR.format(..., $DATA, ...) ... urllib.request.urlopen(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... urllib.request.urlopen(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR % $DATA ... urllib.request.urlopen(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... urllib.request.urlopen(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W(...) ... $INTERM = f"...{$DATA}..." ... urllib.request.urlopen(..., $INTERM, ...) - pattern: | $DATA = request.$W(...) ... urllib.request.urlopen(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W(...) ... $INTERM = $STR + $DATA ... urllib.request.urlopen(..., $INTERM, ...) - pattern: $A = urllib.request.urlopen(..., request.$W(...), ...) - pattern: return urllib.request.urlopen(..., request.$W(...), ...) - pattern: urllib.request.urlopen(..., $S.format(..., request.$W[...], ...), ...) - pattern: urllib.request.urlopen(..., $S % request.$W[...], ...) - pattern: urllib.request.urlopen(..., f"...{request.$W[...]}...", ...) - pattern: urllib.request.urlopen(..., request.$W[...], ...) - pattern: | $DATA = request.$W[...] ... urllib.request.urlopen(..., $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $DATA ... urllib.request.urlopen(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR.format(..., $DATA, ...) ... urllib.request.urlopen(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... urllib.request.urlopen(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR % $DATA ... urllib.request.urlopen(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... urllib.request.urlopen(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W[...] ... $INTERM = f"...{$DATA}..." ... urllib.request.urlopen(..., $INTERM, ...) - pattern: | $DATA = request.$W[...] ... urllib.request.urlopen(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W[...] ... $INTERM = $STR + $DATA ... urllib.request.urlopen(..., $INTERM, ...) - pattern: $A = urllib.request.urlopen(..., request.$W[...], ...) - pattern: return urllib.request.urlopen(..., request.$W[...], ...) - pattern: urllib.request.urlopen(..., $S.format(..., request.$W, ...), ...) - pattern: urllib.request.urlopen(..., $S % request.$W, ...) - pattern: urllib.request.urlopen(..., f"...{request.$W}...", ...) - pattern: urllib.request.urlopen(..., request.$W, ...) - pattern: | $DATA = request.$W ... urllib.request.urlopen(..., $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $DATA ... urllib.request.urlopen(..., $INTERM, ...) - pattern: | $DATA = request.$W ... urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...) - pattern: | $DATA = request.$W ... $INTERM = $STR.format(..., $DATA, ...) ... urllib.request.urlopen(..., $INTERM, ...) - pattern: | $DATA = request.$W ... urllib.request.urlopen(..., $STR % $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR % $DATA ... urllib.request.urlopen(..., $INTERM, ...) - pattern: | $DATA = request.$W ... urllib.request.urlopen(..., f"...{$DATA}...", ...) - pattern: | $DATA = request.$W ... $INTERM = f"...{$DATA}..." ... urllib.request.urlopen(..., $INTERM, ...) - pattern: | $DATA = request.$W ... urllib.request.urlopen(..., $STR + $DATA, ...) - pattern: | $DATA = request.$W ... $INTERM = $STR + $DATA ... urllib.request.urlopen(..., $INTERM, ...) - pattern: $A = urllib.request.urlopen(..., request.$W, ...) - pattern: return urllib.request.urlopen(..., request.$W, ...) - id: python.flask.security.audit.directly-returned-format-string.directly-returned-format-string message: Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection category: security technology: - flask references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string shortlink: https://sg.run/Zv6o semgrep.dev: rule: r_id: 9535 rv_id: 1263416 rule_id: QrUz49 version_id: WrTqKAz url: https://semgrep.dev/playground/r/WrTqKAz/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string origin: community languages: - python severity: WARNING mode: taint pattern-sources: - pattern-either: - patterns: - pattern-inside: | @$APP.route(...) def $FUNC(..., $PARAM, ...): ... - pattern: $PARAM - pattern: | request.$FUNC.get(...) - pattern: | request.$FUNC(...) - pattern: request.$FUNC[...] pattern-sinks: - patterns: - pattern-not-inside: return "..." - pattern-either: - pattern: return "...".format(...) - pattern: return "..." % ... - pattern: return "..." + ... - pattern: return ... + "..." - pattern: return f"...{...}..." - patterns: - pattern: return $X - pattern-either: - pattern-inside: | $X = "...".format(...) ... - pattern-inside: | $X = "..." % ... ... - pattern-inside: | $X = "..." + ... ... - pattern-inside: | $X = ... + "..." ... - pattern-inside: | $X = f"...{...}..." ... - pattern-not-inside: | $X = "..." ... - id: python.flask.security.injection.os-system-injection.os-system-injection languages: - python severity: ERROR message: User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. metadata: cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/www-community/attacks/Command_Injection category: security technology: - flask cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.flask.security.injection.os-system-injection.os-system-injection shortlink: https://sg.run/4xzz semgrep.dev: rule: r_id: 9544 rv_id: 1263429 rule_id: BYUN99 version_id: 1QTypw7 url: https://semgrep.dev/playground/r/1QTypw7/python.flask.security.injection.os-system-injection.os-system-injection origin: community pattern-either: - patterns: - pattern: os.system(...) - pattern-either: - pattern-inside: | @$APP.route($ROUTE, ...) def $FUNC(..., $ROUTEVAR, ...): ... os.system(..., <... $ROUTEVAR ...>, ...) - pattern-inside: | @$APP.route($ROUTE, ...) def $FUNC(..., $ROUTEVAR, ...): ... $INTERM = <... $ROUTEVAR ...> ... os.system(..., <... $INTERM ...>, ...) - pattern: os.system(..., <... flask.request.$W.get(...) ...>, ...) - pattern: os.system(..., <... flask.request.$W[...] ...>, ...) - pattern: os.system(..., <... flask.request.$W(...) ...>, ...) - pattern: os.system(..., <... flask.request.$W ...>, ...) - patterns: - pattern-inside: | $INTERM = <... flask.request.$W.get(...) ...> ... os.system(<... $INTERM ...>) - pattern: os.system(...) - patterns: - pattern-inside: | $INTERM = <... flask.request.$W[...] ...> ... os.system(<... $INTERM ...>) - pattern: os.system(...) - patterns: - pattern-inside: | $INTERM = <... flask.request.$W(...) ...> ... os.system(<... $INTERM ...>) - pattern: os.system(...) - patterns: - pattern-inside: | $INTERM = <... flask.request.$W ...> ... os.system(<... $INTERM ...>) - pattern: os.system(...) - id: python.flask.security.injection.path-traversal-open.path-traversal-open languages: - python severity: ERROR message: Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks. metadata: cwe: - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://owasp.org/www-community/attacks/Path_Traversal category: security technology: - flask cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Path Traversal source: https://semgrep.dev/r/python.flask.security.injection.path-traversal-open.path-traversal-open shortlink: https://sg.run/PJRW semgrep.dev: rule: r_id: 9545 rv_id: 1263430 rule_id: DbUpOQ version_id: 9lT4b94 url: https://semgrep.dev/playground/r/9lT4b94/python.flask.security.injection.path-traversal-open.path-traversal-open origin: community pattern-either: - patterns: - pattern: open(...) - pattern-either: - pattern-inside: | @$APP.route($ROUTE, ...) def $FUNC(..., $ROUTEVAR, ...): ... open(..., <... $ROUTEVAR ...>, ...) - pattern-inside: | @$APP.route($ROUTE, ...) def $FUNC(..., $ROUTEVAR, ...): ... with open(..., <... $ROUTEVAR ...>, ...) as $FD: ... - pattern-inside: | @$APP.route($ROUTE, ...) def $FUNC(..., $ROUTEVAR, ...): ... $INTERM = <... $ROUTEVAR ...> ... open(..., <... $INTERM ...>, ...) - pattern: open(..., <... flask.request.$W.get(...) ...>, ...) - pattern: open(..., <... flask.request.$W[...] ...>, ...) - pattern: open(..., <... flask.request.$W(...) ...>, ...) - pattern: open(..., <... flask.request.$W ...>, ...) - patterns: - pattern-inside: | $INTERM = <... flask.request.$W.get(...) ...> ... open(<... $INTERM ...>, ...) - pattern: open(...) - patterns: - pattern-inside: | $INTERM = <... flask.request.$W[...] ...> ... open(<... $INTERM ...>, ...) - pattern: open(...) - patterns: - pattern-inside: | $INTERM = <... flask.request.$W(...) ...> ... open(<... $INTERM ...>, ...) - pattern: open(...) - patterns: - pattern-inside: | $INTERM = <... flask.request.$W ...> ... open(<... $INTERM ...>, ...) - pattern: open(...) - patterns: - pattern-inside: | $INTERM = <... flask.request.$W.get(...) ...> ... with open(<... $INTERM ...>, ...) as $F: ... - pattern: open(...) - patterns: - pattern-inside: | $INTERM = <... flask.request.$W[...] ...> ... with open(<... $INTERM ...>, ...) as $F: ... - pattern: open(...) - patterns: - pattern-inside: | $INTERM = <... flask.request.$W(...) ...> ... with open(<... $INTERM ...>, ...) as $F: ... - pattern: open(...) - patterns: - pattern-inside: | $INTERM = <... flask.request.$W ...> ... with open(<... $INTERM ...>, ...) as $F: ... - pattern: open(...) - id: python.flask.security.injection.ssrf-requests.ssrf-requests languages: - python severity: ERROR message: Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. metadata: cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery category: security technology: - flask cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Server-Side Request Forgery (SSRF) source: https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests shortlink: https://sg.run/J9LW semgrep.dev: rule: r_id: 9546 rv_id: 1263432 rule_id: WAUoRx version_id: rxTAKJn url: https://semgrep.dev/playground/r/rxTAKJn/python.flask.security.injection.ssrf-requests.ssrf-requests origin: community pattern-either: - patterns: - pattern: requests.$FUNC(...) - pattern-either: - pattern-inside: | @$APP.$ROUTE_METHOD($ROUTE, ...) def $ROUTE_FUNC(..., $ROUTEVAR, ...): ... requests.$FUNC(..., <... $ROUTEVAR ...>, ...) - pattern-inside: | @$APP.$ROUTE_METHOD($ROUTE, ...) def $ROUTE_FUNC(..., $ROUTEVAR, ...): ... $INTERM = <... $ROUTEVAR ...> ... requests.$FUNC(..., <... $INTERM ...>, ...) - metavariable-regex: metavariable: $ROUTE_METHOD regex: ^(route|get|post|put|delete|patch)$ - pattern: requests.$FUNC(..., <... flask.request.$W.get(...) ...>, ...) - pattern: requests.$FUNC(..., <... flask.request.$W[...] ...>, ...) - pattern: requests.$FUNC(..., <... flask.request.$W(...) ...>, ...) - pattern: requests.$FUNC(..., <... flask.request.$W ...>, ...) - patterns: - pattern-inside: | $INTERM = <... flask.request.$W.get(...) ...> ... requests.$FUNC(<... $INTERM ...>, ...) - pattern: requests.$FUNC(...) - patterns: - pattern-inside: | $INTERM = <... flask.request.$W[...] ...> ... requests.$FUNC(<... $INTERM ...>, ...) - pattern: requests.$FUNC(...) - patterns: - pattern-inside: | $INTERM = <... flask.request.$W(...) ...> ... requests.$FUNC(<... $INTERM ...>, ...) - pattern: requests.$FUNC(...) - patterns: - pattern-inside: | $INTERM = <... flask.request.$W ...> ... requests.$FUNC(<... $INTERM ...>, ...) - pattern: requests.$FUNC(...) - id: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode patterns: - pattern-either: - patterns: - pattern: | jwt.decode(..., options={..., "verify_signature": $BOOL, ...}, ...) - metavariable-pattern: metavariable: $BOOL pattern: | False - focus-metavariable: $BOOL - patterns: - pattern: | $OPTS = {..., "verify_signature": $BOOL, ...} ... jwt.decode(..., options=$OPTS, ...) - metavariable-pattern: metavariable: $BOOL pattern: | False - focus-metavariable: $BOOL message: Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified. metadata: owasp: - A02:2017 - Broken Authentication - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures cwe: - 'CWE-287: Improper Authentication' references: - https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96 category: security technology: - jwt cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode shortlink: https://sg.run/6nyB semgrep.dev: rule: r_id: 9559 rv_id: 1263454 rule_id: 10UKjo version_id: 5PTo12w url: https://semgrep.dev/playground/r/5PTo12w/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode origin: community fix: | True severity: ERROR languages: - python - id: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true patterns: - pattern: subprocess.$FUNC(..., shell=$TRUE, ...) - metavariable-pattern: metavariable: $TRUE pattern: "True \n" - pattern-not: subprocess.$FUNC("...", shell=True, ...) - focus-metavariable: $TRUE message: Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. fix: | False metadata: source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' references: - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess - https://docs.python.org/3/library/subprocess.html category: security technology: - python cwe2022-top25: true cwe2021-top25: true subcategory: - secure default likelihood: HIGH impact: LOW confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true shortlink: https://sg.run/J92w semgrep.dev: rule: r_id: 9646 rv_id: 1263518 rule_id: DbUpz2 version_id: 0bTKzDK url: https://semgrep.dev/playground/r/0bTKzDK/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true origin: community languages: - python severity: ERROR - id: python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load metadata: owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures cwe: - 'CWE-502: Deserialization of Untrusted Data' references: - https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation - https://nvd.nist.gov/vuln/detail/CVE-2017-18342 category: security technology: - pyyaml cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load shortlink: https://sg.run/we9Y semgrep.dev: rule: r_id: 9673 rv_id: 1263530 rule_id: ZqU5jZ version_id: 1QTyprw url: https://semgrep.dev/playground/r/1QTyprw/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load origin: community languages: - python message: Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead. fix-regex: regex: unsafe_load replacement: safe_load count: 1 severity: ERROR patterns: - pattern-inside: | import yaml ... - pattern-not-inside: | $YAML = ruamel.yaml.YAML(...) ... - pattern-either: - pattern: yaml.unsafe_load(...) - pattern: yaml.load(..., Loader=yaml.Loader, ...) - pattern: yaml.load(..., Loader=yaml.UnsafeLoader, ...) - pattern: yaml.load(..., Loader=yaml.CLoader, ...) - pattern: yaml.load_all(..., Loader=yaml.Loader, ...) - pattern: yaml.load_all(..., Loader=yaml.UnsafeLoader, ...) - pattern: yaml.load_all(..., Loader=yaml.CLoader, ...) - id: python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel metadata: owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures cwe: - 'CWE-502: Deserialization of Untrusted Data' references: - https://yaml.readthedocs.io/en/latest/basicuse.html?highlight=typ category: security technology: - ruamel.yaml cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel shortlink: https://sg.run/x1rz semgrep.dev: rule: r_id: 9674 rv_id: 1263531 rule_id: nJUzqK version_id: 9lT4bvG url: https://semgrep.dev/playground/r/9lT4bvG/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel origin: community languages: - python message: Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead. severity: ERROR pattern-either: - pattern: ruamel.yaml.YAML(..., typ='unsafe', ...) - pattern: ruamel.yaml.YAML(..., typ='base', ...) - id: python.lang.security.deserialization.pickle.avoid-shelve metadata: owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures cwe: - 'CWE-502: Deserialization of Untrusted Data' references: - https://docs.python.org/3/library/pickle.html category: security technology: - python cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve shortlink: https://sg.run/dKkZ semgrep.dev: rule: r_id: 9678 rv_id: 1263535 rule_id: 8GUje2 version_id: NdTzyb4 url: https://semgrep.dev/playground/r/NdTzyb4/python.lang.security.deserialization.pickle.avoid-shelve origin: community languages: - python message: Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. severity: WARNING pattern: shelve.$FUNC(...) - id: python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection patterns: - pattern-either: - pattern: | def $FUNC(...,$VAR,...): ... $SESSION.query(...).$SQLFUNC("...".$FORMATFUNC(...,$VAR,...)) - pattern: | def $FUNC(...,$VAR,...): ... $SESSION.query.join(...).$SQLFUNC("...".$FORMATFUNC(...,$VAR,...)) - pattern: | def $FUNC(...,$VAR,...): ... $SESSION.query.$SQLFUNC("...".$FORMATFUNC(...,$VAR,...)) - pattern: | def $FUNC(...,$VAR,...): ... query.$SQLFUNC("...".$FORMATFUNC(...,$VAR,...)) - metavariable-regex: metavariable: $SQLFUNC regex: (group_by|order_by|distinct|having|filter) - metavariable-regex: metavariable: $FORMATFUNC regex: (?!bindparams) message: Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides "bindparams". Use bindParams to securely bind user-input to SQL statements. fix-regex: regex: format replacement: bindparams languages: - python severity: WARNING metadata: cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' category: security technology: - sqlalchemy owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection shortlink: https://sg.run/J3Xo semgrep.dev: rule: r_id: 9702 rv_id: 1263579 rule_id: BYUBWo version_id: NdTzyL4 url: https://semgrep.dev/playground/r/NdTzyL4/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection origin: community - id: ruby.lang.security.bad-deserialization.bad-deserialization mode: taint pattern-sources: - pattern-either: - pattern: params - pattern: cookies pattern-sinks: - pattern-either: - pattern: | CSV.load(...) - pattern: | Marshal.load(...) - pattern: | Marshal.restore(...) - pattern: | Oj.object_load(...) - pattern: | Oj.load($X) message: Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially be dangerous. Use JSON in a secure fashion instead. metadata: references: - https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb category: security cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures technology: - ruby cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/ruby.lang.security.bad-deserialization.bad-deserialization shortlink: https://sg.run/DJj2 semgrep.dev: rule: r_id: 9708 rv_id: 1263595 rule_id: lBUdQg version_id: 3ZT4Xqp url: https://semgrep.dev/playground/r/3ZT4Xqp/ruby.lang.security.bad-deserialization.bad-deserialization origin: community languages: - ruby severity: ERROR - id: ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller patterns: - pattern-inside: | class $CONTROLLER < ApplicationController ... http_basic_authenticate_with ..., :password => "$SECRET", ... end - focus-metavariable: $SECRET message: Detected hardcoded password used in basic authentication in a controller class. Including this password in version control could expose this credential. Consider refactoring to use environment variables or configuration files. severity: WARNING metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/basic_auth/index.markdown category: security technology: - ruby - secrets cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller shortlink: https://sg.run/6r0w semgrep.dev: rule: r_id: 9715 rv_id: 1263606 rule_id: X5UZWK version_id: 0bTKzNK url: https://semgrep.dev/playground/r/0bTKzNK/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller origin: community languages: - ruby - id: ruby.lang.security.no-eval.ruby-eval message: Use of eval with user-controllable input detected. This can lead to attackers running arbitrary code. Ensure external data does not reach here, otherwise this is a security vulnerability. Consider other ways to do this without eval. severity: WARNING metadata: likelihood: HIGH impact: MEDIUM confidence: MEDIUM category: security cwe2022-top25: true cwe2021-top25: true cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_evaluation.rb subcategory: - vuln technology: - ruby - rails license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/ruby.lang.security.no-eval.ruby-eval shortlink: https://sg.run/bDwZ semgrep.dev: rule: r_id: 9726 rv_id: 1263615 rule_id: OrUGNk version_id: A8TgdDv url: https://semgrep.dev/playground/r/A8TgdDv/ruby.lang.security.no-eval.ruby-eval origin: community languages: - ruby mode: taint pattern-sources: - pattern-either: - pattern: params - pattern: cookies - patterns: - pattern: | RubyVM::InstructionSequence.compile(...) - pattern-not: | RubyVM::InstructionSequence.compile("...") pattern-sinks: - patterns: - pattern-either: - pattern: $X.eval - pattern: $X.class_eval - pattern: $X.instance_eval - pattern: $X.module_eval - pattern: $X.eval(...) - pattern: $X.class_eval(...) - pattern: $X.instance_eval(...) - pattern: $X.module_eval(...) - pattern: eval(...) - pattern: class_eval(...) - pattern: module_eval(...) - pattern: instance_eval(...) - pattern-not: $M("...",...) - id: typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust message: Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the appropriate prevention mechanism e.g. input validation or sanitization depending on the context. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' references: - https://angular.io/api/platform-browser/DomSanitizer - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection confidence: MEDIUM category: security technology: - angular - browser cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust shortlink: https://sg.run/KWxP semgrep.dev: rule: r_id: 9755 rv_id: 1263902 rule_id: oqUzgA version_id: 5PTo1zk url: https://semgrep.dev/playground/r/5PTo1zk/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust origin: community languages: - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: | function ...({..., $X: string, ...}) { ... } - pattern-inside: | function ...(..., $X: string, ...) { ... } - focus-metavariable: $X pattern-sinks: - patterns: - pattern-either: - pattern: $X.$TRUST($Y) - focus-metavariable: $Y - pattern-not: | $X.$TRUST(`...`) - pattern-not: | $X.$TRUST("...") - metavariable-regex: metavariable: $TRUST regex: (bypassSecurityTrustHtml|bypassSecurityTrustStyle|bypassSecurityTrustScript|bypassSecurityTrustUrl|bypassSecurityTrustResourceUrl) pattern-sanitizers: - patterns: - pattern-either: - pattern-inside: | import $S from "underscore.string" ... - pattern-inside: | import * as $S from "underscore.string" ... - pattern-inside: | import $S from "underscore.string" ... - pattern-inside: | $S = require("underscore.string") ... - pattern-either: - pattern: $S.escapeHTML(...) - patterns: - pattern-either: - pattern-inside: | import $S from "dompurify" ... - pattern-inside: | import { ..., $S,... } from "dompurify" ... - pattern-inside: | import * as $S from "dompurify" ... - pattern-inside: | $S = require("dompurify") ... - pattern-inside: | import $S from "isomorphic-dompurify" ... - pattern-inside: | import * as $S from "isomorphic-dompurify" ... - pattern-inside: | $S = require("isomorphic-dompurify") ... - pattern-either: - patterns: - pattern-inside: | $VALUE = $S(...) ... - pattern: $VALUE.sanitize(...) - patterns: - pattern-inside: | $VALUE = $S.sanitize ... - pattern: $S(...) - pattern: $S.sanitize(...) - pattern: $S(...) - patterns: - pattern-either: - pattern-inside: | import $S from 'xss'; ... - pattern-inside: | import * as $S from 'xss'; ... - pattern-inside: | $S = require("xss") ... - pattern: $S(...) - patterns: - pattern-either: - pattern-inside: | import $S from 'sanitize-html'; ... - pattern-inside: | import * as $S from "sanitize-html"; ... - pattern-inside: | $S = require("sanitize-html") ... - pattern: $S(...) - patterns: - pattern: sanitizer.sanitize(...) - pattern-not: sanitizer.sanitize(SecurityContext.NONE, ...); - id: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml message: Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html category: security confidence: MEDIUM technology: - react cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml shortlink: https://sg.run/rAx6 semgrep.dev: rule: r_id: 9769 rv_id: 1263912 rule_id: x8UWvK version_id: l4TJR0v url: https://semgrep.dev/playground/r/l4TJR0v/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml origin: community languages: - typescript - javascript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: | function ...({..., $X, ...}) { ... } - pattern-inside: | function ...(..., $X, ...) { ... } - focus-metavariable: $X - pattern-not-inside: | $F. ... .$SANITIZEUNC(...) pattern-sinks: - patterns: - focus-metavariable: $X - pattern-either: - pattern: | {...,dangerouslySetInnerHTML: {__html: $X},...} - pattern: | <$Y ... dangerouslySetInnerHTML={{__html: $X}} /> - pattern-not: | <$Y ... dangerouslySetInnerHTML={{__html: "..."}} /> - pattern-not: | {...,dangerouslySetInnerHTML:{__html: "..."},...} - metavariable-pattern: patterns: - pattern-not: | {...} metavariable: $X - pattern-not: | <... {__html: "..."} ...> - pattern-not: | <... {__html: `...`} ...> pattern-sanitizers: - patterns: - pattern-either: - pattern-inside: | import $S from "underscore.string" ... - pattern-inside: | import * as $S from "underscore.string" ... - pattern-inside: | import $S from "underscore.string" ... - pattern-inside: | $S = require("underscore.string") ... - pattern-either: - pattern: $S.escapeHTML(...) - patterns: - pattern-either: - pattern-inside: | import $S from "dompurify" ... - pattern-inside: | import { ..., $S,... } from "dompurify" ... - pattern-inside: | import * as $S from "dompurify" ... - pattern-inside: | $S = require("dompurify") ... - pattern-inside: | import $S from "isomorphic-dompurify" ... - pattern-inside: | import * as $S from "isomorphic-dompurify" ... - pattern-inside: | $S = require("isomorphic-dompurify") ... - pattern-either: - patterns: - pattern-inside: | $VALUE = $S(...) ... - pattern: $VALUE.sanitize(...) - patterns: - pattern-inside: | $VALUE = $S.sanitize ... - pattern: $S(...) - pattern: $S.sanitize(...) - pattern: $S(...) - patterns: - pattern-either: - pattern-inside: | import $S from 'xss'; ... - pattern-inside: | import * as $S from 'xss'; ... - pattern-inside: | $S = require("xss") ... - pattern: $S(...) - patterns: - pattern-either: - pattern-inside: | import $S from 'sanitize-html'; ... - pattern-inside: | import * as $S from "sanitize-html"; ... - pattern-inside: | $S = require("sanitize-html") ... - pattern: $S(...) - patterns: - pattern-either: - pattern-inside: | $S = new Remarkable() ... - pattern: $S.render(...) - id: typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method message: Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as DOMPurify to sanitize your HTML. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://developer.mozilla.org/en-US/docs/Web/API/Document/writeln - https://developer.mozilla.org/en-US/docs/Web/API/Document/write - https://developer.mozilla.org/en-US/docs/Web/API/Element/insertAdjacentHTML category: security confidence: MEDIUM technology: - react cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method shortlink: https://sg.run/E5x8 semgrep.dev: rule: r_id: 9781 rv_id: 1263916 rule_id: QrU68w version_id: GxTkeRl url: https://semgrep.dev/playground/r/GxTkeRl/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method origin: community languages: - typescript - javascript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: | function ...({..., $X, ...}) { ... } - pattern-inside: | function ...(..., $X, ...) { ... } - focus-metavariable: $X - pattern-either: - pattern: $X.$Y - pattern: $X[...] pattern-sinks: - patterns: - pattern-either: - pattern: "this.window.document. ... .$HTML('...',$SINK) \n" - pattern: "window.document. ... .$HTML('...',$SINK) \n" - pattern: "document.$HTML($SINK) \n" - metavariable-regex: metavariable: $HTML regex: (writeln|write) - focus-metavariable: $SINK - patterns: - pattern-either: - pattern: "$PROP. ... .$HTML('...',$SINK) \n" - metavariable-regex: metavariable: $HTML regex: (insertAdjacentHTML) - focus-metavariable: $SINK pattern-sanitizers: - patterns: - pattern-either: - pattern-inside: | import $S from "underscore.string" ... - pattern-inside: | import * as $S from "underscore.string" ... - pattern-inside: | import $S from "underscore.string" ... - pattern-inside: | $S = require("underscore.string") ... - pattern-either: - pattern: $S.escapeHTML(...) - patterns: - pattern-either: - pattern-inside: | import $S from "dompurify" ... - pattern-inside: | import { ..., $S,... } from "dompurify" ... - pattern-inside: | import * as $S from "dompurify" ... - pattern-inside: | $S = require("dompurify") ... - pattern-inside: | import $S from "isomorphic-dompurify" ... - pattern-inside: | import * as $S from "isomorphic-dompurify" ... - pattern-inside: | $S = require("isomorphic-dompurify") ... - pattern-either: - patterns: - pattern-inside: | $VALUE = $S(...) ... - pattern: $VALUE.sanitize(...) - patterns: - pattern-inside: | $VALUE = $S.sanitize ... - pattern: $S(...) - pattern: $S.sanitize(...) - pattern: $S(...) - patterns: - pattern-either: - pattern-inside: | import $S from 'xss'; ... - pattern-inside: | import * as $S from 'xss'; ... - pattern-inside: | $S = require("xss") ... - pattern: $S(...) - patterns: - pattern-either: - pattern-inside: | import $S from 'sanitize-html'; ... - pattern-inside: | import * as $S from "sanitize-html"; ... - pattern-inside: | $S = require("sanitize-html") ... - pattern: $S(...) - patterns: - pattern-either: - pattern-inside: | $S = new Remarkable() ... - pattern: $S.render(...) - id: typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property message: Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as DOMPurify to sanitize your HTML. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html category: security confidence: MEDIUM technology: - react cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property shortlink: https://sg.run/70Zv semgrep.dev: rule: r_id: 9782 rv_id: 1263917 rule_id: 3qUBl4 version_id: RGT0Lln url: https://semgrep.dev/playground/r/RGT0Lln/typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property origin: community languages: - typescript - javascript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: | function ...({..., $X, ...}) { ... } - pattern-inside: | function ...(..., $X, ...) { ... } - focus-metavariable: $X - pattern-either: - pattern: $X.$Y - pattern: $X[...] pattern-sinks: - patterns: - pattern-either: - pattern-inside: | $BODY = $REACT.useRef(...) ... - pattern-inside: | $BODY = useRef(...) ... - pattern-inside: | $BODY = findDOMNode(...) ... - pattern-inside: | $BODY = createRef(...) ... - pattern-inside: | $BODY = $REACT.findDOMNode(...) ... - pattern-inside: | $BODY = $REACT.createRef(...) ... - pattern-either: - pattern: "$BODY. ... .$HTML = $SINK \n" - pattern: "$BODY.$HTML = $SINK \n" - metavariable-regex: metavariable: $HTML regex: (innerHTML|outerHTML) - focus-metavariable: $SINK - patterns: - pattern-either: - pattern: ReactDOM.findDOMNode(...).$HTML = $SINK - metavariable-regex: metavariable: $HTML regex: (innerHTML|outerHTML) - focus-metavariable: $SINK pattern-sanitizers: - patterns: - pattern-either: - pattern-inside: | import $S from "underscore.string" ... - pattern-inside: | import * as $S from "underscore.string" ... - pattern-inside: | import $S from "underscore.string" ... - pattern-inside: | $S = require("underscore.string") ... - pattern-either: - pattern: $S.escapeHTML(...) - patterns: - pattern-either: - pattern-inside: | import $S from "dompurify" ... - pattern-inside: | import { ..., $S,... } from "dompurify" ... - pattern-inside: | import * as $S from "dompurify" ... - pattern-inside: | $S = require("dompurify") ... - pattern-inside: | import $S from "isomorphic-dompurify" ... - pattern-inside: | import * as $S from "isomorphic-dompurify" ... - pattern-inside: | $S = require("isomorphic-dompurify") ... - pattern-either: - patterns: - pattern-inside: | $VALUE = $S(...) ... - pattern: $VALUE.sanitize(...) - patterns: - pattern-inside: | $VALUE = $S.sanitize ... - pattern: $S(...) - pattern: $S.sanitize(...) - pattern: $S(...) - patterns: - pattern-either: - pattern-inside: | import $S from 'xss'; ... - pattern-inside: | import * as $S from 'xss'; ... - pattern-inside: | $S = require("xss") ... - pattern: $S(...) - patterns: - pattern-either: - pattern-inside: | import $S from 'sanitize-html'; ... - pattern-inside: | import * as $S from "sanitize-html"; ... - pattern-inside: | $S = require("sanitize-html") ... - pattern: $S(...) - patterns: - pattern-either: - pattern-inside: | $S = new Remarkable() ... - pattern: $S.render(...) - id: ruby.lang.security.dangerous-exec.dangerous-exec mode: taint pattern-sources: - patterns: - pattern: | def $F(...,$ARG,...) ... end - focus-metavariable: $ARG - pattern: params - pattern: cookies pattern-sinks: - patterns: - pattern: | $EXEC(...) - pattern-not: | $EXEC("...","...","...",...) - pattern-not: | $EXEC(["...","...","...",...],...) - pattern-not: | $EXEC({...},"...","...","...",...) - pattern-not: | $EXEC({...},["...","...","...",...],...) - metavariable-regex: metavariable: $EXEC regex: ^(system|exec|spawn|Process.exec|Process.spawn|Open3.capture2|Open3.capture2e|Open3.capture3|Open3.popen2|Open3.popen2e|Open3.popen3|IO.popen|Gem::Util.popen|PTY.spawn)$ message: Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. metadata: source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_execute.rb cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' owasp: - A03:2021 - Injection - A05:2025 - Injection category: security technology: - ruby - rails references: - https://guides.rubyonrails.org/security.html#command-line-injection cwe2022-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/ruby.lang.security.dangerous-exec.dangerous-exec shortlink: https://sg.run/R8GY semgrep.dev: rule: r_id: 9805 rv_id: 1409405 rule_id: WAUZOw version_id: WrT7erb url: https://semgrep.dev/playground/r/WrT7erb/ruby.lang.security.dangerous-exec.dangerous-exec origin: community severity: WARNING languages: - ruby - id: javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run message: Detected non-literal calls to Deno.run(). This could lead to a command injection vulnerability. metadata: cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection category: security technology: - deno references: - https://deno.land/manual/examples/subprocess#simple-example cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run shortlink: https://sg.run/Nrrn semgrep.dev: rule: r_id: 9927 rv_id: 1409397 rule_id: x8UWWg version_id: PkTe7AP url: https://semgrep.dev/playground/r/PkTe7AP/javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run origin: community languages: - javascript - typescript severity: ERROR mode: taint pattern-sources: - patterns: - pattern-inside: function ... (..., $ARG,...) {...} - focus-metavariable: $ARG pattern-sinks: - patterns: - pattern-either: - pattern: | Deno.run({cmd: [$INPUT,...]},...) - pattern: | Deno.run({cmd: ["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$INPUT,...]},...) - patterns: - pattern: | Deno.run({cmd: [$CMD,"-c",$INPUT,...]},...) - pattern-inside: | $CMD = "=~/(sh|bash|ksh|csh|tcsh|zsh)/" ... - focus-metavariable: $INPUT - id: ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli mode: taint pattern-propagators: - pattern: $X << $Y from: $Y to: $X pattern-sources: - pattern-either: - pattern: | params - pattern: | cookies pattern-sinks: - patterns: - pattern-either: - pattern-inside: | $CON = PG.connect(...) ... - pattern-inside: | $CON = PG::Connection.open(...) ... - pattern-inside: | $CON = PG::Connection.new(...) ... - pattern-either: - pattern: | $CON.$METHOD($X,...) - pattern: | $CON.$METHOD $X, ... - focus-metavariable: $X - metavariable-regex: metavariable: $METHOD regex: ^(exec|exec_params)$ languages: - ruby message: 'Detected string concatenation with a non-literal variable in a pg Ruby SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized queries like so: `conn.exec_params(''SELECT $1 AS a, $2 AS b, $3 AS c'', [1, 2, nil])` And you can use prepared statements with `exec_prepared`.' metadata: cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://www.rubydoc.info/gems/pg/PG/Connection category: security technology: - rails cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli shortlink: https://sg.run/kL0o semgrep.dev: rule: r_id: 10328 rv_id: 1263628 rule_id: NbUAz7 version_id: 2KTv2y2 url: https://semgrep.dev/playground/r/2KTv2y2/ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli origin: community severity: WARNING - id: csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization severity: WARNING languages: - C# metadata: cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide category: security technology: - .net confidence: HIGH cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization shortlink: https://sg.run/ZeXW semgrep.dev: rule: r_id: 11135 rv_id: 1262635 rule_id: bwUOjK version_id: nWT2LGp url: https://semgrep.dev/playground/r/nWT2LGp/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization origin: community message: The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter is insecure and can't be made secure patterns: - pattern-inside: | using System.Runtime.Serialization.Formatters.Binary; ... - pattern: | new BinaryFormatter(); - id: csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization severity: WARNING languages: - C# metadata: cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://mbraceproject.github.io/FsPickler/tutorial.html#Disabling-Subtype-Resolution category: security technology: - .net confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization shortlink: https://sg.run/E5e5 semgrep.dev: rule: r_id: 11137 rv_id: 1262638 rule_id: kxURnR version_id: LjTkgPk url: https://semgrep.dev/playground/r/LjTkgPk/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization origin: community message: The FsPickler is dangerous and is not recommended for data processing. Default configuration tend to insecure deserialization vulnerability. patterns: - pattern-inside: | using MBrace.FsPickler.Json; ... - pattern: | FsPickler.CreateJsonSerializer(); - id: csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization severity: WARNING languages: - C# metadata: cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://docs.microsoft.com/en-us/dotnet/api/system.web.ui.losformatter?view=netframework-4.8 category: security technology: - .net confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization shortlink: https://sg.run/70pG semgrep.dev: rule: r_id: 11138 rv_id: 1262641 rule_id: wdU87G version_id: QkTGqnA url: https://semgrep.dev/playground/r/QkTGqnA/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization origin: community message: The LosFormatter type is dangerous and is not recommended for data processing. Applications should stop using LosFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter is insecure and can't be made secure patterns: - pattern-inside: | using System.Web.UI; ... - pattern: | new LosFormatter(); - id: csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization severity: WARNING languages: - C# metadata: cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.netdatacontractserializer?view=netframework-4.8#security category: security technology: - .net confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization shortlink: https://sg.run/L0AX semgrep.dev: rule: r_id: 11139 rv_id: 1262642 rule_id: x8UW7x version_id: 3ZT4X6b url: https://semgrep.dev/playground/r/3ZT4X6b/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization origin: community message: The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications should stop using NetDataContractSerializer as soon as possible, even if they believe the data they're processing to be trustworthy. NetDataContractSerializer is insecure and can't be made secure patterns: - pattern-inside: | using System.Runtime.Serialization; ... - pattern: | new NetDataContractSerializer(); - id: csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization severity: WARNING languages: - C# metadata: cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.soap.soapformatter?view=netframework-4.8#remarks category: security technology: - .net confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization shortlink: https://sg.run/gJnR semgrep.dev: rule: r_id: 11141 rv_id: 1262644 rule_id: eqUvND version_id: PkTR30n url: https://semgrep.dev/playground/r/PkTR30n/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization origin: community message: The SoapFormatter type is dangerous and is not recommended for data processing. Applications should stop using SoapFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. SoapFormatter is insecure and can't be made secure patterns: - pattern-inside: | using System.Runtime.Serialization.Formatters.Soap; ... - pattern: | new SoapFormatter(); - id: terraform.lang.security.ec2-imdsv1-optional.ec2-imdsv1-optional languages: - hcl message: AWS EC2 Instance allowing use of the IMDSv1 metadata: cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' references: - https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance#metadata-options category: security technology: - terraform - aws owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Server-Side Request Forgery (SSRF) source: https://semgrep.dev/r/terraform.lang.security.ec2-imdsv1-optional.ec2-imdsv1-optional shortlink: https://sg.run/J3BQ semgrep.dev: rule: r_id: 11302 rv_id: 1263884 rule_id: GdU0eA version_id: w8TRooE url: https://semgrep.dev/playground/r/w8TRooE/terraform.lang.security.ec2-imdsv1-optional.ec2-imdsv1-optional origin: community pattern-either: - patterns: - pattern: http_tokens = "optional" - pattern-inside: | metadata_options { ... } - patterns: - pattern: | resource "aws_instance" "$NAME" { ... } - pattern-not: | resource "aws_instance" "$NAME" { ... metadata_options { ... http_tokens = "required" ... } ... } - pattern-not: | resource "aws_instance" "$NAME" { ... metadata_options { ... http_tokens = "optional" ... } ... } - pattern-not: | resource "aws_instance" "$NAME" { ... metadata_options { ... http_endpoint = "disabled" ... } ... } severity: ERROR - id: javascript.express.security.express-vm-injection.express-vm-injection message: Make sure that unverified user data can not reach `$VM`. metadata: owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' category: security technology: - express cwe2022-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/javascript.express.security.express-vm-injection.express-vm-injection shortlink: https://sg.run/jkqJ semgrep.dev: rule: r_id: 12821 rv_id: 1263170 rule_id: DbUKPX version_id: 1QTypXQ url: https://semgrep.dev/playground/r/1QTypXQ/javascript.express.security.express-vm-injection.express-vm-injection origin: community languages: - javascript - typescript severity: ERROR mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: function ... ($REQ, $RES) {...} - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - patterns: - pattern-either: - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|head|delete|options)$ - pattern-either: - pattern: $REQ.query - pattern: $REQ.body - pattern: $REQ.params - pattern: $REQ.cookies - pattern: $REQ.headers - patterns: - pattern-either: - pattern-inside: | ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...} - pattern-inside: | ({ $REQ }: Request,$RES: Response) => {...} - focus-metavariable: $REQ - pattern-either: - pattern: params - pattern: query - pattern: cookies - pattern: headers - pattern: body pattern-sinks: - patterns: - pattern-inside: | $VM = require('vm'); ... - pattern-either: - pattern: | $VM.runInContext(...) - pattern: | $VM.runInNewContext(...) - pattern: | $VM.compileFunction(...) - pattern: | $VM.runInThisContext(...) - pattern: new $VM.Script(...) - id: javascript.express.security.express-vm2-injection.express-vm2-injection message: Make sure that unverified user data can not reach `vm2`. metadata: owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' category: security technology: - express cwe2022-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/javascript.express.security.express-vm2-injection.express-vm2-injection shortlink: https://sg.run/1GWv semgrep.dev: rule: r_id: 12822 rv_id: 1263171 rule_id: WAUPXJ version_id: 9lT4bnX url: https://semgrep.dev/playground/r/9lT4bnX/javascript.express.security.express-vm2-injection.express-vm2-injection origin: community languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: function ... ($REQ, $RES) {...} - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - patterns: - pattern-either: - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|head|delete|options)$ - pattern-either: - pattern: $REQ.query - pattern: $REQ.body - pattern: $REQ.params - pattern: $REQ.cookies - pattern: $REQ.headers - patterns: - pattern-either: - pattern-inside: | ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...} - pattern-inside: | ({ $REQ }: Request,$RES: Response) => {...} - focus-metavariable: $REQ - pattern-either: - pattern: params - pattern: query - pattern: cookies - pattern: headers - pattern: body pattern-sinks: - patterns: - pattern-inside: | require('vm2') ... - pattern-either: - patterns: - pattern-either: - pattern-inside: | $VM = new VM(...) ... - pattern-inside: | $VM = new NodeVM(...) ... - pattern: | $VM.run(...) - pattern: | new VM(...).run(...) - pattern: | new NodeVM(...).run(...) - pattern: | new VMScript(...) - pattern: | new VM(...) - pattern: new NodeVM(...) - id: yaml.github-actions.security.run-shell-injection.run-shell-injection languages: - yaml message: 'Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".' metadata: category: security cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections - https://securitylab.github.com/research/github-actions-untrusted-input/ technology: - github-actions cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection shortlink: https://sg.run/pkzk semgrep.dev: rule: r_id: 13162 rv_id: 1423395 rule_id: v8UjQj version_id: GxTl1DQ url: https://semgrep.dev/playground/r/GxTl1DQ/yaml.github-actions.security.run-shell-injection.run-shell-injection origin: community patterns: - pattern-inside: 'steps: [...]' - pattern-inside: | - run: ... ... - pattern: 'run: $SHELL' - metavariable-pattern: language: generic metavariable: $SHELL patterns: - pattern-either: - pattern: ${{ ... github.event.issue.title ... }} - pattern: ${{ ... github.event.issue.body ... }} - pattern: ${{ ... github.event.pull_request.title ... }} - pattern: ${{ ... github.event.pull_request.body ... }} - pattern: ${{ ... github.event.comment.body ... }} - pattern: ${{ ... github.event.review.body ... }} - pattern: ${{ ... github.event.review_comment.body ... }} - pattern: ${{ ... github.event.pages ... .page_name ... }} - pattern: ${{ ... github.event.head_commit.message ... }} - pattern: ${{ ... github.event.head_commit.author.email ... }} - pattern: ${{ ... github.event.head_commit.author.name ... }} - pattern: ${{ ... github.event.commits ... .author.email ... }} - pattern: ${{ ... github.event.commits ... .author.name ... }} - pattern: ${{ ... github.event.commits ... .message ... }} - pattern: ${{ ... github.event.pull_request.head.ref ... }} - pattern: ${{ ... github.event.pull_request.head.label ... }} - pattern: ${{ ... github.event.pull_request.head.repo.default_branch ... }} - pattern: ${{ ... github.ref ... }} - pattern: ${{ ... github.base_ref ... }} - pattern: ${{ ... github.head_ref ... }} - pattern: ${{ ... github.ref_name ... }} - pattern: ${{ ... github.workflow ... }} - pattern: ${{ ... github.event.inputs ... }} - pattern: ${{ ... github.event.discussion.title ... }} - pattern: ${{ ... github.event.discussion.body ... }} - pattern: ${{ ... github.event.workflow_run.head_branch ... }} - pattern: ${{ ... github.event.workflow_run.head_commit.message ... }} - pattern: ${{ ... github.event.milestone.title ... }} - pattern: ${{ ... github.event.milestone.description ... }} - pattern: ${{ ... github.event.project_card.note ... }} - pattern: ${{ ... github.event.project.name ... }} - pattern: ${{ ... github.event.project_column.name ... }} - pattern: ${{ ... github.event.release.name ... }} - pattern: ${{ ... github.event.release.body ... }} - pattern: ${{ ... github.event.deployment.ref ... }} - pattern: ${{ ... inputs ... }} - pattern-not: ${{ ... github.event.issue.title && ... }} - pattern-not: ${{ ... github.event.issue.body && ... }} - pattern-not: ${{ ... github.event.pull_request.title && ... }} - pattern-not: ${{ ... github.event.pull_request.body && ... }} - pattern-not: ${{ ... github.event.comment.body && ... }} - pattern-not: ${{ ... github.event.review.body && ... }} - pattern-not: ${{ ... github.event.review_comment.body && ... }} - pattern-not: ${{ ... github.event.pages ... .page_name && ... }} - pattern-not: ${{ ... github.event.head_commit.message && ... }} - pattern-not: ${{ ... github.event.head_commit.author.email && ... }} - pattern-not: ${{ ... github.event.head_commit.author.name && ... }} - pattern-not: ${{ ... github.event.commits ... .author.email && ... }} - pattern-not: ${{ ... github.event.commits ... .author.name && ... }} - pattern-not: ${{ ... github.event.commits ... .message && ... }} - pattern-not: ${{ ... github.event.pull_request.head.ref && ... }} - pattern-not: ${{ ... github.event.pull_request.head.label && ... }} - pattern-not: ${{ ... github.event.pull_request.head.repo.default_branch && ... }} - pattern-not: ${{ ... github.event.workflow_run.head_commit.message && ... }} - pattern-not: ${{ ... github.ref && ... }} - pattern-not: ${{ ... github.base_ref && ... }} - pattern-not: ${{ ... github.head_ref && ... }} - pattern-not: ${{ ... github.ref_name && ... }} - pattern-not: ${{ ... github.workflow && ... }} - pattern-not: ${{ ... github.event.inputs && ... }} - pattern-not: ${{ ... github.event.discussion.title && ... }} - pattern-not: ${{ ... github.event.discussion.body && ... }} - pattern-not: ${{ ... github.event.workflow_run.head_branch && ... }} - pattern-not: ${{ ... github.event.milestone.title && ... }} - pattern-not: ${{ ... github.event.milestone.description && ... }} - pattern-not: ${{ ... github.event.project_card.note && ... }} - pattern-not: ${{ ... github.event.project.name && ... }} - pattern-not: ${{ ... github.event.project_column.name && ... }} - pattern-not: ${{ ... github.event.release.name && ... }} - pattern-not: ${{ ... github.event.release.body && ... }} - pattern-not: ${{ ... github.event.deployment.ref && ... }} severity: ERROR - id: ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation metadata: shortDescription: Allowing an attacker to manipulate the session may lead to unintended behavior. tags: - security owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control cwe: - 'CWE-276: Incorrect Default Permissions' references: - https://brakemanscanner.org/docs/warning_types/session_manipulation/ category: security technology: - rails help: | ## Remediation Session manipulation can occur when an application allows user-input in session keys. Since sessions are typically considered a source of truth (e.g. to check the logged-in user or to match CSRF tokens), allowing an attacker to manipulate the session may lead to unintended behavior. ## References [Session Manipulation](https://brakemanscanner.org/docs/warning_types/session_manipulation/) cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authorization source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation shortlink: https://sg.run/86q7 semgrep.dev: rule: r_id: 13584 rv_id: 1263621 rule_id: BYUdW6 version_id: qkTR76G url: https://semgrep.dev/playground/r/qkTR76G/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation origin: community message: This gets data from session using user inputs. A malicious user may be able to retrieve information from your session that you didn't intend them to. Do not use user input as a session key. languages: - ruby severity: WARNING mode: taint pattern-sources: - pattern: params - pattern: cookies - pattern: request.env pattern-sinks: - pattern: session[...] - id: ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access metadata: owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control cwe: - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' references: - https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown category: security technology: - rails cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Path Traversal source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access shortlink: https://sg.run/gYln semgrep.dev: rule: r_id: 13585 rv_id: 1263622 rule_id: DbU1dr version_id: l4TJRkk url: https://semgrep.dev/playground/r/l4TJRkk/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access origin: community message: Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. languages: - ruby severity: WARNING mode: taint pattern-sources: - pattern: params - pattern: cookies - pattern: request.env pattern-sinks: - patterns: - pattern-either: - pattern: Dir.$X(...) - pattern: File.$X(...) - pattern: IO.$X(...) - pattern: Kernel.$X(...) - pattern: PStore.$X(...) - pattern: Pathname.$X(...) - metavariable-pattern: metavariable: $X patterns: - pattern-either: - pattern: chdir - pattern: chroot - pattern: delete - pattern: entries - pattern: foreach - pattern: glob - pattern: install - pattern: lchmod - pattern: lchown - pattern: link - pattern: load - pattern: load_file - pattern: makedirs - pattern: move - pattern: new - pattern: open - pattern: read - pattern: readlines - pattern: rename - pattern: rmdir - pattern: safe_unlink - pattern: symlink - pattern: syscopy - pattern: sysopen - pattern: truncate - pattern: unlink - id: ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call metadata: owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control cwe: - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' references: - https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown category: security technology: - rails cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Path Traversal source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call shortlink: https://sg.run/Q9gP semgrep.dev: rule: r_id: 13586 rv_id: 1263623 rule_id: WAUyzp version_id: YDTZeWL url: https://semgrep.dev/playground/r/YDTZeWL/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call origin: community message: Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. languages: - ruby severity: WARNING mode: taint pattern-sources: - pattern: params - pattern: cookies - pattern: request.env pattern-sinks: - pattern-either: - pattern: Net::FTP.$X(...) - patterns: - pattern-inside: | $FTP = Net::FTP.$OPEN(...) ... $FTP.$METHOD(...) - pattern: $FTP.$METHOD(...) - id: ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request metadata: owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' references: - https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown category: security technology: - rails cwe2022-top25: true cwe2021-top25: true subcategory: - vuln impact: MEDIUM likelihood: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Server-Side Request Forgery (SSRF) source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request shortlink: https://sg.run/3rLb semgrep.dev: rule: r_id: 13587 rv_id: 1263624 rule_id: 0oU2x3 version_id: 6xT29nN url: https://semgrep.dev/playground/r/6xT29nN/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request origin: community message: Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. languages: - ruby severity: WARNING mode: taint pattern-sources: - pattern: params - pattern: cookies - pattern: request.env pattern-sinks: - pattern-either: - patterns: - pattern: Net::HTTP::$METHOD.new(...) - metavariable-pattern: metavariable: $METHOD patterns: - pattern-either: - pattern: Copy - pattern: Delete - pattern: Get - pattern: Head - pattern: Lock - pattern: Mkcol - pattern: Move - pattern: Options - pattern: Patch - pattern: Post - pattern: Propfind - pattern: Proppatch - pattern: Put - pattern: Trace - pattern: Unlock - patterns: - pattern: Net::HTTP.$X(...) - metavariable-pattern: metavariable: $X patterns: - pattern-either: - pattern: get - pattern: get2 - pattern: head - pattern: head2 - pattern: options - pattern: patch - pattern: post - pattern: post2 - pattern: post_form - pattern: put - pattern: request - pattern: request_get - pattern: request_head - pattern: request_post - pattern: send_request - pattern: trace - pattern: get_print - pattern: get_response - pattern: start - id: ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call metadata: owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' references: - https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown category: security technology: - rails cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call shortlink: https://sg.run/4e8E semgrep.dev: rule: r_id: 13588 rv_id: 1263625 rule_id: KxU72k version_id: o5TbDq8 url: https://semgrep.dev/playground/r/o5TbDq8/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call origin: community message: Using user input when accessing files is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. languages: - ruby severity: ERROR mode: taint pattern-sources: - pattern-either: - pattern: params[...] - pattern: cookies - pattern: request.env pattern-sinks: - patterns: - pattern-either: - patterns: - pattern: Kernel.$X(...) - patterns: - pattern-either: - pattern: Shell.$X(...) - patterns: - pattern-inside: | $SHELL = Shell.$ANY(...) ... $SHELL.$X(...) - pattern: $SHELL.$X(...) - metavariable-pattern: metavariable: $X patterns: - pattern-either: - pattern: cat - pattern: chdir - pattern: chroot - pattern: delete - pattern: entries - pattern: exec - pattern: foreach - pattern: glob - pattern: install - pattern: lchmod - pattern: lchown - pattern: link - pattern: load - pattern: load_file - pattern: makedirs - pattern: move - pattern: new - pattern: open - pattern: read - pattern: readlines - pattern: rename - pattern: rmdir - pattern: safe_unlink - pattern: symlink - pattern: syscopy - pattern: sysopen - pattern: system - pattern: truncate - pattern: unlink - id: ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to metadata: source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_link_to.rb owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' references: - https://brakemanscanner.org/docs/warning_types/link_to/ - https://brakemanscanner.org/docs/warning_types/link_to_href/ category: security technology: - rails cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to shortlink: https://sg.run/JxXQ semgrep.dev: rule: r_id: 13590 rv_id: 1263632 rule_id: lBU8Qj version_id: 9lT4brj url: https://semgrep.dev/playground/r/9lT4brj/ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to origin: community message: This code includes user input in `link_to`. In Rails 2.x, the body of `link_to` is not escaped. This means that user input which reaches the body will be executed when the HTML is rendered. Even in other versions, values starting with `javascript:` or `data:` are not escaped. It is better to create and use a safer function which checks the body argument. languages: - ruby severity: WARNING mode: taint pattern-sources: - pattern: params - pattern: cookies - pattern: request.env - pattern-either: - pattern: $MODEL.url(...) - pattern: $MODEL.uri(...) - pattern: $MODEL.link(...) - pattern: $MODEL.page(...) - pattern: $MODEL.site(...) pattern-sinks: - pattern: link_to(...) pattern-sanitizers: - patterns: - pattern: | "...#{...}..." - pattern-not: | "#{...}..." - id: ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path metadata: owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control cwe: - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' references: - https://brakemanscanner.org/docs/warning_types/dynamic_render_paths/ category: security technology: - rails cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Path Traversal source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path shortlink: https://sg.run/GO2n semgrep.dev: rule: r_id: 13592 rv_id: 1263635 rule_id: 6JU1bL version_id: bZT53p0 url: https://semgrep.dev/playground/r/bZT53p0/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path origin: community message: Avoid rendering user input. It may be possible for a malicious user to input a path that lets them access a template they shouldn't. To prevent this, check dynamic template paths against a predefined allowlist to make sure it's an allowed template. languages: - ruby severity: WARNING mode: taint pattern-sources: - pattern: params - pattern: cookies - pattern: request.env pattern-sinks: - patterns: - pattern-inside: render($X => $INPUT, ...) - pattern: $INPUT - metavariable-pattern: metavariable: $X pattern-either: - pattern: action - pattern: template - pattern: partial - pattern: file - id: python.lang.security.audit.insecure-file-permissions.insecure-file-permissions languages: - python severity: WARNING metadata: category: security owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control cwe: - 'CWE-276: Incorrect Default Permissions' technology: - python references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authorization source: https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions shortlink: https://sg.run/AXY4 semgrep.dev: rule: r_id: 13594 rv_id: 1263482 rule_id: zdUYqR version_id: O9Tpxqr url: https://semgrep.dev/playground/r/O9Tpxqr/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions origin: community message: These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else. patterns: - pattern-inside: os.$METHOD(...) - metavariable-pattern: metavariable: $METHOD patterns: - pattern-either: - pattern: chmod - pattern: lchmod - pattern: fchmod - pattern-either: - patterns: - pattern: os.$METHOD($FILE, $BITS, ...) - metavariable-comparison: metavariable: $BITS comparison: $BITS >= 0o650 and $BITS < 0o100000 - patterns: - pattern: os.$METHOD($FILE, $BITS) - metavariable-comparison: metavariable: $BITS comparison: $BITS >= 0o100650 - patterns: - pattern: os.$METHOD($FILE, $BITS, ...) - metavariable-pattern: metavariable: $BITS patterns: - pattern-either: - pattern: <... stat.S_IWGRP ...> - pattern: <... stat.S_IXGRP ...> - pattern: <... stat.S_IWOTH ...> - pattern: <... stat.S_IXOTH ...> - pattern: <... stat.S_IRWXO ...> - pattern: <... stat.S_IRWXG ...> - patterns: - pattern: os.$METHOD($FILE, $EXPR | $MOD, ...) - metavariable-comparison: metavariable: $MOD comparison: $MOD == 0o111 - id: php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query languages: - php message: '`$QUERY` Detected string concatenation with a non-literal variable in a Doctrine QueryBuilder method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead.' metadata: category: security cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/query-builder.html#security-safely-preventing-sql-injection - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html technology: - doctrine cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query shortlink: https://sg.run/jwDJ semgrep.dev: rule: r_id: 13965 rv_id: 1263271 rule_id: kxUw23 version_id: 1QTypnG url: https://semgrep.dev/playground/r/1QTypnG/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query origin: community mode: taint pattern-sinks: - patterns: - focus-metavariable: $SINK - pattern-either: - pattern: $QUERY->add(...,$SINK,...) - pattern: $QUERY->select(...,$SINK,...) - pattern: $QUERY->addSelect(...,$SINK,...) - pattern: $QUERY->delete(...,$SINK,...) - pattern: $QUERY->update(...,$SINK,...) - pattern: $QUERY->insert(...,$SINK,...) - pattern: $QUERY->from(...,$SINK,...) - pattern: $QUERY->join(...,$SINK,...) - pattern: $QUERY->innerJoin(...,$SINK,...) - pattern: $QUERY->leftJoin(...,$SINK,...) - pattern: $QUERY->rightJoin(...,$SINK,...) - pattern: $QUERY->where(...,$SINK,...) - pattern: $QUERY->andWhere(...,$SINK,...) - pattern: $QUERY->orWhere(...,$SINK,...) - pattern: $QUERY->groupBy(...,$SINK,...) - pattern: $QUERY->addGroupBy(...,$SINK,...) - pattern: $QUERY->having(...,$SINK,...) - pattern: $QUERY->andHaving(...,$SINK,...) - pattern: $QUERY->orHaving(...,$SINK,...) - pattern: $QUERY->orderBy(...,$SINK,...) - pattern: $QUERY->addOrderBy(...,$SINK,...) - pattern: $QUERY->set($SINK,...) - pattern: $QUERY->setValue($SINK,...) - pattern-either: - pattern-inside: | $Q = $X->createQueryBuilder(); ... - pattern-inside: | $Q = new QueryBuilder(...); ... pattern-sources: - patterns: - pattern-either: - pattern: sprintf(...) - pattern: | "...".$SMTH severity: WARNING - id: python.django.security.injection.raw-html-format.raw-html-format languages: - python severity: WARNING message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection category: security technology: - django references: - https://docs.djangoproject.com/en/3.2/topics/http/shortcuts/#render - https://docs.djangoproject.com/en/3.2/topics/security/#cross-site-scripting-xss-protection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format shortlink: https://sg.run/oYj1 semgrep.dev: rule: r_id: 14360 rv_id: 1263397 rule_id: 2ZUPER version_id: 5PTo100 url: https://semgrep.dev/playground/r/5PTo100/python.django.security.injection.raw-html-format.raw-html-format origin: community mode: taint pattern-sanitizers: - pattern: django.utils.html.escape(...) pattern-sources: - patterns: - pattern: request.$ANYTHING - pattern-not: request.build_absolute_uri pattern-sinks: - patterns: - pattern-either: - patterns: - pattern-either: - pattern: '"$HTMLSTR" % ...' - pattern: '"$HTMLSTR".format(...)' - pattern: '"$HTMLSTR" + ...' - pattern: f"$HTMLSTR{...}..." - patterns: - pattern-inside: | $HTML = "$HTMLSTR" ... - pattern-either: - pattern: $HTML % ... - pattern: $HTML.format(...) - pattern: $HTML + ... - metavariable-pattern: metavariable: $HTMLSTR language: generic pattern: <$TAG ... - id: python.flask.security.injection.raw-html-concat.raw-html-format languages: - python severity: WARNING message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`flask.render_template`) which will safely render HTML instead. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection category: security technology: - flask references: - https://flask.palletsprojects.com/en/2.0.x/security/#cross-site-scripting-xss cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/python.flask.security.injection.raw-html-concat.raw-html-format shortlink: https://sg.run/Pb7e semgrep.dev: rule: r_id: 14389 rv_id: 1409401 rule_id: GdUrJv version_id: RGTEN1l url: https://semgrep.dev/playground/r/RGTEN1l/python.flask.security.injection.raw-html-concat.raw-html-format origin: community mode: taint pattern-sanitizers: - pattern: jinja2.escape(...) - pattern: flask.escape(...) - patterns: - pattern: flask.render_template($TPL, ...) - metavariable-regex: metavariable: $TPL regex: .*\.html pattern-sources: - patterns: - pattern-either: - pattern: flask.request.$ANYTHING - patterns: - pattern-inside: | @$APP.route(...) def $FUNC(..., $ROUTEVAR, ...): ... - pattern: $ROUTEVAR pattern-sinks: - patterns: - pattern-either: - patterns: - pattern-either: - pattern: '"$HTMLSTR" % ...' - pattern: '"$HTMLSTR".format(...)' - pattern: '"$HTMLSTR" + ...' - pattern: f"$HTMLSTR{...}..." - patterns: - pattern-inside: | $HTML = "$HTMLSTR" ... - pattern-either: - pattern: $HTML % ... - pattern: $HTML.format(...) - pattern: $HTML + ... - metavariable-pattern: metavariable: $HTMLSTR language: generic pattern: <$TAG ... - id: go.lang.security.injection.tainted-url-host.tainted-url-host languages: - go message: A request was found to be crafted from user-input `$REQUEST`. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, potentially exposing sensitive data. It is recommend where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to prevent abuse, including using an allowlist. options: interfile: true metadata: cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://goteleport.com/blog/ssrf-attacks/ category: security technology: - go confidence: HIGH cwe2022-top25: true cwe2021-top25: true subcategory: - vuln impact: MEDIUM likelihood: MEDIUM interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Server-Side Request Forgery (SSRF) source: https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host shortlink: https://sg.run/5DjW semgrep.dev: rule: r_id: 14391 rv_id: 1262970 rule_id: AbUQLr version_id: yeTxpOj url: https://semgrep.dev/playground/r/yeTxpOj/go.lang.security.injection.tainted-url-host.tainted-url-host origin: community mode: taint pattern-sources: - label: INPUT patterns: - pattern-either: - pattern: | ($REQUEST : *http.Request).$ANYTHING - pattern: | ($REQUEST : http.Request).$ANYTHING - metavariable-regex: metavariable: $ANYTHING regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ - label: CLEAN requires: INPUT patterns: - pattern-either: - pattern: | "$URLSTR" + $INPUT - patterns: - pattern-either: - pattern: fmt.Fprintf($F, "$URLSTR", $INPUT, ...) - pattern: fmt.Sprintf("$URLSTR", $INPUT, ...) - pattern: fmt.Printf("$URLSTR", $INPUT, ...) - metavariable-regex: metavariable: $URLSTR regex: .*//[a-zA-Z0-10]+\..* pattern-sinks: - requires: INPUT and not CLEAN patterns: - pattern-either: - patterns: - pattern-either: - patterns: - pattern-inside: | $CLIENT := &http.Client{...} ... - pattern: $CLIENT.$METHOD($URL, ...) - pattern: http.$METHOD($URL, ...) - metavariable-regex: metavariable: $METHOD regex: ^(Get|Head|Post|PostForm)$ - patterns: - pattern: | http.NewRequest("$METHOD", $URL, ...) - metavariable-regex: metavariable: $METHOD regex: ^(GET|HEAD|POST|POSTFORM)$ - focus-metavariable: $URL severity: WARNING - id: go.lang.security.injection.raw-html-format.raw-html-format languages: - go severity: WARNING message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `html/template` package which will safely render HTML instead, or inspect that the HTML is rendered safely. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection category: security technology: - go references: - https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/ confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format shortlink: https://sg.run/3r1G semgrep.dev: rule: r_id: 14443 rv_id: 1262968 rule_id: PeUonQ version_id: 1QTyp2p url: https://semgrep.dev/playground/r/1QTyp2p/go.lang.security.injection.raw-html-format.raw-html-format origin: community mode: taint pattern-sources: - patterns: - pattern-either: - pattern: | ($REQUEST : *http.Request).$ANYTHING - pattern: | ($REQUEST : http.Request).$ANYTHING - metavariable-regex: metavariable: $ANYTHING regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ pattern-sanitizers: - pattern: html.EscapeString(...) pattern-sinks: - patterns: - pattern-either: - pattern: fmt.Printf("$HTMLSTR", ...) - pattern: fmt.Sprintf("$HTMLSTR", ...) - pattern: fmt.Fprintf($W, "$HTMLSTR", ...) - pattern: '"$HTMLSTR" + ...' - metavariable-pattern: metavariable: $HTMLSTR language: generic pattern: <$TAG ... - id: ruby.rails.security.injection.raw-html-format.raw-html-format languages: - ruby severity: WARNING message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `render template` and make template files which will safely render HTML instead, or inspect that the HTML is absolutely rendered safely with a function like `sanitize`. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection category: security technology: - rails references: - https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/ - https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/ruby.rails.security.injection.raw-html-format.raw-html-format shortlink: https://sg.run/b2JQ semgrep.dev: rule: r_id: 14470 rv_id: 1409408 rule_id: kxUwZX version_id: qkTvgYY url: https://semgrep.dev/playground/r/qkTvgYY/ruby.rails.security.injection.raw-html-format.raw-html-format origin: community mode: taint pattern-sanitizers: - pattern-either: - pattern: sanitize(...) - pattern: strip_tags(...) pattern-sources: - patterns: - pattern-either: - pattern: params - pattern: request pattern-sinks: - patterns: - pattern-either: - patterns: - pattern: | $HTMLSTR - pattern-regex: <\w+.* - patterns: - pattern-either: - pattern: Kernel::sprintf("$HTMLSTR", ...) - pattern: | "$HTMLSTR" + $EXPR - pattern: | "$HTMLSTR" % $EXPR - metavariable-pattern: metavariable: $HTMLSTR language: generic pattern: <$TAG ... - id: python.flask.security.injection.tainted-url-host.tainted-url-host languages: - python message: User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host. metadata: cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html category: security technology: - flask cwe2022-top25: true cwe2021-top25: true subcategory: - vuln impact: MEDIUM likelihood: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Server-Side Request Forgery (SSRF) source: https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host shortlink: https://sg.run/RXpK semgrep.dev: rule: r_id: 14649 rv_id: 1409403 rule_id: ReU3Wb version_id: BjTy42w url: https://semgrep.dev/playground/r/BjTy42w/python.flask.security.injection.tainted-url-host.tainted-url-host origin: community mode: taint pattern-sinks: - patterns: - pattern-either: - patterns: - pattern: '"$URLSTR" % ...' - metavariable-pattern: metavariable: $URLSTR language: generic patterns: - pattern-either: - pattern: $SCHEME://%s - pattern: $SCHEME://%r - patterns: - pattern: '"$URLSTR".format(...)' - metavariable-pattern: metavariable: $URLSTR language: generic pattern: $SCHEME:// { ... } - patterns: - pattern: '"$URLSTR" + ...' - metavariable-regex: metavariable: $URLSTR regex: .*://$ - patterns: - pattern: f"$URLSTR{...}..." - metavariable-regex: metavariable: $URLSTR regex: .*://$ - patterns: - pattern-inside: | $URL = "$URLSTR" ... - pattern: $URL += ... - metavariable-regex: metavariable: $URLSTR regex: .*://$ pattern-sources: - patterns: - pattern-either: - pattern: flask.request.$ANYTHING - patterns: - pattern-inside: | @$APP.route(...) def $FUNC(..., $ROUTEVAR, ...): ... - pattern: $ROUTEVAR severity: WARNING - id: go.lang.security.injection.tainted-sql-string.tainted-sql-string languages: - go message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`db.Query("SELECT * FROM t WHERE id = ?", id)`) or a safe library. options: interfile: true metadata: cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://golang.org/doc/database/sql-injection - https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/ category: security technology: - go confidence: HIGH cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string shortlink: https://sg.run/PbEq semgrep.dev: rule: r_id: 14689 rv_id: 1409388 rule_id: PeUoqy version_id: nWTQ5qD url: https://semgrep.dev/playground/r/nWTQ5qD/go.lang.security.injection.tainted-sql-string.tainted-sql-string origin: community mode: taint severity: ERROR pattern-sources: - patterns: - pattern-either: - pattern: | ($REQUEST : *http.Request).$ANYTHING - pattern: | ($REQUEST : http.Request).$ANYTHING - metavariable-regex: metavariable: $ANYTHING regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ pattern-sinks: - patterns: - pattern-either: - patterns: - pattern-either: - pattern: | "$SQLSTR" + ... - patterns: - pattern-inside: | $VAR = "$SQLSTR"; ... - pattern: $VAR += ... - patterns: - pattern-inside: | var $SB strings.Builder ... - pattern-inside: | $SB.WriteString("$SQLSTR") ... $SB.String(...) - pattern: | $SB.WriteString(...) - metavariable-regex: metavariable: $SQLSTR regex: (?i)(select|delete|insert|create|update|alter|drop).* - patterns: - pattern-either: - pattern: fmt.Fprintf($F, "$SQLSTR", ...) - pattern: fmt.Sprintf("$SQLSTR", ...) - pattern: fmt.Printf("$SQLSTR", ...) - metavariable-regex: metavariable: $SQLSTR regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).* pattern-sanitizers: - pattern-either: - pattern: strconv.Atoi(...) - pattern: | ($X: bool) - id: javascript.express.security.injection.raw-html-format.raw-html-format message: User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html category: security technology: - express cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format shortlink: https://sg.run/5DO3 semgrep.dev: rule: r_id: 14691 rv_id: 1263175 rule_id: 5rUL0X version_id: NdTzyQv url: https://semgrep.dev/playground/r/NdTzyQv/javascript.express.security.injection.raw-html-format.raw-html-format origin: community languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - label: EXPRESS patterns: - pattern-either: - pattern-inside: function ... ($REQ, $RES) {...} - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - patterns: - pattern-either: - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|head|delete|options)$ - pattern-either: - pattern: $REQ.query - pattern: $REQ.body - pattern: $REQ.params - pattern: $REQ.cookies - pattern: $REQ.headers - label: EXPRESSTS patterns: - pattern-either: - pattern-inside: | ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...} - pattern-inside: | ({ $REQ }: Request,$RES: Response) => {...} - focus-metavariable: $REQ - pattern-either: - pattern: params - pattern: query - pattern: cookies - pattern: headers - pattern: body - label: CLEAN by-side-effect: true patterns: - pattern-either: - pattern: $A($SOURCE) - pattern: $SANITIZE. ... .$A($SOURCE) - pattern: $A. ... .$SANITIZE($SOURCE) - focus-metavariable: $SOURCE - metavariable-regex: metavariable: $A regex: (?i)(.*valid|.*sanitiz) pattern-sinks: - requires: (EXPRESS and not CLEAN) or (EXPRESSTS and not CLEAN) patterns: - pattern-either: - patterns: - pattern-either: - pattern: '"$HTMLSTR" + $EXPR' - pattern: '"$HTMLSTR".concat(...)' - pattern: util.format($HTMLSTR, ...) - metavariable-pattern: metavariable: $HTMLSTR language: generic pattern: <$TAG ... - patterns: - pattern: | `...` - pattern-regex: | .*<\w+.* - id: ruby.rails.security.injection.tainted-url-host.tainted-url-host languages: - ruby severity: WARNING message: User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Use the `ssrf_filter` gem and guard the url construction with `SsrfFilter(...)`, or create an allowlist for approved hosts. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection category: security technology: - rails references: - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html - https://github.com/arkadiyt/ssrf_filter cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/ruby.rails.security.injection.tainted-url-host.tainted-url-host shortlink: https://sg.run/RX3g semgrep.dev: rule: r_id: 14705 rv_id: 1263668 rule_id: zdUY0W version_id: 6xT29BN url: https://semgrep.dev/playground/r/6xT29BN/ruby.rails.security.injection.tainted-url-host.tainted-url-host origin: community mode: taint pattern-sanitizers: - pattern: SsrfFilter pattern-sources: - patterns: - pattern-either: - pattern: params - pattern: request pattern-sinks: - patterns: - pattern-either: - patterns: - pattern: | $URLSTR - pattern-regex: \w+:\/\/#{.*} - patterns: - pattern-either: - pattern: Kernel::sprintf("$URLSTR", ...) - pattern: | "$URLSTR" + $EXPR - pattern: | "$URLSTR" % $EXPR - metavariable-pattern: metavariable: $URLSTR language: generic pattern: $SCHEME:// ... - id: ruby.rails.security.injection.tainted-sql-string.tainted-sql-string languages: - ruby severity: ERROR message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries. metadata: cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection category: security technology: - rails references: - https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/ruby.rails.security.injection.tainted-sql-string.tainted-sql-string shortlink: https://sg.run/Y85o semgrep.dev: rule: r_id: 14714 rv_id: 1263667 rule_id: bwU8gl version_id: YDTZeLL url: https://semgrep.dev/playground/r/YDTZeLL/ruby.rails.security.injection.tainted-sql-string.tainted-sql-string origin: community mode: taint pattern-sources: - patterns: - pattern-either: - pattern: params - pattern: request pattern-sanitizers: - pattern: | $PARAMS.slice(...) pattern-sinks: - patterns: - pattern-either: - patterns: - pattern-either: - patterns: - pattern: | $RECORD.where($X,...) - pattern: | $RECORD.find(..., :conditions => $X,...) - focus-metavariable: $X - patterns: - pattern: | "$SQLVERB#{$EXPR}..." - pattern-not-inside: | $FUNC("...", "...#{$EXPR}...",...) - focus-metavariable: $SQLVERB - pattern-regex: (?i)(select|delete|insert|create|update|alter|drop)\b - patterns: - pattern-either: - pattern: Kernel::sprintf("$SQLSTR", $EXPR) - pattern: | "$SQLSTR" + $EXPR - pattern: | "$SQLSTR" % $EXPR - pattern-not-inside: | $FUNC("...", "...#{$EXPR}...",...) - focus-metavariable: $EXPR - metavariable-regex: metavariable: $SQLSTR regex: (?i)(select|delete|insert|create|update|alter|drop)\b - id: php.lang.security.injection.tainted-sql-string.tainted-sql-string languages: - php severity: ERROR message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`$mysqli->prepare("INSERT INTO test(id, label) VALUES (?, ?)");`) or a safe library. metadata: cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/www-community/attacks/SQL_Injection category: security technology: - php cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/php.lang.security.injection.tainted-sql-string.tainted-sql-string shortlink: https://sg.run/lZYG semgrep.dev: rule: r_id: 14757 rv_id: 1263290 rule_id: qNUXdL version_id: gETB7vY url: https://semgrep.dev/playground/r/gETB7vY/php.lang.security.injection.tainted-sql-string.tainted-sql-string origin: community mode: taint pattern-sanitizers: - pattern-either: - pattern: mysqli_real_escape_string(...) - pattern: real_escape_string(...) - pattern: $MYSQLI->real_escape_string(...) pattern-sources: - patterns: - pattern-either: - pattern: $_GET - pattern: $_POST - pattern: $_COOKIE - pattern: $_REQUEST pattern-sinks: - pattern-either: - patterns: - pattern: | sprintf($SQLSTR, ...) - metavariable-regex: metavariable: $SQLSTR regex: (?is).*\b(select|delete|insert|create|update|alter|drop)\b.* - patterns: - pattern: | "...$EXPR..." - metavariable-regex: metavariable: $EXPR regex: (?is).*\b(select|delete|insert|create|update|alter|drop)\b.* - patterns: - pattern: | "$SQLSTR".$EXPR - metavariable-regex: metavariable: $SQLSTR regex: (?is).*\b(select|delete|insert|create|update|alter|drop)\b.* - id: php.lang.security.injection.tainted-url-host.tainted-url-host languages: - php severity: WARNING message: User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host. metadata: cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html category: security technology: - php cwe2022-top25: true cwe2021-top25: true subcategory: - vuln impact: MEDIUM likelihood: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Server-Side Request Forgery (SSRF) source: https://semgrep.dev/r/php.lang.security.injection.tainted-url-host.tainted-url-host shortlink: https://sg.run/Y8no semgrep.dev: rule: r_id: 14758 rv_id: 1263291 rule_id: lBU8K1 version_id: QkTGqRd url: https://semgrep.dev/playground/r/QkTGqRd/php.lang.security.injection.tainted-url-host.tainted-url-host origin: community mode: taint pattern-sources: - patterns: - pattern-either: - pattern: $_GET - pattern: $_POST - pattern: $_COOKIE - pattern: $_REQUEST pattern-sinks: - pattern-either: - patterns: - pattern: | sprintf($URLSTR, ...) - metavariable-pattern: metavariable: $URLSTR language: generic pattern: $SCHEME://%s - patterns: - pattern: | "...{$EXPR}..." - pattern-regex: | .*://\{.* - patterns: - pattern: | "...$EXPR..." - pattern-regex: | .*://\$.* - patterns: - pattern: | "...".$EXPR - pattern-regex: | .*://["'].* - id: java.spring.security.injection.tainted-sql-string.tainted-sql-string languages: - java severity: ERROR message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library. metadata: cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html category: security technology: - spring cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/java.spring.security.injection.tainted-sql-string.tainted-sql-string shortlink: https://sg.run/9rzz semgrep.dev: rule: r_id: 14767 rv_id: 1409396 rule_id: 10UdRR version_id: 44TbKvr url: https://semgrep.dev/playground/r/44TbKvr/java.spring.security.injection.tainted-sql-string.tainted-sql-string origin: community options: taint_assume_safe_numbers: true taint_assume_safe_booleans: true interfile: true mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: | $METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) { ... } - pattern-inside: | $METHODNAME(..., @$REQ $TYPE $SOURCE,...) { ... } - metavariable-regex: metavariable: $REQ regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue) - metavariable-regex: metavariable: $TYPE regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean)) - focus-metavariable: $SOURCE pattern-sinks: - patterns: - pattern-either: - pattern: | "$SQLSTR" + ... - pattern: | "$SQLSTR".concat(...) - patterns: - pattern-inside: | StringBuilder $SB = new StringBuilder("$SQLSTR"); ... - pattern: $SB.append(...) - patterns: - pattern-inside: | $VAR = "$SQLSTR"; ... - pattern: $VAR += ... - pattern: String.format("$SQLSTR", ...) - patterns: - pattern-inside: | String $VAR = "$SQLSTR"; ... - pattern: String.format($VAR, ...) - pattern-not-inside: System.out.println(...) - pattern-not-inside: $LOG.info(...) - pattern-not-inside: $LOG.warn(...) - pattern-not-inside: $LOG.warning(...) - pattern-not-inside: $LOG.debug(...) - pattern-not-inside: $LOG.debugging(...) - pattern-not-inside: $LOG.error(...) - pattern-not-inside: new Exception(...) - pattern-not-inside: throw ...; - metavariable-regex: metavariable: $SQLSTR regex: (?i)(select|delete|insert|create|update|alter|drop)\b - id: csharp.lang.security.sqli.csharp-sqli.csharp-sqli mode: taint pattern-sources: - patterns: - pattern: | (string $X) - pattern-not: | "..." pattern-propagators: - pattern: (StringBuilder $B).$ANY(...,(string $X),...) from: $X to: $B pattern-sinks: - patterns: - pattern-either: - patterns: - pattern: | new $PATTERN($CMD,...) - focus-metavariable: $CMD - patterns: - pattern: | $CMD.$PATTERN = $VALUE; - focus-metavariable: $VALUE - metavariable-regex: metavariable: $PATTERN regex: ^(SqlCommand|CommandText|OleDbCommand|OdbcCommand|OracleCommand)$ pattern-sanitizers: - pattern-either: - pattern: | $CMD.Parameters.Add(...) - pattern: | $CMD.Parameters.AddRange(...) - pattern: | $CMD.Parameters.AddWithValue(...) - pattern: | $CMD.Parameters[$IDX].Value = ... by-side-effect: true message: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'. metadata: category: security technology: - csharp owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/csharp.lang.security.sqli.csharp-sqli.csharp-sqli shortlink: https://sg.run/d2Xd semgrep.dev: rule: r_id: 15078 rv_id: 1262648 rule_id: x8UxeP version_id: RGT0LqW url: https://semgrep.dev/playground/r/RGT0LqW/csharp.lang.security.sqli.csharp-sqli.csharp-sqli origin: community languages: - csharp severity: ERROR - id: terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled message: Enabling authentication ensures that all communications in the application are authenticated. The `auth_settings` block needs to be filled out with the appropriate auth backend settings patterns: - pattern: resource - pattern-not-inside: | resource "azurerm_app_service" "..." { ... auth_settings { ... enabled = true ... } ... } - pattern-either: - pattern-inside: | resource "azurerm_app_service" "..." { ... } - pattern-inside: | resource "azurerm_app_service" "..." { ... auth_settings { ... enabled = false ... } ... } metadata: cwe: - 'CWE-287: Improper Authentication' category: security technology: - terraform - azure references: - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#auth_settings owasp: - A02:2017 - Broken Authentication - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled shortlink: https://sg.run/JxYw semgrep.dev: rule: r_id: 15102 rv_id: 1263755 rule_id: 0oU23p version_id: PkTR3P8 url: https://semgrep.dev/playground/r/PkTR3P8/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled origin: community languages: - hcl severity: ERROR - id: kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind metadata: cwe: - 'CWE-287: Improper Authentication' owasp: - A02:2017 - Broken Authentication - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#LDAP_ANONYMOUS category: security technology: - kotlin references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind shortlink: https://sg.run/rY2n semgrep.dev: rule: r_id: 15125 rv_id: 1263258 rule_id: v8U9Q7 version_id: WrTqKgJ url: https://semgrep.dev/playground/r/WrTqKgJ/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind origin: community message: Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information. severity: WARNING pattern: | $ENV.put($CTX.SECURITY_AUTHENTICATION, "none") ... $DCTX = InitialDirContext($ENV, ...) languages: - kt - id: typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod message: Using the GrantPublicAccess method on bucket contruct $X will make the objects in the bucket world accessible. Verify if this is intentional. metadata: cwe: - 'CWE-306: Missing Authentication for Critical Function' category: security technology: - AWS-CDK references: - https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod shortlink: https://sg.run/Z4p7 semgrep.dev: rule: r_id: 15279 rv_id: 1263906 rule_id: wdUjZK version_id: BjTkZA7 url: https://semgrep.dev/playground/r/BjTkZA7/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod origin: community languages: - ts severity: WARNING pattern-either: - patterns: - pattern-inside: | import {Bucket} from '@aws-cdk/aws-s3' ... - pattern: | const $X = new Bucket(...) ... $X.grantPublicAccess(...) - patterns: - pattern-inside: | import * as $Y from '@aws-cdk/aws-s3' ... - pattern: | const $X = new $Y.Bucket(...) ... $X.grantPublicAccess(...) - id: typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public message: CodeBuild Project $X is set to have a public URL. This will make the build results, logs, artifacts publically accessible, including builds prior to the project being public. Ensure this is acceptable for the project. metadata: category: security cwe: - 'CWE-306: Missing Authentication for Critical Function' technology: - AWS-CDK references: - https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public shortlink: https://sg.run/nK7G semgrep.dev: rule: r_id: 15280 rv_id: 1263907 rule_id: x8UxXZ version_id: DkTRbj1 url: https://semgrep.dev/playground/r/DkTRbj1/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public origin: community languages: - ts severity: WARNING pattern-either: - patterns: - pattern-inside: | import {Project} from '@aws-cdk/aws-codebuild' ... - pattern: | const $X = new Project(..., {..., badge: true, ...}) - patterns: - pattern-inside: | import * as $Y from '@aws-cdk/aws-codebuild' ... - pattern: | const $X = new $Y.Project(..., {..., badge: true, ...}) - id: python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text mode: taint pattern-sinks: - pattern: | sqlalchemy.text(...) pattern-sources: - patterns: - pattern: | $X + $Y - metavariable-type: metavariable: $X type: string - patterns: - pattern: | $X + $Y - metavariable-type: metavariable: $Y type: string - patterns: - pattern: | f"..." - patterns: - pattern: | $X.format(...) - metavariable-type: metavariable: $X type: string - patterns: - pattern: | $X % $Y - metavariable-type: metavariable: $X type: string message: sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as `or_()`, `and_()`, etc.) to construct SQL. metadata: owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' category: security technology: - sqlalchemy confidence: MEDIUM references: - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text shortlink: https://sg.run/yP1O semgrep.dev: rule: r_id: 15824 rv_id: 1263577 rule_id: r6U2wE version_id: rxTAKqq url: https://semgrep.dev/playground/r/rxTAKqq/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text origin: community languages: - python severity: ERROR - id: generic.ci.security.bash-reverse-shell.bash_reverse_shell metadata: cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' category: security technology: - ci confidence: HIGH owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true subcategory: - audit likelihood: MEDIUM impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/generic.ci.security.bash-reverse-shell.bash_reverse_shell shortlink: https://sg.run/4l9l semgrep.dev: rule: r_id: 16200 rv_id: 1262664 rule_id: gxUJrJ version_id: jQTn5QE url: https://semgrep.dev/playground/r/jQTn5QE/generic.ci.security.bash-reverse-shell.bash_reverse_shell origin: community message: Semgrep found a bash reverse shell severity: ERROR languages: - generic pattern-either: - pattern: | sh -i >& /dev/udp/.../... 0>&1 - pattern: | <...>/dev/tcp/.../...; sh <&... >&... 2>& - pattern: | <...>/dev/tcp/.../...; cat <&... | while read line; do $line 2>&... >&...;done - pattern: | sh -i ...<...> /dev/tcp/.../... ...<&... 1>&... 2>& - id: php.lang.security.injection.tainted-filename.tainted-filename severity: WARNING message: File name based on user input risks server-side request forgery. metadata: technology: - php category: security cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29 cwe2022-top25: true cwe2021-top25: true subcategory: - vuln impact: MEDIUM likelihood: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Server-Side Request Forgery (SSRF) source: https://semgrep.dev/r/php.lang.security.injection.tainted-filename.tainted-filename shortlink: https://sg.run/Ayqp semgrep.dev: rule: r_id: 16250 rv_id: 1263287 rule_id: 5rUpro version_id: 7ZTE3J1 url: https://semgrep.dev/playground/r/7ZTE3J1/php.lang.security.injection.tainted-filename.tainted-filename origin: community languages: - php mode: taint pattern-sources: - patterns: - pattern-either: - pattern: $_GET - pattern: $_POST - pattern: $_COOKIE - pattern: $_REQUEST - pattern: $_SERVER pattern-sanitizers: - patterns: - pattern-either: - pattern-inside: basename($PATH, ...) - pattern-inside: linkinfo($PATH, ...) - pattern-inside: readlink($PATH, ...) - pattern-inside: realpath($PATH, ...) pattern-sinks: - patterns: - pattern-either: - pattern-inside: opcache_compile_file($FILENAME, ...) - pattern-inside: opcache_invalidate($FILENAME, ...) - pattern-inside: opcache_is_script_cached($FILENAME, ...) - pattern-inside: runkit7_import($FILENAME, ...) - pattern-inside: readline_read_history($FILENAME, ...) - pattern-inside: readline_write_history($FILENAME, ...) - pattern-inside: rar_open($FILENAME, ...) - pattern-inside: zip_open($FILENAME, ...) - pattern-inside: gzfile($FILENAME, ...) - pattern-inside: gzopen($FILENAME, ...) - pattern-inside: readgzfile($FILENAME, ...) - pattern-inside: hash_file($ALGO, $FILENAME, ...) - pattern-inside: hash_update_file($CONTEXT, $FILENAME, ...) - pattern-inside: pg_trace($FILENAME, ...) - pattern-inside: dio_open($FILENAME, ...) - pattern-inside: finfo_file($FINFO, $FILENAME, ...) - pattern-inside: mime_content_type($FILENAME, ...) - pattern-inside: chgrp($FILENAME, ...) - pattern-inside: chmod($FILENAME, ...) - pattern-inside: chown($FILENAME, ...) - pattern-inside: clearstatcache($CLEAR_REALPATH_CACHE, $FILENAME, ...) - pattern-inside: file_exists($FILENAME, ...) - pattern-inside: file_get_contents($FILENAME, ...) - pattern-inside: file_put_contents($FILENAME, ...) - pattern-inside: file($FILENAME, ...) - pattern-inside: fileatime($FILENAME, ...) - pattern-inside: filectime($FILENAME, ...) - pattern-inside: filegroup($FILENAME, ...) - pattern-inside: fileinode($FILENAME, ...) - pattern-inside: filemtime($FILENAME, ...) - pattern-inside: fileowner($FILENAME, ...) - pattern-inside: fileperms($FILENAME, ...) - pattern-inside: filesize($FILENAME, ...) - pattern-inside: filetype($FILENAME, ...) - pattern-inside: fnmatch($PATTERN, $FILENAME, ...) - pattern-inside: fopen($FILENAME, ...) - pattern-inside: is_dir($FILENAME, ...) - pattern-inside: is_executable($FILENAME, ...) - pattern-inside: is_file($FILENAME, ...) - pattern-inside: is_link($FILENAME, ...) - pattern-inside: is_readable($FILENAME, ...) - pattern-inside: is_uploaded_file($FILENAME, ...) - pattern-inside: is_writable($FILENAME, ...) - pattern-inside: lchgrp($FILENAME, ...) - pattern-inside: lchown($FILENAME, ...) - pattern-inside: lstat($FILENAME, ...) - pattern-inside: parse_ini_file($FILENAME, ...) - pattern-inside: readfile($FILENAME, ...) - pattern-inside: stat($FILENAME, ...) - pattern-inside: touch($FILENAME, ...) - pattern-inside: unlink($FILENAME, ...) - pattern-inside: xattr_get($FILENAME, ...) - pattern-inside: xattr_list($FILENAME, ...) - pattern-inside: xattr_remove($FILENAME, ...) - pattern-inside: xattr_set($FILENAME, ...) - pattern-inside: xattr_supported($FILENAME, ...) - pattern-inside: enchant_broker_request_pwl_dict($BROKER, $FILENAME, ...) - pattern-inside: pspell_config_personal($CONFIG, $FILENAME, ...) - pattern-inside: pspell_config_repl($CONFIG, $FILENAME, ...) - pattern-inside: pspell_new_personal($FILENAME, ...) - pattern-inside: exif_imagetype($FILENAME, ...) - pattern-inside: getimagesize($FILENAME, ...) - pattern-inside: image2wbmp($IMAGE, $FILENAME, ...) - pattern-inside: imagecreatefromavif($FILENAME, ...) - pattern-inside: imagecreatefrombmp($FILENAME, ...) - pattern-inside: imagecreatefromgd2($FILENAME, ...) - pattern-inside: imagecreatefromgd2part($FILENAME, ...) - pattern-inside: imagecreatefromgd($FILENAME, ...) - pattern-inside: imagecreatefromgif($FILENAME, ...) - pattern-inside: imagecreatefromjpeg($FILENAME, ...) - pattern-inside: imagecreatefrompng($FILENAME, ...) - pattern-inside: imagecreatefromtga($FILENAME, ...) - pattern-inside: imagecreatefromwbmp($FILENAME, ...) - pattern-inside: imagecreatefromwebp($FILENAME, ...) - pattern-inside: imagecreatefromxbm($FILENAME, ...) - pattern-inside: imagecreatefromxpm($FILENAME, ...) - pattern-inside: imageloadfont($FILENAME, ...) - pattern-inside: imagexbm($IMAGE, $FILENAME, ...) - pattern-inside: iptcembed($IPTC_DATA, $FILENAME, ...) - pattern-inside: mailparse_msg_extract_part_file($MIMEMAIL, $FILENAME, ...) - pattern-inside: mailparse_msg_extract_whole_part_file($MIMEMAIL, $FILENAME, ...) - pattern-inside: mailparse_msg_parse_file($FILENAME, ...) - pattern-inside: fdf_add_template($FDF_DOCUMENT, $NEWPAGE, $FILENAME, ...) - pattern-inside: fdf_get_ap($FDF_DOCUMENT, $FIELD, $FACE, $FILENAME, ...) - pattern-inside: fdf_open($FILENAME, ...) - pattern-inside: fdf_save($FDF_DOCUMENT, $FILENAME, ...) - pattern-inside: fdf_set_ap($FDF_DOCUMENT, $FIELD_NAME, $FACE, $FILENAME, ...) - pattern-inside: ps_add_launchlink($PSDOC, $LLX, $LLY, $URX, $URY, $FILENAME, ...) - pattern-inside: ps_add_pdflink($PSDOC, $LLX, $LLY, $URX, $URY, $FILENAME, ...) - pattern-inside: ps_open_file($PSDOC, $FILENAME, ...) - pattern-inside: ps_open_image_file($PSDOC, $TYPE, $FILENAME, ...) - pattern-inside: posix_access($FILENAME, ...) - pattern-inside: posix_mkfifo($FILENAME, ...) - pattern-inside: posix_mknod($FILENAME, ...) - pattern-inside: ftok($FILENAME, ...) - pattern-inside: fann_cascadetrain_on_file($ANN, $FILENAME, ...) - pattern-inside: fann_read_train_from_file($FILENAME, ...) - pattern-inside: fann_train_on_file($ANN, $FILENAME, ...) - pattern-inside: highlight_file($FILENAME, ...) - pattern-inside: php_strip_whitespace($FILENAME, ...) - pattern-inside: stream_resolve_include_path($FILENAME, ...) - pattern-inside: swoole_async_read($FILENAME, ...) - pattern-inside: swoole_async_readfile($FILENAME, ...) - pattern-inside: swoole_async_write($FILENAME, ...) - pattern-inside: swoole_async_writefile($FILENAME, ...) - pattern-inside: swoole_load_module($FILENAME, ...) - pattern-inside: tidy_parse_file($FILENAME, ...) - pattern-inside: tidy_repair_file($FILENAME, ...) - pattern-inside: get_meta_tags($FILENAME, ...) - pattern-inside: yaml_emit_file($FILENAME, ...) - pattern-inside: yaml_parse_file($FILENAME, ...) - pattern-inside: curl_file_create($FILENAME, ...) - pattern-inside: ftp_chmod($FTP, $PERMISSIONS, $FILENAME, ...) - pattern-inside: ftp_delete($FTP, $FILENAME, ...) - pattern-inside: ftp_mdtm($FTP, $FILENAME, ...) - pattern-inside: ftp_size($FTP, $FILENAME, ...) - pattern-inside: rrd_create($FILENAME, ...) - pattern-inside: rrd_fetch($FILENAME, ...) - pattern-inside: rrd_graph($FILENAME, ...) - pattern-inside: rrd_info($FILENAME, ...) - pattern-inside: rrd_last($FILENAME, ...) - pattern-inside: rrd_lastupdate($FILENAME, ...) - pattern-inside: rrd_tune($FILENAME, ...) - pattern-inside: rrd_update($FILENAME, ...) - pattern-inside: snmp_read_mib($FILENAME, ...) - pattern-inside: ssh2_sftp_chmod($SFTP, $FILENAME, ...) - pattern-inside: ssh2_sftp_realpath($SFTP, $FILENAME, ...) - pattern-inside: ssh2_sftp_unlink($SFTP, $FILENAME, ...) - pattern-inside: apache_lookup_uri($FILENAME, ...) - pattern-inside: md5_file($FILENAME, ...) - pattern-inside: sha1_file($FILENAME, ...) - pattern-inside: simplexml_load_file($FILENAME, ...) - pattern: $FILENAME - id: terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials patterns: - pattern-inside: | provider "aws" { ... secret_key = "$SECRET" } - focus-metavariable: $SECRET message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). languages: - hcl severity: WARNING metadata: technology: - secrets - aws - terraform category: security cwe: - 'CWE-798: Use of Hard-coded Credentials' references: - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials shortlink: https://sg.run/L3kn semgrep.dev: rule: r_id: 16439 rv_id: 1263735 rule_id: d8U4n0 version_id: rxTAK76 url: https://semgrep.dev/playground/r/rxTAK76/terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials origin: community - id: php.laravel.security.laravel-sql-injection.laravel-sql-injection metadata: owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' category: security technology: - laravel references: - https://laravel.com/docs/8.x/queries cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/php.laravel.security.laravel-sql-injection.laravel-sql-injection shortlink: https://sg.run/x40p semgrep.dev: rule: r_id: 16830 rv_id: 1263313 rule_id: j2UQdp version_id: BjTkZ45 url: https://semgrep.dev/playground/r/BjTkZ45/php.laravel.security.laravel-sql-injection.laravel-sql-injection origin: community severity: WARNING message: Detected a SQL query based on user input. This could lead to SQL injection, which could potentially result in sensitive data being exfiltrated by attackers. Instead, use parameterized queries and prepared statements. languages: - php mode: taint pattern-sources: - patterns: - pattern-either: - pattern: $_GET - pattern: $_POST - pattern: $_COOKIE - pattern: $_REQUEST - pattern: $_SERVER pattern-sinks: - patterns: - pattern-either: - patterns: - pattern: $SQL - pattern-either: - pattern-inside: DB::table(...)->whereRaw($SQL, ...) - pattern-inside: DB::table(...)->orWhereRaw($SQL, ...) - pattern-inside: DB::table(...)->groupByRaw($SQL, ...) - pattern-inside: DB::table(...)->havingRaw($SQL, ...) - pattern-inside: DB::table(...)->orHavingRaw($SQL, ...) - pattern-inside: DB::table(...)->orderByRaw($SQL, ...) - patterns: - pattern: $EXPRESSION - pattern-either: - pattern-inside: DB::table(...)->selectRaw($EXPRESSION, ...) - pattern-inside: DB::table(...)->fromRaw($EXPRESSION, ...) - patterns: - pattern: $COLUMNS - pattern-either: - pattern-inside: DB::table(...)->whereNull($COLUMNS, ...) - pattern-inside: DB::table(...)->orWhereNull($COLUMN) - pattern-inside: DB::table(...)->whereNotNull($COLUMNS, ...) - pattern-inside: DB::table(...)->whereRowValues($COLUMNS, ...) - pattern-inside: DB::table(...)->orWhereRowValues($COLUMNS, ...) - pattern-inside: DB::table(...)->find($ID, $COLUMNS) - pattern-inside: DB::table(...)->paginate($PERPAGE, $COLUMNS, ...) - pattern-inside: DB::table(...)->simplePaginate($PERPAGE, $COLUMNS, ...) - pattern-inside: DB::table(...)->cursorPaginate($PERPAGE, $COLUMNS, ...) - pattern-inside: DB::table(...)->getCountForPagination($COLUMNS) - pattern-inside: DB::table(...)->aggregate($FUNCTION, $COLUMNS) - pattern-inside: DB::table(...)->numericAggregate($FUNCTION, $COLUMNS) - pattern-inside: DB::table(...)->insertUsing($COLUMNS, ...) - pattern-inside: DB::table(...)->select($COLUMNS) - pattern-inside: DB::table(...)->get($COLUMNS) - pattern-inside: DB::table(...)->count($COLUMNS) - patterns: - pattern: $COLUMN - pattern-either: - pattern-inside: DB::table(...)->whereIn($COLUMN, ...) - pattern-inside: DB::table(...)->orWhereIn($COLUMN, ...) - pattern-inside: DB::table(...)->whereNotIn($COLUMN, ...) - pattern-inside: DB::table(...)->orWhereNotIn($COLUMN, ...) - pattern-inside: DB::table(...)->whereIntegerInRaw($COLUMN, ...) - pattern-inside: DB::table(...)->orWhereIntegerInRaw($COLUMN, ...) - pattern-inside: DB::table(...)->whereIntegerNotInRaw($COLUMN, ...) - pattern-inside: DB::table(...)->orWhereIntegerNotInRaw($COLUMN, ...) - pattern-inside: DB::table(...)->whereBetweenColumns($COLUMN, ...) - pattern-inside: DB::table(...)->orWhereBetween($COLUMN, ...) - pattern-inside: DB::table(...)->orWhereBetweenColumns($COLUMN, ...) - pattern-inside: DB::table(...)->whereNotBetween($COLUMN, ...) - pattern-inside: DB::table(...)->whereNotBetweenColumns($COLUMN, ...) - pattern-inside: DB::table(...)->orWhereNotBetween($COLUMN, ...) - pattern-inside: DB::table(...)->orWhereNotBetweenColumns($COLUMN, ...) - pattern-inside: DB::table(...)->orWhereNotNull($COLUMN) - pattern-inside: DB::table(...)->whereDate($COLUMN, ...) - pattern-inside: DB::table(...)->orWhereDate($COLUMN, ...) - pattern-inside: DB::table(...)->whereTime($COLUMN, ...) - pattern-inside: DB::table(...)->orWhereTime($COLUMN, ...) - pattern-inside: DB::table(...)->whereDay($COLUMN, ...) - pattern-inside: DB::table(...)->orWhereDay($COLUMN, ...) - pattern-inside: DB::table(...)->whereMonth($COLUMN, ...) - pattern-inside: DB::table(...)->orWhereMonth($COLUMN, ...) - pattern-inside: DB::table(...)->whereYear($COLUMN, ...) - pattern-inside: DB::table(...)->orWhereYear($COLUMN, ...) - pattern-inside: DB::table(...)->whereJsonContains($COLUMN, ...) - pattern-inside: DB::table(...)->orWhereJsonContains($COLUMN, ...) - pattern-inside: DB::table(...)->whereJsonDoesntContain($COLUMN, ...) - pattern-inside: DB::table(...)->orWhereJsonDoesntContain($COLUMN, ...) - pattern-inside: DB::table(...)->whereJsonLength($COLUMN, ...) - pattern-inside: DB::table(...)->orWhereJsonLength($COLUMN, ...) - pattern-inside: DB::table(...)->having($COLUMN, ...) - pattern-inside: DB::table(...)->orHaving($COLUMN, ...) - pattern-inside: DB::table(...)->havingBetween($COLUMN, ...) - pattern-inside: DB::table(...)->orderBy($COLUMN, ...) - pattern-inside: DB::table(...)->orderByDesc($COLUMN) - pattern-inside: DB::table(...)->latest($COLUMN) - pattern-inside: DB::table(...)->oldest($COLUMN) - pattern-inside: DB::table(...)->forPageBeforeId($PERPAGE, $LASTID, $COLUMN) - pattern-inside: DB::table(...)->forPageAfterId($PERPAGE, $LASTID, $COLUMN) - pattern-inside: DB::table(...)->value($COLUMN) - pattern-inside: DB::table(...)->pluck($COLUMN, ...) - pattern-inside: DB::table(...)->implode($COLUMN, ...) - pattern-inside: DB::table(...)->min($COLUMN) - pattern-inside: DB::table(...)->max($COLUMN) - pattern-inside: DB::table(...)->sum($COLUMN) - pattern-inside: DB::table(...)->avg($COLUMN) - pattern-inside: DB::table(...)->average($COLUMN) - pattern-inside: DB::table(...)->increment($COLUMN, ...) - pattern-inside: DB::table(...)->decrement($COLUMN, ...) - pattern-inside: DB::table(...)->where($COLUMN, ...) - pattern-inside: DB::table(...)->orWhere($COLUMN, ...) - pattern-inside: DB::table(...)->addSelect($COLUMN) - patterns: - pattern: $QUERY - pattern-inside: DB::unprepared($QUERY) - id: csharp.dotnet.security.razor-template-injection.razor-template-injection message: User-controllable string passed to Razor.Parse. This leads directly to code execution in the context of the process. severity: WARNING metadata: likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM category: security cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' cwe2022-top25: true owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-(SSTI)-in-ASP.NET-Razor/ subcategory: - vuln technology: - .net - razor - asp license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/csharp.dotnet.security.razor-template-injection.razor-template-injection shortlink: https://sg.run/oyj0 semgrep.dev: rule: r_id: 18216 rv_id: 1262621 rule_id: EwUr68 version_id: 1QTypdj url: https://semgrep.dev/playground/r/1QTypdj/csharp.dotnet.security.razor-template-injection.razor-template-injection origin: community languages: - csharp mode: taint pattern-sources: - patterns: - focus-metavariable: $ARG - pattern-inside: | public ActionResult $METHOD(..., string $ARG,...){...} pattern-sinks: - pattern: | Razor.Parse(...) pattern-sanitizers: - not_conflicting: true pattern: $F(...) - id: csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine mode: taint pattern-sources: - patterns: - pattern: $A - pattern-inside: | Path.Combine(...,$A,...) - pattern-inside: | public $TYPE $M(...,$A,...){...} - pattern-not-inside: | <... Path.GetFileName($A) != $A ...> pattern-sinks: - patterns: - focus-metavariable: $X - pattern: | File.$METHOD($X,...) - metavariable-regex: metavariable: $METHOD regex: (?i)^(read|write) pattern-sanitizers: - pattern: | Path.GetFileName(...) - patterns: - pattern-inside: | $X = Path.GetFileName(...); ... - pattern: $X - patterns: - pattern: $X - pattern-inside: | if(<... Path.GetFileName($X) != $X ...>){ ... throw new $EXCEPTION(...); } ... message: String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal. languages: - csharp severity: WARNING metadata: category: security confidence: MEDIUM references: - https://www.praetorian.com/blog/pathcombine-security-issues-in-aspnet-applications/ - https://docs.microsoft.com/en-us/dotnet/api/system.io.path.combine?view=net-6.0#remarks technology: - .net cwe: - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Path Traversal source: https://semgrep.dev/r/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine shortlink: https://sg.run/1RvG semgrep.dev: rule: r_id: 18222 rv_id: 1262632 rule_id: 3qU3bE version_id: vdT0644 url: https://semgrep.dev/playground/r/vdT0644/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine origin: community - id: csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override mode: taint pattern-sources: - patterns: - focus-metavariable: $ARG - pattern-inside: | public $T $M(...,string $ARG,...){...} pattern-sinks: - patterns: - pattern: | $XMLDOCUMENT.$METHOD(...) - pattern-inside: "XmlDocument $XMLDOCUMENT = new XmlDocument(...);\n...\n$XMLDOCUMENT.XmlResolver = new XmlUrlResolver(...);\n... \n" message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data. languages: - csharp severity: WARNING metadata: category: security references: - https://www.jardinesoftware.net/2016/05/26/xxe-and-net/ - https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks technology: - .net - xml cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration cwe2022-top25: true cwe2021-top25: true subcategory: - vuln impact: MEDIUM likelihood: LOW confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override shortlink: https://sg.run/k98P semgrep.dev: rule: r_id: 18228 rv_id: 1262654 rule_id: ReUK9k version_id: K3TKk5E url: https://semgrep.dev/playground/r/K3TKk5E/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override origin: community - id: csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override mode: taint pattern-sources: - patterns: - focus-metavariable: $ARG - pattern-inside: | public $T $M(...,string $ARG,...){...} pattern-sinks: - patterns: - pattern: | XmlReader $READER = XmlReader.Create(...,$RS,...); - pattern-inside: "XmlReaderSettings $RS = new XmlReaderSettings();\n...\n$RS.DtdProcessing = DtdProcessing.Parse;\n... \n" message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data. languages: - csharp severity: WARNING metadata: category: security references: - https://www.jardinesoftware.net/2016/05/26/xxe-and-net/ - https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks technology: - .net - xml cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration cwe2022-top25: true cwe2021-top25: true subcategory: - vuln impact: MEDIUM likelihood: LOW confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override shortlink: https://sg.run/wXjA semgrep.dev: rule: r_id: 18229 rv_id: 1262655 rule_id: AbU3pX version_id: qkTR7WD url: https://semgrep.dev/playground/r/qkTR7WD/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override origin: community - id: csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults mode: taint pattern-sources: - patterns: - focus-metavariable: $ARG - pattern-inside: | public $T $M(...,string $ARG,...){...} pattern-sinks: - patterns: - pattern: | $READER.$METHOD(...) - pattern-not-inside: | $READER.DtdProcessing = DtdProcessing.Prohibit; ... - pattern-inside: | XmlTextReader $READER = new XmlTextReader(...); ... message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data. languages: - csharp severity: WARNING metadata: category: security references: - https://www.jardinesoftware.net/2016/05/26/xxe-and-net/ - https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks technology: - .net - xml cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration cwe2022-top25: true cwe2021-top25: true subcategory: - vuln impact: MEDIUM likelihood: LOW confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults shortlink: https://sg.run/xXjL semgrep.dev: rule: r_id: 18230 rv_id: 1262656 rule_id: BYUevk version_id: l4TJRWG url: https://semgrep.dev/playground/r/l4TJRWG/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults origin: community - id: go.aws-lambda.security.database-sqli.database-sqli languages: - go message: Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls. mode: taint metadata: references: - https://pkg.go.dev/database/sql#DB.Query category: security owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' technology: - aws-lambda - database - sql cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/go.aws-lambda.security.database-sqli.database-sqli shortlink: https://sg.run/e5e8 semgrep.dev: rule: r_id: 18232 rv_id: 1262909 rule_id: WAUdJ7 version_id: BjTkZkQ url: https://semgrep.dev/playground/r/BjTkZkQ/go.aws-lambda.security.database-sqli.database-sqli origin: community pattern-sinks: - patterns: - focus-metavariable: $QUERY - pattern-either: - pattern: $DB.Exec($QUERY,...) - pattern: $DB.ExecContent($QUERY,...) - pattern: $DB.Query($QUERY,...) - pattern: $DB.QueryContext($QUERY,...) - pattern: $DB.QueryRow($QUERY,...) - pattern: $DB.QueryRowContext($QUERY,...) - pattern-inside: | import "database/sql" ... pattern-sources: - patterns: - pattern-either: - pattern-inside: | func $HANDLER($CTX $CTXTYPE, $EVENT $TYPE, ...) {...} ... lambda.Start($HANDLER, ...) - patterns: - pattern-inside: | func $HANDLER($EVENT $TYPE) {...} ... lambda.Start($HANDLER, ...) - pattern-not-inside: | func $HANDLER($EVENT context.Context) {...} ... lambda.Start($HANDLER, ...) - focus-metavariable: $EVENT severity: WARNING - id: go.aws-lambda.security.tainted-sql-string.tainted-sql-string languages: - go severity: ERROR message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries. metadata: references: - https://owasp.org/www-community/attacks/SQL_Injection category: security owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' technology: - aws-lambda cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/go.aws-lambda.security.tainted-sql-string.tainted-sql-string shortlink: https://sg.run/vX3Y semgrep.dev: rule: r_id: 18233 rv_id: 1262910 rule_id: 0oUwqg version_id: DkTRbRL url: https://semgrep.dev/playground/r/DkTRbRL/go.aws-lambda.security.tainted-sql-string.tainted-sql-string origin: community mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: | func $HANDLER($CTX $CTXTYPE, $EVENT $TYPE, ...) {...} ... lambda.Start($HANDLER, ...) - patterns: - pattern-inside: | func $HANDLER($EVENT $TYPE) {...} ... lambda.Start($HANDLER, ...) - pattern-not-inside: | func $HANDLER($EVENT context.Context) {...} ... lambda.Start($HANDLER, ...) - focus-metavariable: $EVENT pattern-sinks: - patterns: - pattern-either: - patterns: - pattern: | "$SQLSTR" + ... - metavariable-regex: metavariable: $SQLSTR regex: (?i)(\s*select|\s*delete|\s*insert|\s*create|\s*update|\s*alter|\s*drop).* - patterns: - pattern-either: - pattern: fmt.Fprintf($F, "$SQLSTR", ...) - pattern: fmt.Sprintf("$SQLSTR", ...) - pattern: fmt.Printf("$SQLSTR", ...) - metavariable-regex: metavariable: $SQLSTR regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).* - pattern-not-inside: | log.$PRINT(...) pattern-sanitizers: - pattern: strconv.Atoi(...) - id: go.lang.security.filepath-clean-misuse.filepath-clean-misuse message: '`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean("/"+strings.Trim(req.URL.Path, "/")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme.' severity: ERROR languages: - go mode: taint pattern-sources: - patterns: - pattern-either: - pattern: | ($REQUEST : *http.Request).$ANYTHING - pattern: | ($REQUEST : http.Request).$ANYTHING - metavariable-regex: metavariable: $ANYTHING regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ pattern-sinks: - patterns: - pattern-either: - pattern: filepath.Clean($...INNER) - pattern: path.Clean($...INNER) pattern-sanitizers: - pattern-either: - pattern: | "/" + ... fix: filepath.FromSlash(filepath.Clean("/"+strings.Trim($...INNER, "/"))) options: interfile: true metadata: references: - https://pkg.go.dev/path#Clean - http://technosophos.com/2016/03/31/go-quickly-cleaning-filepaths.html - https://labs.detectify.com/2021/12/15/zero-day-path-traversal-grafana/ - https://dzx.cz/2021/04/02/go_path_traversal/ - https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme cwe: - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control category: security technology: - go cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Path Traversal source: https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse shortlink: https://sg.run/ZKzw semgrep.dev: rule: r_id: 18235 rv_id: 1262967 rule_id: qNUQJe version_id: jQTn5Bj url: https://semgrep.dev/playground/r/jQTn5Bj/go.lang.security.filepath-clean-misuse.filepath-clean-misuse origin: community - id: java.aws-lambda.security.tainted-sql-string.tainted-sql-string languages: - java severity: ERROR message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries. options: interfile: true metadata: references: - https://owasp.org/www-community/attacks/SQL_Injection category: security owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' technology: - aws-lambda cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/java.aws-lambda.security.tainted-sql-string.tainted-sql-string shortlink: https://sg.run/EBYN semgrep.dev: rule: r_id: 18237 rv_id: 1262977 rule_id: YGUl4z version_id: O9TpxQN url: https://semgrep.dev/playground/r/O9TpxQN/java.aws-lambda.security.tainted-sql-string.tainted-sql-string origin: community mode: taint pattern-sources: - patterns: - focus-metavariable: $EVENT - pattern-either: - pattern: | $HANDLERTYPE $HANDLER($TYPE $EVENT, com.amazonaws.services.lambda.runtime.Context $CONTEXT) { ... } - pattern: | $HANDLERTYPE $HANDLER(InputStream $EVENT, OutputStream $OUT, com.amazonaws.services.lambda.runtime.Context $CONTEXT) { ... } pattern-sinks: - patterns: - pattern-either: - pattern: | "$SQLSTR" + ... - pattern: | "$SQLSTR".concat(...) - patterns: - pattern-inside: | StringBuilder $SB = new StringBuilder("$SQLSTR"); ... - pattern: $SB.append(...) - patterns: - pattern-inside: | $VAR = "$SQLSTR"; ... - pattern: $VAR += ... - pattern: String.format("$SQLSTR", ...) - metavariable-regex: metavariable: $SQLSTR regex: (?i)(select|delete|insert|create|update|alter|drop)\b - pattern-not-inside: | System.out.$PRINTLN(...) - id: java.aws-lambda.security.tainted-sqli.tainted-sqli message: Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead. languages: - java severity: WARNING mode: taint pattern-sources: - patterns: - focus-metavariable: $EVENT - pattern-either: - pattern: | $HANDLERTYPE $HANDLER($TYPE $EVENT, com.amazonaws.services.lambda.runtime.Context $CONTEXT) { ... } - pattern: | $HANDLERTYPE $HANDLER(InputStream $EVENT, OutputStream $OUT, com.amazonaws.services.lambda.runtime.Context $CONTEXT) { ... } pattern-sinks: - patterns: - pattern-either: - pattern: "(java.sql.CallableStatement $STMT) = ...; \n" - pattern: | (java.sql.Statement $STMT) = ...; - pattern: | (java.sql.PreparedStatement $STMT) = ...; - pattern: | $VAR = $CONN.prepareStatement(...) - pattern: | $PATH.queryForObject(...); - pattern: | (java.util.Map $STMT) = $PATH.queryForMap(...); - pattern: | (org.springframework.jdbc.support.rowset.SqlRowSet $STMT) = ...; - patterns: - pattern-inside: | (String $SQL) = "$SQLSTR" + ...; ... - pattern: $PATH.$SQLCMD(..., $SQL, ...); - metavariable-regex: metavariable: $SQLSTR regex: (?i)(^SELECT.* | ^INSERT.* | ^UPDATE.*) - metavariable-regex: metavariable: $SQLCMD regex: (execute|query|executeUpdate|batchUpdate) options: interfile: true metadata: category: security technology: - sql - java - aws-lambda cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/java.aws-lambda.security.tainted-sqli.tainted-sqli shortlink: https://sg.run/7942 semgrep.dev: rule: r_id: 18238 rv_id: 1262978 rule_id: 6JUDWk version_id: e1Tyj4g url: https://semgrep.dev/playground/r/e1Tyj4g/java.aws-lambda.security.tainted-sqli.tainted-sqli origin: community - id: java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request message: Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead. severity: WARNING metadata: likelihood: HIGH impact: MEDIUM confidence: HIGH category: security cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' cwe2021-top25: true cwe2022-top25: true owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html - https://owasp.org/www-community/attacks/SQL_Injection subcategory: - vuln technology: - sql - java - servlets - spring license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request shortlink: https://sg.run/Lg56 semgrep.dev: rule: r_id: 18239 rv_id: 1409390 rule_id: oqUBJG version_id: 7ZTKJNj url: https://semgrep.dev/playground/r/7ZTKJNj/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request origin: community languages: - java mode: taint options: taint_assume_safe_numbers: true taint_assume_safe_booleans: true pattern-sources: - patterns: - pattern-either: - pattern: | (HttpServletRequest $REQ).$REQFUNC(...) - pattern: "(ServletRequest $REQ).$REQFUNC(...) \n" - metavariable-regex: metavariable: $REQFUNC regex: (getInputStream|getParameter|getParameterMap|getParameterValues|getReader|getCookies|getHeader|getHeaderNames|getHeaders|getPart|getParts|getQueryString) pattern-sinks: - patterns: - pattern-either: - pattern: "(java.sql.CallableStatement $STMT) = ...; \n" - pattern: | (java.sql.Statement $STMT) = ...; ... $OUTPUT = $STMT.$FUNC(...); - pattern: | (java.sql.PreparedStatement $STMT) = ...; - pattern: | $VAR = $CONN.prepareStatement(...) - pattern: | $PATH.queryForObject(...); - pattern: | (java.util.Map $STMT) = $PATH.queryForMap(...); - pattern: | (org.springframework.jdbc.support.rowset.SqlRowSet $STMT) = ...; - pattern: | (org.springframework.jdbc.core.JdbcTemplate $TEMPL).batchUpdate(...) - patterns: - pattern-inside: | (String $SQL) = "$SQLSTR" + ...; ... - pattern: $PATH.$SQLCMD(..., $SQL, ...); - metavariable-regex: metavariable: $SQLSTR regex: (?i)(^SELECT.* | ^INSERT.* | ^UPDATE.*) - metavariable-regex: metavariable: $SQLCMD regex: (execute|query|executeUpdate|batchUpdate) - id: java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request message: Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands with user-supplied input, or, if you must use these commands, use a whitelist of specific values. languages: - java severity: ERROR mode: taint pattern-sources: - patterns: - pattern-either: - pattern: | (HttpServletRequest $REQ) - patterns: - pattern-inside: | (javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...); ... for (javax.servlet.http.Cookie $COOKIE: $COOKIES) { ... } - pattern: | $COOKIE.getValue(...) pattern-sinks: - patterns: - pattern-either: - pattern: | (ProcessBuilder $PB) = ...; - patterns: - pattern: | (Process $P) = ...; - pattern-not: | (Process $P) = (java.lang.Runtime $R).exec(...); - patterns: - pattern: (java.lang.Runtime $R).exec($CMD, ...); - focus-metavariable: $CMD - patterns: - pattern-either: - pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...; \n...\n(ProcessBuilder $PB) = ...;\n...\n$PB.command($ARGLIST);\n" - pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...; \n...\n(ProcessBuilder $PB) = ...;\n" - pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...; \n...\n(Process $P) = ...;\n" - pattern: | $ARGLIST.add(...); metadata: category: security technology: - java cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request shortlink: https://sg.run/8zPN semgrep.dev: rule: r_id: 18240 rv_id: 1263042 rule_id: zdUWrg version_id: LjTkg9J url: https://semgrep.dev/playground/r/LjTkg9J/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request origin: community - id: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false severity: ERROR metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://blog.sonarsource.com/secure-xml-processor - https://xerces.apache.org/xerces2-j/features.html category: security technology: - java - xml cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false shortlink: https://sg.run/4Dv5 semgrep.dev: rule: r_id: 18244 rv_id: 1263057 rule_id: j2UrJ8 version_id: 0bTKzgX url: https://semgrep.dev/playground/r/0bTKzgX/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false origin: community message: DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature "http://apache.org/xml/features/disallow-doctype-decl" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features "http://xml.org/sax/features/external-general-entities" and "http://xml.org/sax/features/external-parameter-entities" to false. patterns: - pattern: $DBFACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", false); - pattern-not-inside: | $RETURNTYPE $METHOD(...){ ... $DBF.setFeature("http://xml.org/sax/features/external-general-entities", false); ... $DBF.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... } - pattern-not-inside: | $RETURNTYPE $METHOD(...){ ... $DBF.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... $DBF.setFeature("http://xml.org/sax/features/external-general-entities", false); ... } - pattern-not-inside: | $RETURNTYPE $METHOD(...){ ... $DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); ... $DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, ""); ... } - pattern-not-inside: | $RETURNTYPE $METHOD(...){ ... $DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, ""); ... $DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); ... } languages: - java - id: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing severity: ERROR metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://blog.sonarsource.com/secure-xml-processor - https://xerces.apache.org/xerces2-j/features.html category: security technology: - java - xml cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing shortlink: https://sg.run/PYBz semgrep.dev: rule: r_id: 18245 rv_id: 1263058 rule_id: 10UPQB version_id: K3TKk80 url: https://semgrep.dev/playground/r/K3TKk80/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing origin: community message: DOCTYPE declarations are enabled for this DocumentBuilderFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature "http://apache.org/xml/features/disallow-doctype-decl" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features "http://xml.org/sax/features/external-general-entities" and "http://xml.org/sax/features/external-parameter-entities" to false. mode: taint pattern-sources: - by-side-effect: true patterns: - pattern-either: - pattern: | $FACTORY = DocumentBuilderFactory.newInstance(); - patterns: - pattern: $FACTORY - pattern-inside: | class $C { ... $V $FACTORY = DocumentBuilderFactory.newInstance(); ... } - pattern-not-inside: | class $C { ... $V $FACTORY = DocumentBuilderFactory.newInstance(); static { ... $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); ... } ... } - pattern-not-inside: | class $C { ... $V $FACTORY = DocumentBuilderFactory.newInstance(); static { ... $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); ... } ... } - pattern-not-inside: | class $C { ... $V $FACTORY = DocumentBuilderFactory.newInstance(); static { ... $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... } ... } pattern-sinks: - patterns: - pattern: $FACTORY.newDocumentBuilder(); pattern-sanitizers: - by-side-effect: true pattern-either: - patterns: - pattern-either: - pattern: | $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); - pattern: | $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); - pattern: | $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); - focus-metavariable: $FACTORY - patterns: - pattern-either: - pattern-inside: | class $C { ... $T $M(...) { ... $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); ... } ... } - pattern-inside: | class $C { ... $T $M(...) { ... $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... } ... } - pattern-inside: | class $C { ... $T $M(...) { ... $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities",false); ... } ... } - pattern: $M($X) - focus-metavariable: $X fix: | $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); $FACTORY.newDocumentBuilder(); languages: - java - id: java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true severity: ERROR metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://blog.sonarsource.com/secure-xml-processor category: security technology: - java - xml cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true shortlink: https://sg.run/JgPy semgrep.dev: rule: r_id: 18246 rv_id: 1263059 rule_id: 9AUJ6r version_id: qkTR7Lk url: https://semgrep.dev/playground/r/qkTR7Lk/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true origin: community message: External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature "http://xml.org/sax/features/external-general-entities" to false. pattern: $DBFACTORY.setFeature("http://xml.org/sax/features/external-general-entities", true); fix: $DBFACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); languages: - java - id: java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true severity: ERROR metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://blog.sonarsource.com/secure-xml-processor category: security technology: - java - xml cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true shortlink: https://sg.run/5Lv0 semgrep.dev: rule: r_id: 18247 rv_id: 1263060 rule_id: yyUNeo version_id: l4TJRoL url: https://semgrep.dev/playground/r/l4TJRoL/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true origin: community message: External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature "http://xml.org/sax/features/external-parameter-entities" to false. pattern: $DBFACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", true); fix: $DBFACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); languages: - java - id: javascript.aws-lambda.security.detect-child-process.detect-child-process message: Allowing spawning arbitrary programs or running shell processes with arbitrary arguments may end up in a command injection vulnerability. Try to avoid non-literal values for the command string. If it is not possible, then do not let running arbitrary commands, use a white list for inputs. metadata: cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection category: security technology: - javascript - aws-lambda cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/javascript.aws-lambda.security.detect-child-process.detect-child-process shortlink: https://sg.run/Ggoq semgrep.dev: rule: r_id: 18248 rv_id: 1263105 rule_id: r6UDNQ version_id: YDTZe4o url: https://semgrep.dev/playground/r/YDTZe4o/javascript.aws-lambda.security.detect-child-process.detect-child-process origin: community languages: - javascript - typescript severity: ERROR mode: taint pattern-sources: - patterns: - pattern: $EVENT - pattern-either: - pattern-inside: | exports.handler = function ($EVENT, ...) { ... } - pattern-inside: | function $FUNC ($EVENT, ...) {...} ... exports.handler = $FUNC - pattern-inside: | $FUNC = function ($EVENT, ...) {...} ... exports.handler = $FUNC pattern-sinks: - patterns: - focus-metavariable: $CMD - pattern-either: - pattern: exec($CMD,...) - pattern: execSync($CMD,...) - pattern: spawn($CMD,...) - pattern: spawnSync($CMD,...) - pattern: $CP.exec($CMD,...) - pattern: $CP.execSync($CMD,...) - pattern: $CP.spawn($CMD,...) - pattern: $CP.spawnSync($CMD,...) - pattern-either: - pattern-inside: | require('child_process') ... - pattern-inside: | import 'child_process' ... - id: javascript.aws-lambda.security.knex-sqli.knex-sqli message: 'Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `knex.raw(''SELECT $1 from table'', [userinput])`' metadata: references: - https://knexjs.org/#Builder-fromRaw - https://knexjs.org/#Builder-whereRaw category: security owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' technology: - aws-lambda - knex cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/javascript.aws-lambda.security.knex-sqli.knex-sqli shortlink: https://sg.run/RgWq semgrep.dev: rule: r_id: 18249 rv_id: 1263106 rule_id: bwUBlj version_id: JdTzxKg url: https://semgrep.dev/playground/r/JdTzxKg/javascript.aws-lambda.security.knex-sqli.knex-sqli origin: community languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: | exports.handler = function ($EVENT, ...) { ... } - pattern-inside: | function $FUNC ($EVENT, ...) {...} ... exports.handler = $FUNC - pattern-inside: | $FUNC = function ($EVENT, ...) {...} ... exports.handler = $FUNC - pattern: $EVENT pattern-sinks: - patterns: - focus-metavariable: $QUERY - pattern-either: - pattern: $KNEX.fromRaw($QUERY, ...) - pattern: $KNEX.whereRaw($QUERY, ...) - pattern: $KNEX.raw($QUERY, ...) - pattern-either: - pattern-inside: | require('knex') ... - pattern-inside: | import 'knex' ... - id: javascript.aws-lambda.security.mysql-sqli.mysql-sqli message: 'Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query(''SELECT $1 from table'', [userinput])`' metadata: references: - https://www.npmjs.com/package/mysql2 category: security owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' technology: - aws-lambda - mysql - mysql2 cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/javascript.aws-lambda.security.mysql-sqli.mysql-sqli shortlink: https://sg.run/A502 semgrep.dev: rule: r_id: 18250 rv_id: 1263107 rule_id: NbUBJ2 version_id: 5PTo1En url: https://semgrep.dev/playground/r/5PTo1En/javascript.aws-lambda.security.mysql-sqli.mysql-sqli origin: community languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: | exports.handler = function ($EVENT, ...) { ... } - pattern-inside: | function $FUNC ($EVENT, ...) {...} ... exports.handler = $FUNC - pattern-inside: | $FUNC = function ($EVENT, ...) {...} ... exports.handler = $FUNC - pattern: $EVENT pattern-sinks: - patterns: - focus-metavariable: $QUERY - pattern-either: - pattern: $POOL.query($QUERY, ...) - pattern: $POOL.execute($QUERY, ...) - pattern-either: - pattern-inside: | require('mysql') ... - pattern-inside: | require('mysql2') ... - pattern-inside: | require('mysql2/promise') ... - pattern-inside: | import 'mysql' ... - pattern-inside: | import 'mysql2' ... - pattern-inside: | import 'mysql2/promise' ... - id: javascript.aws-lambda.security.pg-sqli.pg-sqli message: 'Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query(''SELECT $1 from table'', [userinput])`' metadata: references: - https://node-postgres.com/features/queries category: security owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' technology: - aws-lambda - postgres - pg cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/javascript.aws-lambda.security.pg-sqli.pg-sqli shortlink: https://sg.run/BGKA semgrep.dev: rule: r_id: 18251 rv_id: 1263108 rule_id: kxU25P version_id: GxTkeJL url: https://semgrep.dev/playground/r/GxTkeJL/javascript.aws-lambda.security.pg-sqli.pg-sqli origin: community languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: | exports.handler = function ($EVENT, ...) { ... } - pattern-inside: | function $FUNC ($EVENT, ...) {...} ... exports.handler = $FUNC - pattern-inside: | $FUNC = function ($EVENT, ...) {...} ... exports.handler = $FUNC - pattern: $EVENT pattern-sinks: - patterns: - focus-metavariable: $QUERY - pattern-either: - pattern: $DB.query($QUERY, ...) - pattern-either: - pattern-inside: | require('pg') ... - pattern-inside: | import 'pg' ... - id: javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli message: 'Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `sequelize.query(''SELECT * FROM projects WHERE status = ?'', { replacements: [''active''], type: QueryTypes.SELECT });`' metadata: references: - https://sequelize.org/master/manual/raw-queries.html category: security owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' technology: - aws-lambda - sequelize cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli shortlink: https://sg.run/DAlP semgrep.dev: rule: r_id: 18252 rv_id: 1263109 rule_id: wdUA5o version_id: RGT0LrD url: https://semgrep.dev/playground/r/RGT0LrD/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli origin: community languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: | exports.handler = function ($EVENT, ...) { ... } - pattern-inside: | function $FUNC ($EVENT, ...) {...} ... exports.handler = $FUNC - pattern-inside: | $FUNC = function ($EVENT, ...) {...} ... exports.handler = $FUNC - pattern: $EVENT pattern-sinks: - patterns: - focus-metavariable: $QUERY - pattern-either: - pattern: $DB.query($QUERY, ...) - pattern-either: - pattern-inside: | require('sequelize') ... - pattern-inside: | import 'sequelize' ... - id: javascript.aws-lambda.security.tainted-html-response.tainted-html-response message: Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection category: security technology: - aws-lambda cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-response.tainted-html-response shortlink: https://sg.run/0Gvj semgrep.dev: rule: r_id: 18254 rv_id: 1263111 rule_id: OrUJBY version_id: BjTkZ8D url: https://semgrep.dev/playground/r/BjTkZ8D/javascript.aws-lambda.security.tainted-html-response.tainted-html-response origin: community languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: | exports.handler = function ($EVENT, ...) { ... } - pattern-inside: | function $FUNC ($EVENT, ...) {...} ... exports.handler = $FUNC - pattern-inside: | $FUNC = function ($EVENT, ...) {...} ... exports.handler = $FUNC - pattern: $EVENT pattern-sinks: - patterns: - focus-metavariable: $BODY - pattern-inside: | {..., headers: {..., 'Content-Type': 'text/html', ...}, body: $BODY, ... } - id: javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection message: The `vm` module enables compiling and running code within V8 Virtual Machine contexts. The `vm` module is not a security mechanism. Do not use it to run untrusted code. If code passed to `vm` functions is controlled by user input it could result in command injection. Do not let user input in `vm` functions. metadata: owasp: - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' category: security technology: - javascript - aws-lambda cwe2022-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection shortlink: https://sg.run/q9w7 semgrep.dev: rule: r_id: 18256 rv_id: 1263114 rule_id: v8UOdZ version_id: 0bTKz9J url: https://semgrep.dev/playground/r/0bTKz9J/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection origin: community languages: - javascript - typescript severity: ERROR mode: taint pattern-sources: - patterns: - pattern: $EVENT - pattern-either: - pattern-inside: | exports.handler = function ($EVENT, ...) { ... } - pattern-inside: | function $FUNC ($EVENT, ...) {...} ... exports.handler = $FUNC - pattern-inside: | $FUNC = function ($EVENT, ...) {...} ... exports.handler = $FUNC pattern-sinks: - patterns: - pattern-either: - pattern-inside: | require('vm'); ... - pattern-inside: | import 'vm' ... - pattern-either: - pattern: $VM.runInContext($X,...) - pattern: $VM.runInNewContext($X,...) - pattern: $VM.runInThisContext($X,...) - pattern: $VM.compileFunction($X,...) - pattern: new $VM.Script($X,...) - pattern: new $VM.SourceTextModule($X,...) - pattern: runInContext($X,...) - pattern: runInNewContext($X,...) - pattern: runInThisContext($X,...) - pattern: compileFunction($X,...) - pattern: new Script($X,...) - pattern: new SourceTextModule($X,...) - id: javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli message: 'Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. An example of parameterized queries like so: `knex.raw(''SELECT $1 from table'', [userinput])` can help prevent SQLi.' metadata: confidence: MEDIUM references: - https://knexjs.org/#Builder-fromRaw - https://knexjs.org/#Builder-whereRaw - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html category: security owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' technology: - express - nodejs - knex cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli shortlink: https://sg.run/l9eE semgrep.dev: rule: r_id: 18257 rv_id: 1263205 rule_id: d8UKLD version_id: l4TJRey url: https://semgrep.dev/playground/r/l4TJRey/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli origin: community languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: function ... ($REQ, $RES) {...} - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - patterns: - pattern-either: - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|head|delete|options) - pattern-either: - pattern: $REQ.query - pattern: $REQ.body - pattern: $REQ.params - pattern: $REQ.cookies - pattern: $REQ.headers - pattern: $REQ.files.$ANYTHING.data.toString('utf8') - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') - patterns: - pattern-either: - pattern-inside: | ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...} - pattern-inside: | ({ $REQ }: Request,$RES: Response) => {...} - focus-metavariable: $REQ - pattern-either: - pattern: params - pattern: query - pattern: cookies - pattern: headers - pattern: body - pattern: files.$ANYTHING.data.toString('utf8') - pattern: files.$ANYTHING['data'].toString('utf8') pattern-sinks: - patterns: - focus-metavariable: $QUERY - pattern-either: - pattern-inside: $KNEX.fromRaw($QUERY, ...) - pattern-inside: $KNEX.whereRaw($QUERY, ...) - pattern-inside: $KNEX.raw($QUERY, ...) - pattern-either: - pattern-inside: | require('knex') ... - pattern-inside: | import 'knex' ... pattern-sanitizers: - patterns: - pattern: parseInt(...) - id: php.lang.security.deserialization.extract-user-data mode: taint pattern-sources: - pattern-either: - pattern: $_GET[...] - pattern: $_FILES[...] - pattern: $_POST[...] pattern-sinks: - pattern: extract(...) pattern-sanitizers: - pattern: extract($VAR, EXTR_SKIP,...) message: Do not call 'extract()' on user-controllable data. If you must, then you must also provide the EXTR_SKIP flag to prevent overwriting existing variables. languages: - php metadata: category: security cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures technology: - php references: - https://www.php.net/manual/en/function.extract.php#refsect1-function.extract-notes cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/php.lang.security.deserialization.extract-user-data shortlink: https://sg.run/6bv1 semgrep.dev: rule: r_id: 18259 rv_id: 1263278 rule_id: nJUykq version_id: w8TRovw url: https://semgrep.dev/playground/r/w8TRovw/php.lang.security.deserialization.extract-user-data origin: community severity: ERROR - id: python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec mode: taint pattern-sources: - patterns: - pattern: event - pattern-inside: | def $HANDLER(event, context): ... pattern-sinks: - patterns: - focus-metavariable: $CMD - pattern-either: - pattern: asyncio.create_subprocess_exec($PROG, $CMD, ...) - pattern: asyncio.create_subprocess_exec($PROG, [$CMD, ...], ...) - pattern: asyncio.subprocess.create_subprocess_exec($PROG, $CMD, ...) - pattern: asyncio.subprocess.create_subprocess_exec($PROG, [$CMD, ...], ...) - pattern: asyncio.create_subprocess_exec($PROG, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...) - pattern: asyncio.create_subprocess_exec($PROG, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...], ...) - pattern: asyncio.subprocess.create_subprocess_exec($PROG, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...) - pattern: asyncio.subprocess.create_subprocess_exec($PROG, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...], ...) message: Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. metadata: owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.8 OS Command Injection control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements version: '4' references: - https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec - https://docs.python.org/3/library/shlex.html category: security technology: - python cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec shortlink: https://sg.run/oyv0 semgrep.dev: rule: r_id: 18260 rv_id: 1263331 rule_id: EwUrX8 version_id: rxTAKgo url: https://semgrep.dev/playground/r/rxTAKgo/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec origin: community languages: - python severity: ERROR - id: python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec mode: taint pattern-sources: - patterns: - pattern: event - pattern-inside: | def $HANDLER(event, context): ... pattern-sinks: - patterns: - focus-metavariable: $CMD - pattern-either: - pattern: $LOOP.subprocess_exec($PROTOCOL, $CMD, ...) - pattern: $LOOP.subprocess_exec($PROTOCOL, [$CMD, ...], ...) - pattern: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...) - pattern: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $CMD, ...], ...) message: Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. metadata: owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.8 OS Command Injection control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements version: '4' references: - https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec - https://docs.python.org/3/library/shlex.html category: security technology: - python - aws-lambda cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec shortlink: https://sg.run/z14d semgrep.dev: rule: r_id: 18261 rv_id: 1263332 rule_id: 7KUxXg version_id: bZT53Ww url: https://semgrep.dev/playground/r/bZT53Ww/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec origin: community languages: - python severity: ERROR - id: python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell mode: taint pattern-sources: - patterns: - pattern: event - pattern-inside: | def $HANDLER(event, context): ... pattern-sinks: - patterns: - focus-metavariable: $CMD - pattern-either: - pattern: $LOOP.subprocess_shell($PROTOCOL, $CMD) - pattern: asyncio.subprocess.create_subprocess_shell($CMD, ...) - pattern: asyncio.create_subprocess_shell($CMD, ...) message: Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. metadata: owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.8 OS Command Injection control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements version: '4' references: - https://docs.python.org/3/library/asyncio-subprocess.html - https://docs.python.org/3/library/shlex.html category: security technology: - python - aws-lambda cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell shortlink: https://sg.run/p9vZ semgrep.dev: rule: r_id: 18262 rv_id: 1263333 rule_id: L1UEl7 version_id: NdTzyWA url: https://semgrep.dev/playground/r/NdTzyWA/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell origin: community languages: - python severity: ERROR - id: python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process mode: taint message: Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. metadata: source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.8 OS Command Injection control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements version: '4' category: security technology: - python - aws-lambda references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process shortlink: https://sg.run/2AjL semgrep.dev: rule: r_id: 18263 rv_id: 1263334 rule_id: 8GUGBq version_id: kbTzGv8 url: https://semgrep.dev/playground/r/kbTzGv8/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process origin: community languages: - python severity: ERROR pattern-sources: - patterns: - pattern: event - pattern-inside: | def $HANDLER(event, context): ... pattern-sinks: - patterns: - focus-metavariable: $CMD - pattern-either: - patterns: - pattern: os.$METHOD($MODE, $CMD, ...) - metavariable-regex: metavariable: $METHOD regex: (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile) - patterns: - pattern-inside: os.$METHOD($MODE, $BASH, ["-c", $CMD,...],...) - metavariable-regex: metavariable: $METHOD regex: (spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp) - metavariable-regex: metavariable: $BASH regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) - patterns: - pattern-inside: os.$METHOD($MODE, $BASH, "-c", $CMD,...) - metavariable-regex: metavariable: $METHOD regex: (spawnl|spawnle|spawnlp|spawnlpe) - metavariable-regex: metavariable: $BASH regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) - id: python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use mode: taint message: Detected subprocess function with argument tainted by an `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for this purpose. metadata: owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.8 OS Command Injection control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements version: '4' references: - https://docs.python.org/3/library/subprocess.html - https://docs.python.org/3/library/shlex.html category: security technology: - python - aws-lambda cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use shortlink: https://sg.run/XZ7B semgrep.dev: rule: r_id: 18264 rv_id: 1263335 rule_id: gxUyn1 version_id: w8TRogj url: https://semgrep.dev/playground/r/w8TRogj/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use origin: community languages: - python severity: ERROR pattern-sources: - patterns: - pattern: event - pattern-inside: | def $HANDLER(event, context): ... pattern-sinks: - patterns: - pattern: subprocess.$FUNC(..., shell=True, ...) pattern-sanitizers: - pattern: shlex.split(...) - pattern: pipes.quote(...) - pattern: shlex.quote(...) - id: python.aws-lambda.security.dangerous-system-call.dangerous-system-call mode: taint message: Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. metadata: source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.2.4 Dyanmic Code Execution Features control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements version: '4' category: security technology: - python references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-system-call.dangerous-system-call shortlink: https://sg.run/jDvN semgrep.dev: rule: r_id: 18265 rv_id: 1263336 rule_id: QrUkg6 version_id: xyTjzbG url: https://semgrep.dev/playground/r/xyTjzbG/python.aws-lambda.security.dangerous-system-call.dangerous-system-call origin: community languages: - python severity: ERROR pattern-sources: - patterns: - pattern: event - pattern-inside: | def $HANDLER(event, context): ... pattern-sinks: - patterns: - focus-metavariable: $CMD - pattern-either: - pattern: os.system($CMD,...) - pattern: os.popen($CMD,...) - pattern: os.popen2($CMD,...) - pattern: os.popen3($CMD,...) - pattern: os.popen4($CMD,...) - id: python.aws-lambda.security.mysql-sqli.mysql-sqli languages: - python message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = %s'', (''active''))`' mode: taint metadata: references: - https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html - https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-executemany.html category: security owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' technology: - aws-lambda - mysql cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/python.aws-lambda.security.mysql-sqli.mysql-sqli shortlink: https://sg.run/1RjG semgrep.dev: rule: r_id: 18266 rv_id: 1263337 rule_id: 3qU3eE version_id: O9TpxLJ url: https://semgrep.dev/playground/r/O9TpxLJ/python.aws-lambda.security.mysql-sqli.mysql-sqli origin: community pattern-sinks: - patterns: - focus-metavariable: $QUERY - pattern-either: - pattern: $CURSOR.execute($QUERY,...) - pattern: $CURSOR.executemany($QUERY,...) - pattern-either: - pattern-inside: | import mysql ... - pattern-inside: | import mysql.cursors ... pattern-sources: - patterns: - pattern: event - pattern-inside: | def $HANDLER(event, context): ... severity: WARNING - id: python.aws-lambda.security.psycopg-sqli.psycopg-sqli languages: - python message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = %s'', ''active'')`' mode: taint metadata: references: - https://www.psycopg.org/docs/cursor.html#cursor.execute - https://www.psycopg.org/docs/cursor.html#cursor.executemany - https://www.psycopg.org/docs/cursor.html#cursor.mogrify category: security owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' technology: - aws-lambda - psycopg - psycopg2 cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/python.aws-lambda.security.psycopg-sqli.psycopg-sqli shortlink: https://sg.run/9L8r semgrep.dev: rule: r_id: 18267 rv_id: 1263338 rule_id: 4bUQG1 version_id: e1TyjPZ url: https://semgrep.dev/playground/r/e1TyjPZ/python.aws-lambda.security.psycopg-sqli.psycopg-sqli origin: community pattern-sinks: - patterns: - focus-metavariable: $QUERY - pattern-either: - pattern: $CURSOR.execute($QUERY,...) - pattern: $CURSOR.executemany($QUERY,...) - pattern: $CURSOR.mogrify($QUERY,...) - pattern-inside: | import psycopg2 ... pattern-sources: - patterns: - pattern: event - pattern-inside: | def $HANDLER(event, context): ... severity: WARNING - id: python.aws-lambda.security.pymssql-sqli.pymssql-sqli languages: - python message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = %s'', ''active'')`' mode: taint metadata: references: - https://pypi.org/project/pymssql/ category: security owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' technology: - aws-lambda - pymssql cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/python.aws-lambda.security.pymssql-sqli.pymssql-sqli shortlink: https://sg.run/yXvP semgrep.dev: rule: r_id: 18268 rv_id: 1263339 rule_id: PeUxO0 version_id: vdT06bG url: https://semgrep.dev/playground/r/vdT06bG/python.aws-lambda.security.pymssql-sqli.pymssql-sqli origin: community pattern-sinks: - patterns: - focus-metavariable: $QUERY - pattern: $CURSOR.execute($QUERY,...) - pattern-inside: | import pymssql ... pattern-sources: - patterns: - pattern: event - pattern-inside: | def $HANDLER(event, context): ... severity: WARNING - id: python.aws-lambda.security.pymysql-sqli.pymysql-sqli languages: - python message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = %s'', (''active''))`' mode: taint metadata: references: - https://pypi.org/project/PyMySQL/#id4 category: security owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' technology: - aws-lambda - pymysql cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/python.aws-lambda.security.pymysql-sqli.pymysql-sqli shortlink: https://sg.run/reve semgrep.dev: rule: r_id: 18269 rv_id: 1263340 rule_id: JDUlel version_id: d6TyxNA url: https://semgrep.dev/playground/r/d6TyxNA/python.aws-lambda.security.pymysql-sqli.pymysql-sqli origin: community pattern-sinks: - patterns: - focus-metavariable: $QUERY - pattern: $CURSOR.execute($QUERY,...) - pattern-either: - pattern-inside: | import pymysql ... - pattern-inside: | import pymysql.cursors ... pattern-sources: - patterns: - pattern: event - pattern-inside: | def $HANDLER(event, context): ... severity: WARNING - id: python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli languages: - python message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute(''SELECT * FROM projects WHERE status = ?'', ''active'')`' mode: taint metadata: references: - https://docs.sqlalchemy.org/en/14/core/connections.html#sqlalchemy.engine.Connection.execute category: security owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' technology: - aws-lambda - sqlalchemy cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli shortlink: https://sg.run/b48W semgrep.dev: rule: r_id: 18270 rv_id: 1263341 rule_id: 5rUy3N version_id: ZRTKARp url: https://semgrep.dev/playground/r/ZRTKARp/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli origin: community pattern-sinks: - patterns: - focus-metavariable: $QUERY - pattern: $CURSOR.execute($QUERY,...) - pattern-inside: | import sqlalchemy ... pattern-sources: - patterns: - pattern: event - pattern-inside: | def $HANDLER(event, context): ... severity: WARNING - id: python.aws-lambda.security.tainted-html-response.tainted-html-response mode: taint pattern-sources: - patterns: - pattern: event - pattern-inside: | def $HANDLER(event, context): ... pattern-sinks: - patterns: - pattern: $BODY - pattern-inside: | {..., "headers": {..., "Content-Type": "text/html", ...}, "body": $BODY, ... } message: Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection category: security technology: - aws-lambda references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/python.aws-lambda.security.tainted-html-response.tainted-html-response shortlink: https://sg.run/k9vP semgrep.dev: rule: r_id: 18272 rv_id: 1263343 rule_id: ReUKrk version_id: ExTEx5o url: https://semgrep.dev/playground/r/ExTEx5o/python.aws-lambda.security.tainted-html-response.tainted-html-response origin: community languages: - python severity: WARNING - id: python.aws-lambda.security.tainted-sql-string.tainted-sql-string languages: - python message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries. metadata: references: - https://owasp.org/www-community/attacks/SQL_Injection category: security owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' technology: - aws-lambda cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string shortlink: https://sg.run/wXvA semgrep.dev: rule: r_id: 18273 rv_id: 1263346 rule_id: AbU3LX version_id: 8KT5ron url: https://semgrep.dev/playground/r/8KT5ron/python.aws-lambda.security.tainted-sql-string.tainted-sql-string origin: community mode: taint pattern-sinks: - patterns: - pattern-either: - pattern: | "$SQLSTR" + ... - pattern: | "$SQLSTR" % ... - pattern: | "$SQLSTR".format(...) - pattern: | f"$SQLSTR{...}..." - metavariable-regex: metavariable: $SQLSTR regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*= - pattern-not-inside: | print(...) pattern-sources: - patterns: - pattern: event - pattern-inside: | def $HANDLER(event, context): ... severity: ERROR - id: ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli languages: - ruby message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `Example.find_by_sql ["SELECT title FROM posts WHERE author = ? AND created > ?", author_id, start_date]`' mode: taint metadata: references: - https://guides.rubyonrails.org/active_record_querying.html#finding-by-sql category: security owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' technology: - aws-lambda - active-record cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli shortlink: https://sg.run/vXvY semgrep.dev: rule: r_id: 18277 rv_id: 1263581 rule_id: 0oUw9g version_id: w8TRor7 url: https://semgrep.dev/playground/r/w8TRor7/ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli origin: community pattern-sinks: - patterns: - pattern: $QUERY - pattern-either: - pattern: ActiveRecord::Base.connection.execute($QUERY,...) - pattern: $MODEL.find_by_sql($QUERY,...) - pattern: $MODEL.select_all($QUERY,...) - pattern-inside: | require 'active_record' ... pattern-sources: - patterns: - pattern: event - pattern-inside: | def $HANDLER(event, context) ... end severity: WARNING - id: ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli languages: - ruby message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use sanitize statements like so: `escaped = client.escape(user_input)`' mode: taint metadata: references: - https://github.com/brianmario/mysql2 category: security owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' technology: - aws-lambda - mysql2 cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli shortlink: https://sg.run/dJLE semgrep.dev: rule: r_id: 18278 rv_id: 1263582 rule_id: KxUrQ3 version_id: xyTjzOe url: https://semgrep.dev/playground/r/xyTjzOe/ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli origin: community pattern-sinks: - patterns: - pattern: $QUERY - pattern-either: - pattern: $CLIENT.query($QUERY,...) - pattern: $CLIENT.prepare($QUERY,...) - pattern-inside: | require 'mysql2' ... pattern-sanitizers: - pattern: $CLIENT.escape(...) pattern-sources: - patterns: - pattern: event - pattern-inside: | def $HANDLER(event, context) ... end severity: WARNING - id: ruby.aws-lambda.security.pg-sqli.pg-sqli languages: - ruby message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `conn.exec_params(''SELECT $1 AS a, $2 AS b, $3 AS c'', [1, 2, nil])`' mode: taint metadata: references: - https://www.rubydoc.info/gems/pg/PG/Connection category: security owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' technology: - aws-lambda - postgres - pg cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/ruby.aws-lambda.security.pg-sqli.pg-sqli shortlink: https://sg.run/ZKww semgrep.dev: rule: r_id: 18279 rv_id: 1263583 rule_id: qNUQee version_id: O9Tpxz7 url: https://semgrep.dev/playground/r/O9Tpxz7/ruby.aws-lambda.security.pg-sqli.pg-sqli origin: community pattern-sinks: - patterns: - pattern: $QUERY - pattern-either: - pattern: $CONN.exec($QUERY,...) - pattern: $CONN.exec_params($QUERY,...) - pattern: $CONN.exec_prepared($QUERY,...) - pattern: $CONN.async_exec($QUERY,...) - pattern: $CONN.async_exec_params($QUERY,...) - pattern: $CONN.async_exec_prepared($QUERY,...) - pattern-inside: | require 'pg' ... pattern-sources: - patterns: - pattern: event - pattern-inside: | def $HANDLER(event, context) ... end severity: WARNING - id: ruby.aws-lambda.security.sequel-sqli.sequel-sqli languages: - ruby message: 'Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `DB[''select * from items where name = ?'', name]`' mode: taint metadata: references: - https://github.com/jeremyevans/sequel#label-Arbitrary+SQL+queries category: security owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' technology: - aws-lambda - sequel cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/ruby.aws-lambda.security.sequel-sqli.sequel-sqli shortlink: https://sg.run/n9vY semgrep.dev: rule: r_id: 18280 rv_id: 1263584 rule_id: lBUy2N version_id: e1Tyj5j url: https://semgrep.dev/playground/r/e1Tyj5j/ruby.aws-lambda.security.sequel-sqli.sequel-sqli origin: community pattern-sinks: - patterns: - pattern: $QUERY - pattern-either: - pattern: DB[$QUERY,...] - pattern: DB.run($QUERY,...) - pattern-inside: | require 'sequel' ... pattern-sources: - patterns: - pattern: event - pattern-inside: | def $HANDLER(event, context) ... end severity: WARNING - id: ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string languages: - ruby severity: ERROR message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries. metadata: references: - https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet category: security owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' technology: - aws-lambda cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string shortlink: https://sg.run/EB7N semgrep.dev: rule: r_id: 18281 rv_id: 1263586 rule_id: PeUxOE version_id: d6Tyx1Z url: https://semgrep.dev/playground/r/d6Tyx1Z/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string origin: community mode: taint pattern-sources: - patterns: - pattern: event - pattern-inside: | def $HANDLER(event, context) ... end pattern-sinks: - patterns: - pattern-either: - patterns: - pattern: | "...#{...}..." - pattern-regex: (?i)(select|delete|insert|create|update|alter|drop)\b|\w+\s*!?[<>=].* - patterns: - pattern-either: - pattern: Kernel::sprintf("$SQLSTR", ...) - pattern: | "$SQLSTR" + $EXPR - pattern: | "$SQLSTR" % $EXPR - metavariable-regex: metavariable: $SQLSTR regex: (?i)(select|delete|insert|create|update|alter|drop)\b|\w+\s*!?[<>=].* - pattern-not-inside: | puts(...) - id: go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check patterns: - pattern-inside: | import ("github.com/gorilla/websocket") ... - patterns: - pattern-not-inside: | $UPGRADER = websocket.Upgrader{..., CheckOrigin: $FN ,...} ... - pattern-not-inside: | $UPGRADER.CheckOrigin = $FN2 ... - pattern: | $UPGRADER.Upgrade(...) message: 'The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per "gorilla/websocket" documentation: "A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery."' languages: - go severity: WARNING metadata: category: security cwe: - 'CWE-352: Cross-Site Request Forgery (CSRF)' owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://pkg.go.dev/github.com/gorilla/websocket#Upgrader technology: - gorilla confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site Request Forgery (CSRF) source: https://semgrep.dev/r/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check shortlink: https://sg.run/xXpz semgrep.dev: rule: r_id: 18430 rv_id: 1262914 rule_id: ReUKdz version_id: qkTR7RP url: https://semgrep.dev/playground/r/qkTR7RP/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check origin: community - id: javascript.aws-lambda.security.tainted-html-string.tainted-html-string message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection category: security technology: - aws-lambda cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-string.tainted-html-string shortlink: https://sg.run/Lgqr semgrep.dev: rule: r_id: 18483 rv_id: 1263112 rule_id: PeUxwW version_id: DkTRbvp url: https://semgrep.dev/playground/r/DkTRbvp/javascript.aws-lambda.security.tainted-html-string.tainted-html-string origin: community languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: | exports.handler = function ($EVENT, ...) { ... } - pattern-inside: | function $FUNC ($EVENT, ...) {...} ... exports.handler = $FUNC - pattern-inside: | $FUNC = function ($EVENT, ...) {...} ... exports.handler = $FUNC - pattern: $EVENT pattern-sinks: - patterns: - pattern-either: - patterns: - pattern-either: - pattern: | "$HTMLSTR" + $EXPR - pattern: | "$HTMLSTR".concat(...) - pattern: $UTIL.format($HTMLSTR, ...) - pattern: format($HTMLSTR, ...) - metavariable-pattern: metavariable: $HTMLSTR language: generic pattern: <$TAG ... - patterns: - pattern: | `...${...}...` - pattern-regex: | .*<\w+.* - pattern-not-inside: | console.$LOG(...) - id: python.aws-lambda.security.tainted-html-string.tainted-html-string languages: - python severity: WARNING message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection category: security technology: - aws-lambda references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/python.aws-lambda.security.tainted-html-string.tainted-html-string shortlink: https://sg.run/8zNy semgrep.dev: rule: r_id: 18484 rv_id: 1263344 rule_id: JDUlwy version_id: 7ZTE36K url: https://semgrep.dev/playground/r/7ZTE36K/python.aws-lambda.security.tainted-html-string.tainted-html-string origin: community mode: taint pattern-sources: - patterns: - pattern: event - pattern-inside: | def $HANDLER(event, context): ... pattern-sinks: - patterns: - pattern-either: - patterns: - pattern-either: - pattern: '"$HTMLSTR" % ...' - pattern: '"$HTMLSTR".format(...)' - pattern: '"$HTMLSTR" + ...' - pattern: f"$HTMLSTR{...}..." - patterns: - pattern-inside: | $HTML = "$HTMLSTR" ... - pattern-either: - pattern: $HTML % ... - pattern: $HTML.format(...) - pattern: $HTML + ... - metavariable-pattern: metavariable: $HTMLSTR language: generic pattern: <$TAG ... - pattern-not-inside: | print(...) - id: scala.lang.security.audit.io-source-ssrf.io-source-ssrf patterns: - pattern-either: - pattern: Source.fromURL($URL,...) - pattern: Source.fromURI($URL,...) - pattern-inside: | import scala.io.$SOURCE ... - pattern-either: - pattern-inside: | def $FUNC(..., $URL: $T, ...) = $A { ... } - pattern-inside: | def $FUNC(..., $URL: $T, ...) = { ... } message: A parameter being passed directly into `fromURL` most likely lead to SSRF. This could allow an attacker to send data to their own server, potentially exposing sensitive data sent with this request. They could also probe internal servers or other resources that the server running this code can access. Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host. metadata: cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html - https://www.scala-lang.org/api/current/scala/io/Source$.html#fromURL(url:java.net.URL)(implicitcodec:scala.io.Codec):scala.io.BufferedSource category: security technology: - scala confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Server-Side Request Forgery (SSRF) source: https://semgrep.dev/r/scala.lang.security.audit.io-source-ssrf.io-source-ssrf shortlink: https://sg.run/Qbz4 semgrep.dev: rule: r_id: 18486 rv_id: 1263675 rule_id: GdUDOZ version_id: 1QTypG9 url: https://semgrep.dev/playground/r/1QTypG9/scala.lang.security.audit.io-source-ssrf.io-source-ssrf origin: community languages: - scala severity: WARNING - id: scala.play.security.tainted-html-response.tainted-html-response mode: taint metadata: category: security cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection technology: - scala - play confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/scala.play.security.tainted-html-response.tainted-html-response shortlink: https://sg.run/BG96 semgrep.dev: rule: r_id: 18795 rv_id: 1263686 rule_id: 0oUwn2 version_id: vdT06yj url: https://semgrep.dev/playground/r/vdT06yj/scala.play.security.tainted-html-response.tainted-html-response origin: community message: Detected a request with potential user-input going into an `Ok()` response. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as Twirl which automatically escapes HTML views. pattern-sources: - patterns: - pattern-either: - patterns: - pattern: $REQ - pattern-either: - pattern-inside: "Action {\n $REQ: Request[$T] => \n ...\n}\n" - pattern-inside: "Action(...) {\n $REQ: Request[$T] => \n ...\n}\n" - pattern-inside: "Action.async {\n $REQ: Request[$T] => \n ...\n}\n" - pattern-inside: "Action.async(...) {\n $REQ: Request[$T] => \n ...\n}\n" - patterns: - pattern: $PARAM - pattern-either: - pattern-inside: | def $CTRL(..., $PARAM: $TYPE, ...) = Action { ... } - pattern-inside: | def $CTRL(..., $PARAM: $TYPE, ...) = Action(...) { ... } - pattern-inside: | def $CTRL(..., $PARAM: $TYPE, ...) = Action.async { ... } - pattern-inside: | def $CTRL(..., $PARAM: $TYPE, ...) = Action.async(...) { ... } pattern-sanitizers: - pattern-either: - pattern: org.apache.commons.lang3.StringEscapeUtils.escapeHtml4(...) - pattern: org.owasp.encoder.Encode.forHtml(...) pattern-sinks: - pattern-either: - pattern: Html.apply(...) - pattern: Ok(...).as(HTML) - pattern: Ok(...).as(ContentTypes.HTML) - patterns: - pattern: Ok(...).as($CTYPE) - metavariable-regex: metavariable: $CTYPE regex: '"[tT][eE][xX][tT]/[hH][tT][mM][lL]"' - patterns: - pattern: Ok(...).as($CTYPE) - pattern-not: Ok(...).as("...") - pattern-either: - pattern-inside: | def $FUNC(..., $URL: $T, ...) = $A { ... } - pattern-inside: | def $FUNC(..., $URL: $T, ...) = { ... } severity: WARNING languages: - scala - id: scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled patterns: - pattern-either: - pattern: | $DF = DocumentBuilderFactory.newInstance(...) ... $DB = $DF.newDocumentBuilder(...) - patterns: - pattern: $DB = DocumentBuilderFactory.newInstance(...) - pattern-not-inside: | ... $X = $DB.newDocumentBuilder(...) - pattern: $DB = DocumentBuilderFactory.newInstance(...).newDocumentBuilder(...) - pattern-not-inside: | ... $DB.setXIncludeAware(true) ... $DB.setNamespaceAware(true) ... $DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) ... $DB.setFeature("http://xml.org/sax/features/external-general-entities", false) ... $DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false) - pattern-not-inside: | ... $DB.setXIncludeAware(true) ... $DB.setNamespaceAware(true) ... $DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) ... $DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false) ... $DB.setFeature("http://xml.org/sax/features/external-general-entities", false) - pattern-not-inside: | ... $DB.setXIncludeAware(true) ... $DB.setNamespaceAware(true) ... $DB.setFeature("http://xml.org/sax/features/external-general-entities", false) ... $DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) ... $DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false) - pattern-not-inside: | ... $DB.setXIncludeAware(true) ... $DB.setNamespaceAware(true) ... $DB.setFeature("http://xml.org/sax/features/external-general-entities", false) ... $DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false) ... $DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) message: Document Builder being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality. languages: - scala severity: WARNING metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html category: security technology: - scala confidence: HIGH references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled shortlink: https://sg.run/gRQn semgrep.dev: rule: r_id: 19041 rv_id: 1263673 rule_id: 0oUwzP version_id: X0TzyRq url: https://semgrep.dev/playground/r/X0TzyRq/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled origin: community - id: scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled patterns: - pattern-either: - pattern: $SR = new SAXReader(...) - pattern: | $SF = SAXParserFactory.newInstance(...) ... $SR = $SF.newSAXParser(...) - patterns: - pattern: $SR = SAXParserFactory.newInstance(...) - pattern-not-inside: | ... $X = $SR.newSAXParser(...) - pattern: $SR = SAXParserFactory.newInstance(...).newSAXParser(...) - pattern: $SR = new SAXBuilder(...) - pattern-not-inside: | ... $SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) ... $SR.setFeature("http://xml.org/sax/features/external-general-entities", false) ... $SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false) - pattern-not-inside: | ... $SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) ... $SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false) ... $SR.setFeature("http://xml.org/sax/features/external-general-entities", false) - pattern-not-inside: | ... $SR.setFeature("http://xml.org/sax/features/external-general-entities", false) ... $SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) ... $SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false) - pattern-not-inside: | ... $SR.setFeature("http://xml.org/sax/features/external-general-entities", false) ... $SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false) ... $SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) message: XML processor being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Parsers can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality. languages: - scala severity: WARNING metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html category: security technology: - scala confidence: HIGH references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: MEDIUM impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled shortlink: https://sg.run/QbYP semgrep.dev: rule: r_id: 19042 rv_id: 1263678 rule_id: KxUrkq version_id: rxTAKWY url: https://semgrep.dev/playground/r/rxTAKWY/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled origin: community - id: scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled patterns: - pattern-not-inside: | ... $XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", false) - pattern-either: - pattern: $XMLFACTORY = XMLInputFactory.newFactory(...) - pattern: $XMLFACTORY = XMLInputFactory.newInstance(...) - pattern: $XMLFACTORY = new XMLInputFactory(...) message: XMLInputFactory being instantiated without calling the setProperty functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality. languages: - scala severity: WARNING metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html category: security technology: - scala confidence: HIGH references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled shortlink: https://sg.run/3BEb semgrep.dev: rule: r_id: 19043 rv_id: 1263683 rule_id: qNUQ7w version_id: xyTjzkA url: https://semgrep.dev/playground/r/xyTjzkA/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled origin: community - id: scala.play.security.conf-csrf-headers-bypass.conf-csrf-headers-bypass patterns: - pattern-either: - pattern: X-Requested-With = "*" - pattern: Csrf-Token = "..." - pattern-inside: | bypassHeaders {... ... ...} - pattern-not-inside: | {... ... ...blackList = [..."application/x-www-form-urlencoded"..."multipart/form-data"..."text/plain"...] ... ...} - pattern-not-inside: | {... ... ...blackList = [..."application/x-www-form-urlencoded"..."text/plain"..."multipart/form-data"...] ... ...} - pattern-not-inside: | {... ... ...blackList = [..."multipart/form-data"..."application/x-www-form-urlencoded"..."text/plain"...] ... ...} - pattern-not-inside: | {... ... ...blackList = [..."multipart/form-data"..."text/plain"..."application/x-www-form-urlencoded"...] ... ...} - pattern-not-inside: | {... ... ...blackList = [..."text/plain"..."application/x-www-form-urlencoded"..."multipart/form-data"...] ... ...} - pattern-not-inside: | {... ... ...blackList = [..."text/plain"..."multipart/form-data"..."application/x-www-form-urlencoded"...] ... ...} message: "Possibly bypassable CSRF configuration found. CSRF is an attack that forces an end user to execute unwanted actions on a web application in which they\u2019re currently authenticated. Make sure that Content-Type black list is configured and CORS filter is turned on." languages: - generic severity: ERROR paths: include: - '*.conf' metadata: references: - https://www.playframework.com/documentation/2.8.x/Migration25#CSRF-changes - https://owasp.org/www-community/attacks/csrf cwe: - 'CWE-352: Cross-Site Request Forgery (CSRF)' owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control category: security technology: - scala - play confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site Request Forgery (CSRF) source: https://semgrep.dev/r/scala.play.security.conf-csrf-headers-bypass.conf-csrf-headers-bypass shortlink: https://sg.run/4DEE semgrep.dev: rule: r_id: 19044 rv_id: 1263684 rule_id: lBUyRR version_id: O9Tpx53 url: https://semgrep.dev/playground/r/O9Tpx53/scala.play.security.conf-csrf-headers-bypass.conf-csrf-headers-bypass origin: community - id: ruby.rails.security.brakeman.check-dynamic-render-local-file-include.check-dynamic-render-local-file-include mode: search paths: include: - '*.erb' patterns: - pattern: | params[...] - pattern-inside: | render :file => ... message: Found request parameters in a call to `render` in a dynamic context. This can allow end users to request arbitrary local files which may result in leaking sensitive information persisted on disk. languages: - generic severity: WARNING metadata: technology: - ruby - rails category: security cwe: - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_render.rb references: - https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion - https://github.com/presidentbeef/brakeman/blob/f74cb53ead47f0af821d98b5b41e16d63100c240/test/apps/rails2/app/views/home/test_render.html.erb cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Path Traversal source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-dynamic-render-local-file-include.check-dynamic-render-local-file-include shortlink: https://sg.run/3QWl semgrep.dev: rule: r_id: 20043 rv_id: 1263651 rule_id: JDUokO version_id: QkTGq9X url: https://semgrep.dev/playground/r/QkTGq9X/ruby.rails.security.brakeman.check-dynamic-render-local-file-include.check-dynamic-render-local-file-include origin: community - id: ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include mode: taint pattern-sources: - patterns: - pattern: params[...] pattern-sinks: - patterns: - pattern-either: - pattern: | render ..., file: $X - pattern: | render ..., inline: $X - pattern: | render ..., template: $X - pattern: | render ..., action: $X - pattern: | render $X, ... - focus-metavariable: $X pattern-sanitizers: - patterns: - pattern: $MAP[...] - metavariable-pattern: metavariable: $MAP patterns: - pattern-not-regex: params - pattern: File.basename(...) message: Found request parameters in a call to `render`. This can allow end users to request arbitrary local files which may result in leaking sensitive information persisted on disk. Where possible, avoid letting users specify template paths for `render`. If you must allow user input, use an allow-list of known templates or normalize the user-supplied value with `File.basename(...)`. languages: - ruby severity: WARNING metadata: technology: - ruby - rails category: security cwe: - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_render.rb references: - https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion - https://github.com/presidentbeef/brakeman/blob/f74cb53/test/apps/rails2/app/controllers/home_controller.rb#L48-L60 cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM vulnerability_class: - Path Traversal license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include shortlink: https://sg.run/Jw8Z semgrep.dev: rule: r_id: 20046 rv_id: 1409407 rule_id: ReU2pZ version_id: K3TgANN url: https://semgrep.dev/playground/r/K3TgANN/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include origin: community - id: scala.lang.security.audit.tainted-sql-string.tainted-sql-string languages: - scala severity: ERROR mode: taint message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library. metadata: cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html category: security technology: - scala confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/scala.lang.security.audit.tainted-sql-string.tainted-sql-string shortlink: https://sg.run/ALD6 semgrep.dev: rule: r_id: 20050 rv_id: 1263682 rule_id: WAUY8B version_id: w8TRoO6 url: https://semgrep.dev/playground/r/w8TRoO6/scala.lang.security.audit.tainted-sql-string.tainted-sql-string origin: community pattern-sources: - patterns: - pattern: $PARAM - pattern-either: - pattern-inside: | def $CTRL(..., $PARAM: $TYPE, ...) = { ... } - pattern-inside: | def $CTRL(..., $PARAM: $TYPE, ...) = $A { ... } - pattern-inside: | def $CTRL(..., $PARAM: $TYPE, ...) = $A(...) { ... } pattern-sinks: - patterns: - pattern-either: - patterns: - pattern-either: - pattern: | "$SQLSTR" + ... - pattern: | "$SQLSTR".format(...) - patterns: - pattern-inside: | $SB = new StringBuilder("$SQLSTR"); ... - pattern: $SB.append(...) - patterns: - pattern-inside: | $VAR = "$SQLSTR" ... - pattern: $VAR += ... - metavariable-regex: metavariable: $SQLSTR regex: (?i)(select|delete|insert|create|update|alter|drop)\b - patterns: - pattern-either: - pattern: s"..." - pattern: f"..." - pattern-regex: | .*\b(?i)(select|delete|insert|create|update|alter|drop)\b.* - pattern-not-inside: println(...) - pattern-not-inside: throw new $EXCEPTION(...) pattern-sanitizers: - pattern-either: - patterns: - pattern-either: - pattern: $LOGGER.$METHOD(...) - pattern: $LOGGER(...) - metavariable-regex: metavariable: $LOGGER regex: (i?)log.* - patterns: - pattern: $LOGGER.$METHOD(...) - metavariable-regex: metavariable: $METHOD regex: (i?)(trace|info|warn|warning|warnToError|error|debug) - id: scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request languages: - scala severity: ERROR mode: taint message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library. metadata: cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html category: security technology: - scala - play confidence: HIGH cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request shortlink: https://sg.run/BeW9 semgrep.dev: rule: r_id: 20051 rv_id: 1263688 rule_id: 0oUpon version_id: ZRTKAoG url: https://semgrep.dev/playground/r/ZRTKAoG/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request origin: community pattern-sources: - patterns: - pattern-either: - patterns: - pattern: $REQ - pattern-either: - pattern-inside: "Action {\n $REQ: Request[$T] => \n ...\n}\n" - pattern-inside: "Action(...) {\n $REQ: Request[$T] => \n ...\n}\n" - pattern-inside: "Action.async {\n $REQ: Request[$T] => \n ...\n}\n" - pattern-inside: "Action.async(...) {\n $REQ: Request[$T] => \n ...\n}\n" - patterns: - pattern: $PARAM - pattern-either: - pattern-inside: | def $CTRL(..., $PARAM: $TYPE, ...) = Action { ... } - pattern-inside: | def $CTRL(..., $PARAM: $TYPE, ...) = Action(...) { ... } - pattern-inside: | def $CTRL(..., $PARAM: $TYPE, ...) = Action.async { ... } - pattern-inside: | def $CTRL(..., $PARAM: $TYPE, ...) = Action.async(...) { ... } pattern-sinks: - patterns: - pattern-either: - patterns: - pattern-either: - pattern: | "$SQLSTR" + ... - pattern: | "$SQLSTR".format(...) - patterns: - pattern-inside: | $SB = new StringBuilder("$SQLSTR"); ... - pattern: $SB.append(...) - patterns: - pattern-inside: | $VAR = "$SQLSTR" ... - pattern: $VAR += ... - metavariable-regex: metavariable: $SQLSTR regex: (?i)(select|delete|insert|create|update|alter|drop)\b - patterns: - pattern: s"..." - pattern-regex: | .*\b(?i)(select|delete|insert|create|update|alter|drop)\b.* - pattern-not-inside: println(...) - id: yaml.kubernetes.security.secrets-in-config-file.secrets-in-config-file patterns: - pattern: | $KEY: $VALUE - pattern-inside: | data: ... - pattern-inside: | kind: Secret ... - metavariable-regex: metavariable: $VALUE regex: (?i)^[aA-zZ0-9+/]+={0,2}$ - metavariable-analysis: analyzer: entropy metavariable: $VALUE message: 'Secrets ($VALUE) should not be stored in infrastructure as code files. Use an alternative such as Bitnami Sealed Secrets or KSOPS to encrypt Kubernetes Secrets. ' metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' category: security technology: - kubernetes references: - https://kubernetes.io/docs/concepts/configuration/secret/ - https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/0/CTR_Kubernetes_Hardening_Guidance_1.1_20220315.PDF - https://docs.gitlab.com/ee/user/clusters/agent/gitops/secrets_management.html - https://www.cncf.io/blog/2021/04/22/revealing-the-secrets-of-kubernetes-secrets/ - https://github.com/bitnami-labs/sealed-secrets - https://www.cncf.io/blog/2022/01/25/secrets-management-essential-when-using-kubernetes/ - https://blog.oddbit.com/post/2021-03-09-getting-started-with-ksops/ owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/yaml.kubernetes.security.secrets-in-config-file.secrets-in-config-file shortlink: https://sg.run/KyL6 semgrep.dev: rule: r_id: 20055 rv_id: 1263942 rule_id: YGUYEb version_id: xyTjz5B url: https://semgrep.dev/playground/r/xyTjz5B/yaml.kubernetes.security.secrets-in-config-file.secrets-in-config-file origin: community languages: - yaml severity: WARNING - id: ruby.rails.security.brakeman.check-sql.check-sql mode: taint pattern-sources: - pattern-either: - pattern: | cookies[...] - patterns: - pattern: | cookies. ... .$PROPERTY[...] - metavariable-regex: metavariable: $PROPERTY regex: (?!signed|encrypted) - pattern: | params[...] - pattern: | request.env[...] pattern-sanitizers: - patterns: - pattern-either: - patterns: - pattern: $X - pattern-either: - pattern-inside: | :$KEY => $X - pattern-inside: | ["...",$X,...] - pattern: | params[...].to_i - pattern: | params[...].to_f - patterns: - pattern: | params[...] ? $A : $B - metavariable-pattern: metavariable: $A patterns: - pattern-not: | params[...] - metavariable-pattern: metavariable: $B patterns: - pattern-not: | params[...] pattern-sinks: - patterns: - pattern: $X - pattern-not-inside: | $P.where("...",...) - pattern-not-inside: | $P.where(:$KEY => $VAL,...) - pattern-either: - pattern-inside: | $P.$M(...) - pattern-inside: | $P.$M("...",...) - pattern-inside: | class $P < ActiveRecord::Base ... end - metavariable-regex: metavariable: $M regex: (where|find|first|last|select|minimum|maximum|calculate|sum|average) message: Found potential SQL injection due to unsafe SQL query construction via $X. Where possible, prefer parameterized queries. languages: - ruby severity: ERROR metadata: source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_sql.rb category: security cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection technology: - ruby - rails references: - https://owasp.org/www-community/attacks/SQL_Injection - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/models/product.rb cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-sql.check-sql shortlink: https://sg.run/vpgb semgrep.dev: rule: r_id: 20533 rv_id: 1263661 rule_id: OrUv2z version_id: DkTRbE4 url: https://semgrep.dev/playground/r/DkTRbE4/ruby.rails.security.brakeman.check-sql.check-sql origin: community - id: ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods mode: taint pattern-sources: - pattern-either: - pattern: | cookies[...] - patterns: - pattern: | cookies. ... .$PROPERTY[...] - metavariable-regex: metavariable: $PROPERTY regex: (?!signed|encrypted) - pattern: | params[...] - pattern: | request.env[...] pattern-sinks: - patterns: - pattern: $X - pattern-either: - pattern-inside: | $X. ... .to_proc - patterns: - pattern-inside: | $Y.method($Z) - focus-metavariable: $Z - patterns: - pattern-inside: | $Y.tap($Z) - focus-metavariable: $Z - patterns: - pattern-inside: | $Y.tap{ |$ANY| $Z } - focus-metavariable: $Z message: Found user-controllable input to a reflection method. This may allow a user to alter program behavior and potentially execute arbitrary instructions in the context of the process. Do not provide arbitrary user input to `tap`, `method`, or `to_proc` languages: - ruby severity: ERROR metadata: source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_unsafe_reflection_methods.rb category: security cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' owasp: - A03:2021 - Injection - A05:2025 - Injection technology: - ruby - rails references: - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails6/app/controllers/groups_controller.rb cwe2022-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods shortlink: https://sg.run/dPYd semgrep.dev: rule: r_id: 20534 rv_id: 1263662 rule_id: eqUZ2Q version_id: WrTqKLA url: https://semgrep.dev/playground/r/WrTqKLA/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods origin: community - id: ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase message: Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file. languages: - ruby severity: WARNING metadata: technology: - ruby - secrets category: security references: - https://cwe.mitre.org/data/definitions/522.html cwe: - 'CWE-798: Use of Hard-coded Credentials' owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase shortlink: https://sg.run/xPEe semgrep.dev: rule: r_id: 20730 rv_id: 1263607 rule_id: bwULyN version_id: K3TKkEo url: https://semgrep.dev/playground/r/K3TKkEo/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase origin: community patterns: - pattern-either: - pattern: OpenSSL::PKey::RSA.new(..., '...') - pattern: OpenSSL::PKey::RSA.new(...).to_pem(..., '...') - pattern: OpenSSL::PKey::RSA.new(...).export(..., '...') - patterns: - pattern-inside: | $OPENSSL = OpenSSL::PKey::RSA.new(...) ... - pattern-either: - pattern: | $OPENSSL.export(...,'...') - pattern: | $OPENSSL.to_pem(...,'...') - patterns: - pattern-either: - patterns: - pattern-inside: | $ASSIGN = '...' ... - pattern: OpenSSL::PKey::RSA.new(..., $ASSIGN) - patterns: - pattern-inside: | def $METHOD1(...) ... $ASSIGN = '...' ... end ... def $METHOD2(...) ... end - pattern: OpenSSL::PKey::RSA.new(..., $ASSIGN) - patterns: - pattern-inside: | $ASSIGN = '...' ... def $METHOD(...) $OPENSSL = OpenSSL::PKey::RSA.new(...) ... end ... - pattern-either: - pattern: $OPENSSL.export(...,$ASSIGN) - pattern: $OPENSSL.to_pem(...,$ASSIGN) - patterns: - pattern-inside: | def $METHOD1(...) ... $OPENSSL = OpenSSL::PKey::RSA.new(...) ... $ASSIGN = '...' ... end ... - pattern-either: - pattern: $OPENSSL.export(...,$ASSIGN) - pattern: $OPENSSL.to_pem(...,$ASSIGN) - patterns: - pattern-inside: | def $METHOD1(...) ... $ASSIGN = '...' ... end ... def $METHOD2(...) ... $OPENSSL = OpenSSL::PKey::RSA.new(...) ... end ... - pattern-either: - pattern: $OPENSSL.export(...,$ASSIGN) - pattern: $OPENSSL.to_pem(...,$ASSIGN) - id: ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection mode: taint pattern-sources: - pattern-either: - pattern: | cookies[...] - patterns: - pattern: | cookies. ... .$PROPERTY[...] - metavariable-regex: metavariable: $PROPERTY regex: (?!signed|encrypted) - pattern: | params[...] - pattern: | request.env[...] pattern-sinks: - patterns: - pattern: $X - pattern-either: - pattern-inside: | $X.constantize - pattern-inside: | $X. ... .safe_constantize - pattern-inside: | const_get(...) - pattern-inside: | qualified_const_get(...) message: Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input. languages: - ruby severity: ERROR metadata: source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_unsafe_reflection.rb category: security cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' owasp: - A03:2021 - Injection - A05:2025 - Injection technology: - ruby - rails references: - https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails2/app/controllers/application_controller.rb cwe2022-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection shortlink: https://sg.run/vpEX semgrep.dev: rule: r_id: 20733 rv_id: 1263663 rule_id: wdUkYA version_id: 0bTKzn8 url: https://semgrep.dev/playground/r/0bTKzn8/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection origin: community - id: python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally patterns: - pattern-inside: | $CONFIG.set_default_csrf_options(..., check_origin=$CHECK_ORIGIN, ...) - pattern: $CHECK_ORIGIN - metavariable-comparison: metavariable: $CHECK_ORIGIN comparison: $CHECK_ORIGIN == False message: Automatic check of the referrer for cross-site request forgery tokens has been explicitly disabled globally, which might leave views unprotected when an unsafe CSRF storage policy is used. Use 'pyramid.config.Configurator.set_default_csrf_options(check_origin=True)' to turn the automatic check for all unsafe methods (per RFC2616). languages: - python severity: ERROR fix: | True metadata: cwe: - 'CWE-352: Cross-Site Request Forgery (CSRF)' owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control category: security technology: - pyramid references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: LOW confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site Request Forgery (CSRF) source: https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally shortlink: https://sg.run/3GeW semgrep.dev: rule: r_id: 21443 rv_id: 1263563 rule_id: eqU9Le version_id: K3TKkeo url: https://semgrep.dev/playground/r/K3TKkeo/python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally origin: community - id: python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled message: Origin check for the CSRF token is disabled for this view. This might represent a security risk if the CSRF storage policy is not known to be secure. metadata: cwe: - 'CWE-352: Cross-Site Request Forgery (CSRF)' owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control asvs: section: V4 Access Control control_id: 4.2.2 CSRF control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V4-Access-Control.md#v42-operation-level-access-control version: '4' category: security technology: - pyramid references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: LOW confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site Request Forgery (CSRF) source: https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled shortlink: https://sg.run/4RB9 semgrep.dev: rule: r_id: 21444 rv_id: 1263564 rule_id: v8UGpL version_id: qkTR7Gv url: https://semgrep.dev/playground/r/qkTR7Gv/python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled origin: community severity: WARNING languages: - python patterns: - pattern-inside: | from pyramid.view import view_config ... @view_config(..., check_origin=$CHECK_ORIGIN, ...) def $VIEW(...): ... - pattern: $CHECK_ORIGIN - metavariable-comparison: metavariable: $CHECK_ORIGIN comparison: $CHECK_ORIGIN == False fix: | True - id: python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally patterns: - pattern-inside: | $CONFIG.set_default_csrf_options(..., require_csrf=$REQUIRE_CSRF, ...) - pattern: $REQUIRE_CSRF - metavariable-comparison: metavariable: $REQUIRE_CSRF comparison: $REQUIRE_CSRF == False message: Automatic check of cross-site request forgery tokens has been explicitly disabled globally, which might leave views unprotected. Use 'pyramid.config.Configurator.set_default_csrf_options(require_csrf=True)' to turn the automatic check for all unsafe methods (per RFC2616). languages: - python severity: ERROR fix: | True metadata: cwe: - 'CWE-352: Cross-Site Request Forgery (CSRF)' owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control category: security technology: - pyramid references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: LOW confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site Request Forgery (CSRF) source: https://semgrep.dev/r/python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally shortlink: https://sg.run/Bx2R semgrep.dev: rule: r_id: 21451 rv_id: 1263571 rule_id: 8GUKqP version_id: 2KTv2en url: https://semgrep.dev/playground/r/2KTv2en/python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally origin: community - id: python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response message: Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection category: security technology: - pyramid references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response shortlink: https://sg.run/DX8G semgrep.dev: rule: r_id: 21452 rv_id: 1263572 rule_id: gxUeA8 version_id: X0TzyEe url: https://semgrep.dev/playground/r/X0TzyEe/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response origin: community languages: - python severity: ERROR mode: taint pattern-sources: - patterns: - pattern-inside: | @pyramid.view.view_config( ... ) def $VIEW($REQ): ... - pattern: $REQ.$ANYTHING - pattern-not: $REQ.dbsession pattern-sinks: - patterns: - pattern-either: - pattern: | pyramid.request.Response.text($SINK) - pattern: | pyramid.request.Response($SINK) - pattern: | $REQ.response.body = $SINK - pattern: | $REQ.response.text = $SINK - pattern: | $REQ.response.ubody = $SINK - pattern: | $REQ.response.unicode_body = $SINK - pattern: $SINK - id: python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection message: Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides "bindparams". Use bindParams to securely bind user-input to SQL statements. languages: - python severity: ERROR metadata: category: security cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.sqlalchemy.org/en/14/tutorial/data_select.html#tutorial-selecting-data technology: - pyramid cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection shortlink: https://sg.run/W7eE semgrep.dev: rule: r_id: 21453 rv_id: 1263573 rule_id: QrUZ7l version_id: jQTn5WA url: https://semgrep.dev/playground/r/jQTn5WA/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection origin: community mode: taint pattern-sources: - patterns: - pattern-inside: | from pyramid.view import view_config ... @view_config( ... ) def $VIEW($REQ): ... - pattern: $REQ.$ANYTHING - pattern-not: $REQ.dbsession pattern-sinks: - patterns: - pattern-inside: | $QUERY = $REQ.dbsession.query(...) ... - pattern-either: - pattern: | $QUERY.$SQLFUNC("...".$FORMATFUNC(..., $SINK, ...)) - pattern: | $QUERY.join(...).$SQLFUNC("...".$FORMATFUNC(..., $SINK, ...)) - pattern: $SINK - metavariable-regex: metavariable: $SQLFUNC regex: (group_by|order_by|distinct|having|filter) - metavariable-regex: metavariable: $FORMATFUNC regex: (?!bindparams) fix-regex: regex: format replacement: bindparams - id: javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint message: Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize. metadata: confidence: MEDIUM cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' references: - https://docs.angularjs.org/api/ng/function/angular.element - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf category: security technology: - angularjs owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint shortlink: https://sg.run/5AQ0 semgrep.dev: rule: r_id: 21503 rv_id: 1263091 rule_id: GdUP71 version_id: 44TEj8L url: https://semgrep.dev/playground/r/44TEj8L/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint origin: community languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern: window.location.search - pattern: window.document.location.search - pattern: document.location.search - pattern: location.search - pattern: $location.search(...) - patterns: - pattern-either: - pattern: $DECODE(<... location.hash ...>) - pattern: $DECODE(<... window.location.hash ...>) - pattern: $DECODE(<... document.location.hash ...>) - pattern: $DECODE(<... location.href ...>) - pattern: $DECODE(<... window.location.href ...>) - pattern: $DECODE(<... document.location.href ...>) - pattern: $DECODE(<... document.URL ...>) - pattern: $DECODE(<... window.document.URL ...>) - pattern: $DECODE(<... document.location.href ...>) - pattern: $DECODE(<... document.location.href ...>) - pattern: $DECODE(<... $location.absUrl() ...>) - pattern: $DECODE(<... $location.url() ...>) - pattern: $DECODE(<... $location.hash() ...>) - metavariable-regex: metavariable: $DECODE regex: ^(unescape|decodeURI|decodeURIComponent)$ - patterns: - pattern-inside: $http.$METHOD(...).$CONTINUE(function $FUNC($RES) {...}) - metavariable-regex: metavariable: $METHOD regex: ^(get|delete|head|jsonp|post|put|patch) - pattern: $RES.data pattern-sinks: - patterns: - pattern-either: - pattern-inside: | angular.element(...). ... .$SINK($QUERY) - pattern-inside: | $ANGULAR = angular.element(...) ... $ANGULAR. ... .$SINK($QUERY) - metavariable-regex: metavariable: $SINK regex: ^(after|append|html|prepend|replaceWith|wrap)$ - focus-metavariable: $QUERY pattern-sanitizers: - patterns: - pattern-either: - pattern: $sce.getTrustedHtml(...) - pattern: $sanitize(...) - pattern: DOMPurify.sanitize(...) - id: python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization mode: taint pattern-sources: - patterns: - pattern: event - pattern-inside: | def $HANDLER(event, context): ... pattern-sinks: - patterns: - focus-metavariable: $SINK - pattern-either: - pattern: pickle.load($SINK,...) - pattern: pickle.loads($SINK,...) - pattern: _pickle.load($SINK,...) - pattern: _pickle.loads($SINK,...) - pattern: cPickle.load($SINK,...) - pattern: cPickle.loads($SINK,...) - pattern: dill.load($SINK,...) - pattern: dill.loads($SINK,...) - pattern: shelve.open($SINK,...) message: Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. metadata: owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures cwe: - 'CWE-502: Deserialization of Untrusted Data' references: - https://docs.python.org/3/library/pickle.html - https://davidhamann.de/2020/04/05/exploiting-python-pickle/ category: security technology: - python - aws-lambda cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization shortlink: https://sg.run/JbjW semgrep.dev: rule: r_id: 21602 rv_id: 1263345 rule_id: JDUDQg version_id: LjTkgd9 url: https://semgrep.dev/playground/r/LjTkgd9/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization origin: community languages: - python severity: WARNING - id: php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection mode: taint pattern-sources: - patterns: - focus-metavariable: $ARG - pattern-inside: | Route::$METHOD($ROUTE_NAME, function(...,$ARG,...){...}) pattern-sanitizers: - patterns: - pattern: | DB::raw("...",[...]) pattern-sinks: - patterns: - pattern: | DB::raw(...) message: HTTP method [$METHOD] to Laravel route $ROUTE_NAME is vulnerable to SQL injection via string concatenation or unsafe interpolation. languages: - php severity: WARNING metadata: category: security cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md technology: - php - laravel cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection shortlink: https://sg.run/x94g semgrep.dev: rule: r_id: 21674 rv_id: 1263305 rule_id: zdUln0 version_id: qkTR7A9 url: https://semgrep.dev/playground/r/qkTR7A9/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection origin: community - id: php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator mode: taint pattern-sources: - patterns: - pattern: | public function $F(...,Request $R,...){...} - focus-metavariable: $R - patterns: - pattern-either: - pattern: | $this->$PROPERTY - pattern: | $this->$PROPERTY->$GET - metavariable-pattern: metavariable: $PROPERTY patterns: - pattern-either: - pattern: query - pattern: request - pattern: headers - pattern: cookies - pattern: cookie - pattern: files - pattern: file - pattern: allFiles - pattern: input - pattern: all - pattern: post - pattern: json - pattern-either: - pattern-inside: | class $CL extends Illuminate\Http\Request {...} - pattern-inside: | class $CL extends Illuminate\Foundation\Http\FormRequest {...} pattern-sinks: - patterns: - pattern: | Illuminate\Validation\Rule::unique(...)->ignore(...,$IGNORE,...) - focus-metavariable: $IGNORE message: Found a request argument passed to an `ignore()` definition in a Rule constraint. This can lead to SQL injection. languages: - php severity: ERROR metadata: category: security cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection technology: - php - laravel references: - https://laravel.com/docs/9.x/validation#rule-unique cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator shortlink: https://sg.run/vkeb semgrep.dev: rule: r_id: 21677 rv_id: 1263314 rule_id: X5ULgE version_id: DkTRbBl url: https://semgrep.dev/playground/r/DkTRbBl/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator origin: community - id: java.spring.security.injection.tainted-html-string.tainted-html-string languages: - java severity: ERROR message: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. You can use the OWASP ESAPI encoder if you must render user data. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html category: security technology: - java - spring cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/java.spring.security.injection.tainted-html-string.tainted-html-string shortlink: https://sg.run/ObdR semgrep.dev: rule: r_id: 22075 rv_id: 1409395 rule_id: YGUvkL version_id: 3ZT2598 url: https://semgrep.dev/playground/r/3ZT2598/java.spring.security.injection.tainted-html-string.tainted-html-string origin: community mode: taint pattern-sources: - label: INPUT patterns: - pattern-either: - pattern-inside: | $METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) { ... } - pattern-inside: | $METHODNAME(..., @$REQ $TYPE $SOURCE,...) { ... } - metavariable-regex: metavariable: $TYPE regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean)) - metavariable-regex: metavariable: $REQ regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute) - focus-metavariable: $SOURCE - label: CONCAT by-side-effect: true requires: INPUT patterns: - pattern-either: - pattern: | "$HTMLSTR" + ... - pattern: | "$HTMLSTR".concat(...) - patterns: - pattern-inside: | StringBuilder $SB = new StringBuilder("$HTMLSTR"); ... - pattern: $SB.append(...) - patterns: - pattern-inside: | $VAR = "$HTMLSTR"; ... - pattern: $VAR += ... - pattern: String.format("$HTMLSTR", ...) - patterns: - pattern-inside: | String $VAR = "$HTMLSTR"; ... - pattern: String.format($VAR, ...) - metavariable-regex: metavariable: $HTMLSTR regex: ^<\w+ pattern-propagators: - pattern: (StringBuilder $SB).append($...TAINTED) from: $...TAINTED to: $SB - pattern: $VAR += $...TAINTED from: $...TAINTED to: $VAR pattern-sinks: - requires: CONCAT patterns: - pattern-either: - pattern: new ResponseEntity<>($PAYLOAD, ...) - pattern: new ResponseEntity<$ERROR>($PAYLOAD, ...) - pattern: ResponseEntity. ... .body($PAYLOAD) - patterns: - pattern: | ResponseEntity.$RESPFUNC($PAYLOAD). ... - metavariable-regex: metavariable: $RESPFUNC regex: ^(ok|of)$ - focus-metavariable: $PAYLOAD pattern-sanitizers: - pattern-either: - pattern: Encode.forHtml(...) - pattern: (PolicyFactory $POLICY).sanitize(...) - pattern: (AntiSamy $AS).scan(...) - pattern: JSoup.clean(...) - id: java.spring.security.injection.tainted-system-command.tainted-system-command languages: - java severity: ERROR mode: taint pattern-propagators: - pattern: (StringBuilder $STRB).append($INPUT) from: $INPUT to: $STRB label: CONCAT requires: INPUT pattern-sources: - patterns: - pattern-either: - pattern-inside: | $METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) { ... } - pattern-inside: | $METHODNAME(..., @$REQ $TYPE $SOURCE,...) { ... } - metavariable-regex: metavariable: $TYPE regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean)) - metavariable-regex: metavariable: $REQ regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute) - focus-metavariable: $SOURCE label: INPUT - patterns: - pattern-either: - pattern: $X + $SOURCE - pattern: $SOURCE + $Y - pattern: String.format("...", ..., $SOURCE, ...) - pattern: String.join("...", ..., $SOURCE, ...) - pattern: (String $STR).concat($SOURCE) - pattern: $SOURCE.concat(...) - pattern: $X += $SOURCE - pattern: $SOURCE += $X label: CONCAT requires: INPUT pattern-sinks: - patterns: - pattern-either: - pattern: | (Process $P) = new Process(...); - pattern: | (ProcessBuilder $PB).command(...); - patterns: - pattern-either: - pattern: | (Runtime $R).$EXEC(...); - pattern: | Runtime.getRuntime(...).$EXEC(...); - metavariable-regex: metavariable: $EXEC regex: (exec|loadLibrary|load) - patterns: - pattern: | (ProcessBuilder $PB).command(...).$ADD(...); - metavariable-regex: metavariable: $ADD regex: (add|addAll) - patterns: - pattern-either: - patterns: - pattern-inside: | $BUILDER = new ProcessBuilder(...); ... - pattern: $BUILDER.start(...) - pattern: | new ProcessBuilder(...). ... .start(...); requires: CONCAT message: 'Detected user input entering a method which executes a system command. This could result in a command injection vulnerability, which allows an attacker to inject an arbitrary system command onto the server. The attacker could download malware onto or steal data from the server. Instead, use ProcessBuilder, separating the command into individual arguments, like this: `new ProcessBuilder("ls", "-al", targetDirectory)`. Further, make sure you hardcode or allowlist the actual command so that attackers can''t run arbitrary commands.' metadata: cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection category: security technology: - java - spring confidence: HIGH references: - https://www.stackhawk.com/blog/command-injection-java/ - https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html - https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.java cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/java.spring.security.injection.tainted-system-command.tainted-system-command shortlink: https://sg.run/epY0 semgrep.dev: rule: r_id: 22076 rv_id: 1263087 rule_id: 6JUxGN version_id: 8KT5rnP url: https://semgrep.dev/playground/r/8KT5rnP/java.spring.security.injection.tainted-system-command.tainted-system-command origin: community - id: java.spring.security.injection.tainted-url-host.tainted-url-host languages: - java severity: ERROR message: User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, hardcode the correct host, or ensure that the user data can only affect the path or parameters. options: interfile: true metadata: cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control references: - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html category: security technology: - java - spring cwe2022-top25: true cwe2021-top25: true subcategory: - vuln impact: MEDIUM likelihood: MEDIUM confidence: MEDIUM interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Server-Side Request Forgery (SSRF) source: https://semgrep.dev/r/java.spring.security.injection.tainted-url-host.tainted-url-host shortlink: https://sg.run/vkYn semgrep.dev: rule: r_id: 22077 rv_id: 1263088 rule_id: oqUZo8 version_id: gETB708 url: https://semgrep.dev/playground/r/gETB708/java.spring.security.injection.tainted-url-host.tainted-url-host origin: community mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: | $METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) { ... } - pattern-inside: | $METHODNAME(..., @$REQ $TYPE $SOURCE,...) { ... } - metavariable-regex: metavariable: $TYPE regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean)) - metavariable-regex: metavariable: $REQ regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute) - focus-metavariable: $SOURCE pattern-sinks: - pattern-either: - pattern: new URL($ONEARG) - patterns: - pattern-either: - pattern: | "$URLSTR" + ... - pattern: | "$URLSTR".concat(...) - patterns: - pattern-inside: | StringBuilder $SB = new StringBuilder("$URLSTR"); ... - pattern: $SB.append(...) - patterns: - pattern-inside: | $VAR = "$URLSTR"; ... - pattern: $VAR += ... - patterns: - pattern: String.format("$URLSTR", ...) - pattern-not: String.format("$URLSTR", "...", ...) - patterns: - pattern-inside: | String $VAR = "$URLSTR"; ... - pattern: String.format($VAR, ...) - metavariable-regex: metavariable: $URLSTR regex: http(s?)://%(v|s|q).* - id: ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization mode: taint languages: - ruby message: Deserialization of a string tainted by `event` object found. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of `load` can cause remote code execution. Loading user input with MARSHAL, YAML or CSV can potentially be dangerous. If you need to deserialize untrusted data, you should use JSON as it is only capable of returning 'primitive' types such as strings, arrays, hashes, numbers and nil. metadata: references: - https://ruby-doc.org/core-3.1.2/doc/security_rdoc.html - https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb category: security owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures cwe: - 'CWE-502: Deserialization of Untrusted Data' technology: - ruby - aws-lambda cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization shortlink: https://sg.run/dplX semgrep.dev: rule: r_id: 22078 rv_id: 1263585 rule_id: zdUlNJ version_id: vdT06gR url: https://semgrep.dev/playground/r/vdT06gR/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization origin: community pattern-sinks: - patterns: - pattern: $SINK - pattern-either: - pattern-inside: | YAML.load($SINK,...) - pattern-inside: | CSV.load($SINK,...) - pattern-inside: | Marshal.load($SINK,...) - pattern-inside: | Marshal.restore($SINK,...) pattern-sources: - patterns: - pattern: event - pattern-inside: | def $HANDLER(event, context) ... end severity: WARNING - id: javascript.express.security.audit.express-libxml-noent.express-libxml-noent message: The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure you are protected. options: interfile: true metadata: interfile: true references: - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html technology: - express category: security cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent shortlink: https://sg.run/Z75x semgrep.dev: rule: r_id: 22079 rv_id: 1263138 rule_id: pKUNeD version_id: d6TyxpX url: https://semgrep.dev/playground/r/d6TyxpX/javascript.express.security.audit.express-libxml-noent.express-libxml-noent origin: community languages: - javascript - typescript severity: ERROR mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: function ... ($REQ, $RES) {...} - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - patterns: - pattern-either: - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|head|delete|options)$ - pattern-either: - pattern: $REQ.query - pattern: $REQ.body - pattern: $REQ.params - pattern: $REQ.cookies - pattern: $REQ.headers - pattern: $REQ.files.$ANYTHING.data.toString('utf8') - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') - patterns: - pattern-either: - pattern-inside: | ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...} - pattern-inside: | ({ $REQ }: Request,$RES: Response) => {...} - focus-metavariable: $REQ - pattern-either: - pattern: params - pattern: query - pattern: cookies - pattern: headers - pattern: body - pattern: files.$ANYTHING.data.toString('utf8') - pattern: files.$ANYTHING['data'].toString('utf8') pattern-sinks: - pattern-either: - patterns: - pattern-either: - pattern-inside: | $XML = require('$IMPORT') ... - pattern-inside: | import $XML from '$IMPORT' ... - pattern-inside: | import * as $XML from '$IMPORT' ... - metavariable-regex: metavariable: $IMPORT regex: ^(libxmljs|libxmljs2)$ - pattern-inside: $XML.$FUNC($QUERY, {...,noent:true,...}) - metavariable-regex: metavariable: $FUNC regex: ^(parseXmlString|parseXml)$ - focus-metavariable: $QUERY - id: javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). options: interfile: true metadata: interfile: true cwe: - 'CWE-798: Use of Hard-coded Credentials' references: - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures category: security technology: - express - secrets cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret shortlink: https://sg.run/LYvG semgrep.dev: rule: r_id: 22083 rv_id: 1263143 rule_id: 10Uo39 version_id: LjTkgle url: https://semgrep.dev/playground/r/LjTkgle/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret origin: community languages: - javascript - typescript severity: WARNING patterns: - pattern-either: - pattern-inside: | $SESSION = require('express-session'); ... - pattern-inside: | import $SESSION from 'express-session' ... - pattern-inside: | import {..., $SESSION, ...} from 'express-session' ... - pattern-inside: | import * as $SESSION from 'express-session' ... - patterns: - pattern-either: - pattern-inside: $APP.use($SESSION({...})) - pattern: | $SECRET = $VALUE ... $APP.use($SESSION($SECRET)) - pattern: | secret: '$Y' - id: javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization message: The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and Buffer.from(). options: interfile: true metadata: interfile: true technology: - express category: security cwe: - 'CWE-502: Deserialization of Untrusted Data' references: - https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html source_rule_url: - https://github.com/ajinabraham/njsscan/blob/75bfbeb9c8d72999e4d527dfa2548f7f0f3cc48a/njsscan/rules/semantic_grep/eval/eval_deserialize.yaml owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization shortlink: https://sg.run/8W5j semgrep.dev: rule: r_id: 22084 rv_id: 1263145 rule_id: 9AUyqj version_id: gETB7nD url: https://semgrep.dev/playground/r/gETB7nD/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization origin: community languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: function ... ($REQ, $RES) {...} - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - patterns: - pattern-either: - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|head|delete|options)$ - pattern-either: - pattern: $REQ.query - pattern: $REQ.body - pattern: $REQ.params - pattern: $REQ.cookies - pattern: $REQ.headers - pattern: $REQ.files.$ANYTHING.data.toString('utf8') - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') - patterns: - pattern-either: - pattern-inside: | ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...} - pattern-inside: | ({ $REQ }: Request,$RES: Response) => {...} - focus-metavariable: $REQ - pattern-either: - pattern: params - pattern: query - pattern: cookies - pattern: headers - pattern: body - pattern: files.$ANYTHING.data.toString('utf8') - pattern: files.$ANYTHING['data'].toString('utf8') pattern-sinks: - pattern-either: - patterns: - pattern-either: - pattern-inside: | $SER = require('$IMPORT') ... - pattern-inside: | import $SER from '$IMPORT' ... - pattern-inside: | import * as $SER from '$IMPORT' ... - metavariable-regex: metavariable: $IMPORT regex: ^(node-serialize|serialize-to-js)$ - pattern: $SER.$FUNC(...) - metavariable-regex: metavariable: $FUNC regex: ^(unserialize|deserialize)$ - id: javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection message: Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. options: interfile: true metadata: interfile: true references: - https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements category: security technology: - express cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection shortlink: https://sg.run/gjoe semgrep.dev: rule: r_id: 22085 rv_id: 1263241 rule_id: yyU0GX version_id: nWT2Llx url: https://semgrep.dev/playground/r/nWT2Llx/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection origin: community languages: - javascript - typescript severity: ERROR mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: function ... ($REQ, $RES) {...} - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - patterns: - pattern-either: - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|head|delete|options)$ - pattern-either: - pattern: $REQ.query - pattern: $REQ.body - pattern: $REQ.params - pattern: $REQ.cookies - pattern: $REQ.headers - pattern: $REQ.files.$ANYTHING.data.toString('utf8') - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') - patterns: - pattern-either: - pattern-inside: | ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...} - pattern-inside: | ({ $REQ }: Request,$RES: Response) => {...} - focus-metavariable: $REQ - pattern-either: - pattern: params - pattern: query - pattern: cookies - pattern: headers - pattern: body - pattern: files.$ANYTHING.data.toString('utf8') - pattern: files.$ANYTHING['data'].toString('utf8') pattern-sinks: - pattern-either: - patterns: - pattern-either: - pattern: sequelize.query($QUERY,...) - pattern: $DB.sequelize.query($QUERY,...) - focus-metavariable: $QUERY pattern-sanitizers: - pattern-either: - pattern: parseInt(...) - pattern: $FUNC. ... .hash(...) - id: javascript.express.security.audit.express-ssrf.express-ssrf message: 'The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded to follow OWASP best practices to prevent abuse. ' metadata: references: - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' technology: - express category: security owasp: - A10:2021 - Server-Side Request Forgery (SSRF) - A01:2025 - Broken Access Control cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Server-Side Request Forgery (SSRF) source: https://semgrep.dev/r/javascript.express.security.audit.express-ssrf.express-ssrf shortlink: https://sg.run/0PNw semgrep.dev: rule: r_id: 22554 rv_id: 1263144 rule_id: eqU9l2 version_id: 8KT5rBr url: https://semgrep.dev/playground/r/8KT5rBr/javascript.express.security.audit.express-ssrf.express-ssrf origin: community languages: - javascript - typescript severity: WARNING mode: taint options: taint_unify_mvars: true pattern-sources: - patterns: - pattern-either: - pattern-inside: function ... ($REQ, ...) {...} - pattern-either: - pattern: $REQ.query - pattern: $REQ.body - pattern: $REQ.params - pattern: $REQ.cookies - pattern: $REQ.headers - patterns: - pattern-either: - pattern-inside: | ({ $REQ }: Request,...) => {...} - pattern-inside: | ({ $REQ }: $EXPRESS.Request,...) => {...} - focus-metavariable: $REQ - pattern-either: - pattern: params - pattern: query - pattern: cookies - pattern: headers - pattern: body pattern-sinks: - patterns: - pattern-either: - pattern-inside: | $REQUEST = require('request') ... - pattern-inside: | import * as $REQUEST from 'request' ... - pattern-inside: | import $REQUEST from 'request' ... - pattern-either: - pattern: $REQUEST.$METHOD("$HTTP"+$REQ. ... .$VALUE) - pattern: $REQUEST.$METHOD("$HTTP"+$REQ. ... .$VALUE + $...A) - pattern: $REQUEST.$METHOD(`$HTTP${$REQ. ... .$VALUE}...`) - pattern: $REQUEST.$METHOD("$HTTP"+$REQ.$VALUE[...]) - pattern: $REQUEST.$METHOD("$HTTP"+$REQ.$VALUE[...] + $...A) - pattern: $REQUEST.$METHOD(`$HTTP${$REQ.$VALUE[...]}...`) - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|patch|del|head|delete)$ - metavariable-regex: metavariable: $HTTP regex: ^(https?:\/\/|//)$ - pattern-either: - pattern: $REQ. ... .$VALUE - patterns: - pattern-either: - pattern-inside: | $REQUEST = require('request') ... - pattern-inside: | import * as $REQUEST from 'request' ... - pattern-inside: | import $REQUEST from 'request' ... - pattern-either: - pattern: $REQUEST.$METHOD($REQ. ... .$VALUE,...) - pattern: $REQUEST.$METHOD($REQ. ... .$VALUE + $...A,...) - pattern: $REQUEST.$METHOD(`${$REQ. ... .$VALUE}...`,...) - pattern: $REQ. ... .$VALUE - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|patch|del|head|delete)$ - patterns: - pattern-either: - pattern-inside: | $REQUEST = require('request') ... - pattern-inside: | import * as $REQUEST from 'request' ... - pattern-inside: | import $REQUEST from 'request' ... - pattern-either: - pattern: $REQUEST.$METHOD($REQ.$VALUE['...'],...) - pattern: $REQUEST.$METHOD($REQ.$VALUE['...'] + $...A,...) - pattern: $REQUEST.$METHOD(`${$REQ.$VALUE['...']}...`,...) - pattern: $REQ.$VALUE - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|patch|del|head|delete)$ - patterns: - pattern-either: - pattern-inside: | $REQUEST = require('request') ... - pattern-inside: | import * as $REQUEST from 'request' ... - pattern-inside: | import $REQUEST from 'request' ... - pattern-either: - pattern-inside: | $ASSIGN = $REQ. ... .$VALUE ... - pattern-inside: | $ASSIGN = $REQ. ... .$VALUE['...'] ... - pattern-inside: | $ASSIGN = $REQ. ... .$VALUE + $...A ... - pattern-inside: "$ASSIGN = $REQ. ... .$VALUE['...'] + $...A\n... \n" - pattern-inside: | $ASSIGN = `${$REQ. ... .$VALUE}...` ... - pattern-inside: "$ASSIGN = `${$REQ. ... .$VALUE['...']}...`\n... \n" - patterns: - pattern-either: - pattern-inside: | $ASSIGN = "$HTTP"+ $REQ. ... .$VALUE ... - pattern-inside: | $ASSIGN = "$HTTP"+$REQ. ... .$VALUE + $...A ... - pattern-inside: | $ASSIGN = "$HTTP"+$REQ.$VALUE[...] ... - pattern-inside: | $ASSIGN = "$HTTP"+$REQ.$VALUE[...] + $...A ... - pattern-inside: | $ASSIGN = `$HTTP${$REQ.$VALUE[...]}...` ... - metavariable-regex: metavariable: $HTTP regex: ^(https?:\/\/|//)$ - pattern-either: - pattern: $REQUEST.$METHOD($ASSIGN,...) - pattern: $REQUEST.$METHOD($ASSIGN + $...FOO,...) - pattern: $REQUEST.$METHOD(`${$ASSIGN}...`,...) - patterns: - pattern-either: - pattern: $REQUEST.$METHOD("$HTTP"+$ASSIGN,...) - pattern: $REQUEST.$METHOD("$HTTP"+$ASSIGN + $...A,...) - pattern: $REQUEST.$METHOD(`$HTTP${$ASSIGN}...`,...) - metavariable-regex: metavariable: $HTTP regex: ^(https?:\/\/|//)$ - pattern: $ASSIGN - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|patch|del|head|delete)$ - id: go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage message: Detected usage of dangerous method $METHOD which does not escape inputs (see link in references). If the argument is user-controlled, this can lead to SQL injection. When using $METHOD function, do not trust user-submitted data and only allow approved list of input (possibly, use an allowlist approach). severity: WARNING languages: - go mode: taint pattern-sources: - patterns: - pattern-either: - pattern: | ($REQUEST : http.Request).$ANYTHING - pattern: | ($REQUEST : *http.Request).$ANYTHING - metavariable-regex: metavariable: $ANYTHING regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$ pattern-sinks: - patterns: - pattern-inside: | import ("gorm.io/gorm") ... - patterns: - pattern-inside: | func $VAL(..., $GORM *gorm.DB,... ) { ... } - pattern-either: - pattern: | $GORM. ... .$METHOD($VALUE) - pattern: | $DB := $GORM. ... .$ANYTHING(...) ... $DB. ... .$METHOD($VALUE) - focus-metavariable: $VALUE - metavariable-regex: metavariable: $METHOD regex: ^(Order|Exec|Raw|Group|Having|Distinct|Select|Pluck)$ pattern-sanitizers: - pattern-either: - pattern: strconv.Atoi(...) - pattern: | ($X: bool) options: interfile: true metadata: category: security technology: - gorm cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://gorm.io/docs/security.html#SQL-injection-Methods - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html confidence: HIGH cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM interfile: true license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage shortlink: https://sg.run/R4qg semgrep.dev: rule: r_id: 24693 rv_id: 1262915 rule_id: AbU5o3 version_id: l4TJRJK url: https://semgrep.dev/playground/r/l4TJRJK/go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage origin: community - id: csharp.dotnet.security.audit.missing-or-broken-authorization.missing-or-broken-authorization message: Anonymous access shouldn't be allowed unless explicit by design. Access control checks are missing and potentially can be bypassed. This finding violates the principle of least privilege or deny by default, where access should only be permitted for a specific set of roles or conforms to a custom policy or users. severity: INFO metadata: likelihood: LOW impact: MEDIUM confidence: MEDIUM category: security cwe: - 'CWE-862: Missing Authorization' cwe2021-top25: true cwe2022-top25: true cwe2023-top25: true owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - https://cwe.mitre.org/data/definitions/862.html - https://docs.microsoft.com/en-us/aspnet/core/security/authorization/simple?view=aspnetcore-7.0 subcategory: - vuln technology: - .net - mvc license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authorization source: https://semgrep.dev/r/csharp.dotnet.security.audit.missing-or-broken-authorization.missing-or-broken-authorization shortlink: https://sg.run/Z8GA semgrep.dev: rule: r_id: 26335 rv_id: 1262615 rule_id: eqU32Y version_id: o5TbD41 url: https://semgrep.dev/playground/r/o5TbD41/csharp.dotnet.security.audit.missing-or-broken-authorization.missing-or-broken-authorization origin: community languages: - csharp patterns: - pattern: | public class $CLASS : Controller { ... } - pattern-inside: | using Microsoft.AspNetCore.Mvc; ... - pattern-not: | [AllowAnonymous] public class $CLASS : Controller { ... } - pattern-not: | [Authorize] public class $CLASS : Controller { ... } - pattern-not: | [Authorize(Roles = ...)] public class $CLASS : Controller { ... } - pattern-not: | [Authorize(Policy = ...)] public class $CLASS : Controller { ... } - id: python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args mode: taint options: symbolic_propagation: true pattern-sources: - patterns: - pattern-either: - patterns: - pattern-either: - pattern: os.environ - pattern: os.environ.get('$FOO', ...) - pattern: os.environb - pattern: os.environb.get('$FOO', ...) - pattern: os.getenv('$ANYTHING', ...) - pattern: os.getenvb('$ANYTHING', ...) - patterns: - pattern-either: - patterns: - pattern-either: - pattern: sys.argv - pattern: sys.orig_argv - patterns: - pattern-inside: | $PARSER = argparse.ArgumentParser(...) ... - pattern-inside: | $ARGS = $PARSER.parse_args() - pattern: <... $ARGS ...> - patterns: - pattern-inside: | $PARSER = optparse.OptionParser(...) ... - pattern-inside: | $ARGS = $PARSER.parse_args() - pattern: <... $ARGS ...> - patterns: - pattern-either: - pattern-inside: | $OPTS, $ARGS = getopt.getopt(...) ... - pattern-inside: | $OPTS, $ARGS = getopt.gnu_getopt(...) ... - pattern-either: - patterns: - pattern-inside: | for $O, $A in $OPTS: ... - pattern: $A - pattern: $ARGS pattern-sinks: - pattern-either: - patterns: - pattern-not: $LOOP.subprocess_exec($PROTOCOL, "...", ...) - pattern-not: $LOOP.subprocess_exec($PROTOCOL, ["...",...], ...) - pattern: $LOOP.subprocess_exec(...) - patterns: - pattern-not: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", "...", ...) - pattern: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c",...) - patterns: - pattern-not: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", "...", ...], ...) - pattern: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", ...], ...) message: Detected subprocess function '$LOOP.subprocess_exec' with user controlled data. You may consider using 'shlex.escape()'. metadata: owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.8 OS Command Injection control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements version: '4' references: - https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec - https://docs.python.org/3/library/shlex.html - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ category: security technology: - python confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args shortlink: https://sg.run/Apjp semgrep.dev: rule: r_id: 27250 rv_id: 1263460 rule_id: 7KUE1E version_id: WrTqKXz url: https://semgrep.dev/playground/r/WrTqKXz/python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args origin: community languages: - python severity: ERROR - id: python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args mode: taint options: symbolic_propagation: true pattern-sources: - patterns: - pattern-either: - patterns: - pattern-either: - pattern: os.environ - pattern: os.environ.get('$FOO', ...) - pattern: os.environb - pattern: os.environb.get('$FOO', ...) - pattern: os.getenv('$ANYTHING', ...) - pattern: os.getenvb('$ANYTHING', ...) - patterns: - pattern-either: - patterns: - pattern-either: - pattern: sys.argv - pattern: sys.orig_argv - patterns: - pattern-inside: | $PARSER = argparse.ArgumentParser(...) ... - pattern-inside: | $ARGS = $PARSER.parse_args() - pattern: <... $ARGS ...> - patterns: - pattern-inside: | $PARSER = optparse.OptionParser(...) ... - pattern-inside: | $ARGS = $PARSER.parse_args() - pattern: <... $ARGS ...> - patterns: - pattern-either: - pattern-inside: | $OPTS, $ARGS = getopt.getopt(...) ... - pattern-inside: | $OPTS, $ARGS = getopt.gnu_getopt(...) ... - pattern-either: - patterns: - pattern-inside: | for $O, $A in $OPTS: ... - pattern: $A - pattern: $ARGS pattern-sinks: - patterns: - pattern-either: - pattern-inside: $LOOP.subprocess_shell($PROTOCOL, $CMD) - pattern-inside: asyncio.subprocess.create_subprocess_shell($CMD, ...) - pattern-inside: asyncio.create_subprocess_shell($CMD, ...) - focus-metavariable: $CMD - pattern-not-inside: | $CMD = "..." ... - pattern-not: $LOOP.subprocess_shell($PROTOCOL, "...") - pattern-not: asyncio.subprocess.create_subprocess_shell("...", ...) - pattern-not: asyncio.create_subprocess_shell("...", ...) message: Detected asyncio subprocess function with user controlled data. You may consider using 'shlex.escape()'. metadata: owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.8 OS Command Injection control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements version: '4' references: - https://docs.python.org/3/library/asyncio-subprocess.html - https://docs.python.org/3/library/shlex.html - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ category: security technology: - python confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args shortlink: https://sg.run/Dx8Y semgrep.dev: rule: r_id: 27252 rv_id: 1263462 rule_id: 8GU5q3 version_id: K3TKkDn url: https://semgrep.dev/playground/r/K3TKkDn/python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args origin: community languages: - python severity: ERROR - id: python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args mode: taint options: symbolic_propagation: true pattern-sources: - patterns: - pattern-either: - patterns: - pattern-either: - pattern: os.environ - pattern: os.environ.get('$FOO', ...) - pattern: os.environb - pattern: os.environb.get('$FOO', ...) - pattern: os.getenv('$ANYTHING', ...) - pattern: os.getenvb('$ANYTHING', ...) - patterns: - pattern-either: - patterns: - pattern-either: - pattern: sys.argv - pattern: sys.orig_argv - patterns: - pattern-inside: | $PARSER = argparse.ArgumentParser(...) ... - pattern-inside: | $ARGS = $PARSER.parse_args() - pattern: <... $ARGS ...> - patterns: - pattern-inside: | $PARSER = optparse.OptionParser(...) ... - pattern-inside: | $ARGS = $PARSER.parse_args() - pattern: <... $ARGS ...> - patterns: - pattern-either: - pattern-inside: | $OPTS, $ARGS = getopt.getopt(...) ... - pattern-inside: | $OPTS, $ARGS = getopt.gnu_getopt(...) ... - pattern-either: - patterns: - pattern-inside: | for $O, $A in $OPTS: ... - pattern: $A - pattern: $ARGS pattern-sinks: - patterns: - pattern-either: - patterns: - pattern-not: os.$METHOD("...", ...) - pattern: os.$METHOD(...) - metavariable-regex: metavariable: $METHOD regex: (execl|execle|execlp|execlpe|execv|execve|execvp|execvpe) - patterns: - pattern-not: os.$METHOD("...", [$PATH,"...","...",...],...) - pattern-inside: os.$METHOD($BASH,[$PATH,"-c",$CMD,...],...) - pattern: $CMD - metavariable-regex: metavariable: $METHOD regex: (execv|execve|execvp|execvpe) - metavariable-regex: metavariable: $BASH regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) - patterns: - pattern-not: os.$METHOD("...", $PATH, "...", "...",...) - pattern-inside: os.$METHOD($BASH, $PATH, "-c", $CMD,...) - pattern: $CMD - metavariable-regex: metavariable: $METHOD regex: (execl|execle|execlp|execlpe) - metavariable-regex: metavariable: $BASH regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. metadata: cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.8 OS Command Injection control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements version: '4' confidence: MEDIUM category: security technology: - python cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args shortlink: https://sg.run/qL6z semgrep.dev: rule: r_id: 27256 rv_id: 1263466 rule_id: 4bUEAY version_id: 6xT29l6 url: https://semgrep.dev/playground/r/6xT29l6/python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args origin: community languages: - python severity: ERROR - id: python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args mode: taint options: symbolic_propagation: true pattern-sources: - patterns: - pattern-either: - patterns: - pattern-either: - pattern: os.environ - pattern: os.environ.get('$FOO', ...) - pattern: os.environb - pattern: os.environb.get('$FOO', ...) - pattern: os.getenv('$ANYTHING', ...) - pattern: os.getenvb('$ANYTHING', ...) - patterns: - pattern-either: - patterns: - pattern-either: - pattern: sys.argv - pattern: sys.orig_argv - patterns: - pattern-inside: | $PARSER = argparse.ArgumentParser(...) ... - pattern-inside: | $ARGS = $PARSER.parse_args() - pattern: <... $ARGS ...> - patterns: - pattern-inside: | $PARSER = optparse.OptionParser(...) ... - pattern-inside: | $ARGS = $PARSER.parse_args() - pattern: <... $ARGS ...> - patterns: - pattern-either: - pattern-inside: | $OPTS, $ARGS = getopt.getopt(...) ... - pattern-inside: | $OPTS, $ARGS = getopt.gnu_getopt(...) ... - pattern-either: - patterns: - pattern-inside: | for $O, $A in $OPTS: ... - pattern: $A - pattern: $ARGS pattern-sinks: - patterns: - pattern-either: - patterns: - pattern-not: os.$METHOD($MODE, "...", ...) - pattern-inside: os.$METHOD($MODE, $CMD, ...) - pattern: $CMD - metavariable-regex: metavariable: $METHOD regex: (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile) - patterns: - pattern-not: os.$METHOD($MODE, "...", ["...","...",...], ...) - pattern-inside: os.$METHOD($MODE, $BASH, ["-c",$CMD,...],...) - pattern: $CMD - metavariable-regex: metavariable: $METHOD regex: (spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp) - metavariable-regex: metavariable: $BASH regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) - patterns: - pattern-not: os.$METHOD($MODE, "...", "...", "...", ...) - pattern-inside: os.$METHOD($MODE, $BASH, "-c", $CMD,...) - pattern: $CMD - metavariable-regex: metavariable: $METHOD regex: (spawnl|spawnle|spawnlp|spawnlpe) - metavariable-regex: metavariable: $BASH regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. metadata: source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.8 OS Command Injection control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements version: '4' category: security technology: - python confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args shortlink: https://sg.run/Y3Ke semgrep.dev: rule: r_id: 27258 rv_id: 1263468 rule_id: JDUz34 version_id: zyTb2wn url: https://semgrep.dev/playground/r/zyTb2wn/python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args origin: community languages: - python severity: ERROR - id: python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args mode: taint options: symbolic_propagation: true pattern-sanitizers: - pattern: shlex.quote(...) pattern-sources: - patterns: - pattern-either: - patterns: - pattern-either: - pattern: os.environ - pattern: os.environ.get('$FOO', ...) - pattern: os.environb - pattern: os.environb.get('$FOO', ...) - pattern: os.getenv('$ANYTHING', ...) - pattern: os.getenvb('$ANYTHING', ...) - patterns: - pattern-either: - patterns: - pattern-either: - pattern: sys.argv - pattern: sys.orig_argv - patterns: - pattern-inside: | $PARSER = argparse.ArgumentParser(...) ... - pattern-inside: | $ARGS = $PARSER.parse_args() - pattern: <... $ARGS ...> - patterns: - pattern-inside: | $PARSER = optparse.OptionParser(...) ... - pattern-inside: | $ARGS = $PARSER.parse_args() - pattern: <... $ARGS ...> - patterns: - pattern-either: - pattern-inside: | $OPTS, $ARGS = getopt.getopt(...) ... - pattern-inside: | $OPTS, $ARGS = getopt.gnu_getopt(...) ... - pattern-either: - patterns: - pattern-inside: | for $O, $A in $OPTS: ... - pattern: $A - pattern: $ARGS pattern-sinks: - patterns: - pattern-either: - patterns: - pattern-not: subprocess.$FUNC("...", ...) - pattern-not: subprocess.$FUNC(["...",...], ...) - pattern-not: subprocess.$FUNC(("...",...), ...) - pattern-not: subprocess.CalledProcessError(...) - pattern-not: subprocess.SubprocessError(...) - pattern: subprocess.$FUNC($CMD, ...) - patterns: - pattern-not: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...) - pattern: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD) - patterns: - pattern-not: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...],...) - pattern-not: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...),...) - pattern-either: - pattern: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD], ...) - pattern: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD), ...) - patterns: - pattern-not: subprocess.$FUNC("=~/(python)/","...",...) - pattern: subprocess.$FUNC("=~/(python)/", $CMD) - patterns: - pattern-not: subprocess.$FUNC(["=~/(python)/","...",...],...) - pattern-not: subprocess.$FUNC(("=~/(python)/","...",...),...) - pattern-either: - pattern: subprocess.$FUNC(["=~/(python)/", $CMD],...) - pattern: subprocess.$FUNC(("=~/(python)/", $CMD),...) - focus-metavariable: $CMD message: Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. metadata: owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.8 OS Command Injection control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements version: '4' references: - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess - https://docs.python.org/3/library/subprocess.html - https://docs.python.org/3/library/shlex.html - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ category: security technology: - python confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args shortlink: https://sg.run/pLGg semgrep.dev: rule: r_id: 27262 rv_id: 1263472 rule_id: AbUgrZ version_id: jQTn54Y url: https://semgrep.dev/playground/r/jQTn54Y/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args origin: community languages: - python severity: ERROR - id: python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args mode: taint options: symbolic_propagation: true pattern-sources: - patterns: - pattern-either: - patterns: - pattern-either: - pattern: os.environ - pattern: os.environ.get('$FOO', ...) - pattern: os.environb - pattern: os.environb.get('$FOO', ...) - pattern: os.getenv('$ANYTHING', ...) - pattern: os.getenvb('$ANYTHING', ...) - patterns: - pattern-either: - patterns: - pattern-either: - pattern: sys.argv - pattern: sys.orig_argv - patterns: - pattern-inside: | $PARSER = argparse.ArgumentParser(...) ... - pattern-inside: | $ARGS = $PARSER.parse_args() - pattern: <... $ARGS ...> - patterns: - pattern-inside: | $PARSER = optparse.OptionParser(...) ... - pattern-inside: | $ARGS = $PARSER.parse_args() - pattern: <... $ARGS ...> - patterns: - pattern-either: - pattern-inside: | $OPTS, $ARGS = getopt.getopt(...) ... - pattern-inside: | $OPTS, $ARGS = getopt.gnu_getopt(...) ... - pattern-either: - patterns: - pattern-inside: | for $O, $A in $OPTS: ... - pattern: $A - pattern: $ARGS pattern-sinks: - patterns: - pattern-not: os.$W("...", ...) - pattern-either: - pattern: os.system(...) - pattern: | $X = __import__("os") ... $X.system(...) - pattern: | $X = __import__("os") ... getattr($X, "system")(...) - pattern: | $X = getattr(os, "system") ... $X(...) - pattern: | $X = __import__("os") ... $Y = getattr($X, "system") ... $Y(...) - pattern: os.popen(...) - pattern: os.popen2(...) - pattern: os.popen3(...) - pattern: os.popen4(...) message: Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. metadata: source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.2.4 Dyanmic Code Execution Features control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements version: '4' category: security technology: - python confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args shortlink: https://sg.run/XR2K semgrep.dev: rule: r_id: 27264 rv_id: 1263474 rule_id: DbUR9g version_id: 9lT4bG4 url: https://semgrep.dev/playground/r/9lT4bG4/python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args origin: community languages: - python severity: ERROR - id: python.lang.security.dangerous-os-exec.dangerous-os-exec mode: taint options: symbolic_propagation: true pattern-sources: - patterns: - pattern-either: - patterns: - pattern-either: - pattern: flask.request.form.get(...) - pattern: flask.request.form[...] - pattern: flask.request.args.get(...) - pattern: flask.request.args[...] - pattern: flask.request.values.get(...) - pattern: flask.request.values[...] - pattern: flask.request.cookies.get(...) - pattern: flask.request.cookies[...] - pattern: flask.request.stream - pattern: flask.request.headers.get(...) - pattern: flask.request.headers[...] - pattern: flask.request.data - pattern: flask.request.full_path - pattern: flask.request.url - pattern: flask.request.json - pattern: flask.request.get_json() - pattern: flask.request.view_args.get(...) - pattern: flask.request.view_args[...] - patterns: - pattern-inside: | @$APP.route(...) def $FUNC(..., $ROUTEVAR, ...): ... - focus-metavariable: $ROUTEVAR - patterns: - pattern-inside: | def $FUNC(request, ...): ... - pattern-either: - pattern: request.$PROPERTY.get(...) - pattern: request.$PROPERTY[...] - patterns: - pattern-either: - pattern-inside: | @rest_framework.decorators.api_view(...) def $FUNC($REQ, ...): ... - patterns: - pattern-either: - pattern-inside: | class $VIEW(..., rest_framework.views.APIView, ...): ... - pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n ... \n" - pattern-inside: | def $METHOD(self, $REQ, ...): ... - metavariable-regex: metavariable: $METHOD regex: (get|post|put|patch|delete|head) - pattern-either: - pattern: $REQ.POST.get(...) - pattern: $REQ.POST[...] - pattern: $REQ.FILES.get(...) - pattern: $REQ.FILES[...] - pattern: $REQ.DATA.get(...) - pattern: $REQ.DATA[...] - pattern: $REQ.QUERY_PARAMS.get(...) - pattern: $REQ.QUERY_PARAMS[...] - pattern: $REQ.data.get(...) - pattern: $REQ.data[...] - pattern: $REQ.query_params.get(...) - pattern: $REQ.query_params[...] - pattern: $REQ.content_type - pattern: $REQ.content_type - pattern: $REQ.stream - pattern: $REQ.stream - patterns: - pattern-either: - pattern-inside: | class $SERVER(..., http.server.BaseHTTPRequestHandler, ...): ... - pattern-inside: | class $SERVER(..., http.server.StreamRequestHandler, ...): ... - pattern-inside: | class $SERVER(..., http.server.DatagramRequestHandler, ...): ... - pattern-either: - pattern: self.requestline - pattern: self.path - pattern: self.headers[...] - pattern: self.headers.get(...) - pattern: self.rfile - patterns: - pattern-inside: | @pyramid.view.view_config( ... ) def $VIEW($REQ): ... - pattern: $REQ.$ANYTHING - pattern-not: $REQ.dbsession pattern-sinks: - patterns: - pattern-either: - patterns: - pattern-not: os.$METHOD("...", ...) - pattern: os.$METHOD(...) - metavariable-regex: metavariable: $METHOD regex: (execl|execle|execlp|execlpe|execv|execve|execvp|execvpe) - patterns: - pattern-not: os.$METHOD("...", [$PATH,"...","...",...],...) - pattern-inside: os.$METHOD($BASH,[$PATH,"-c",$CMD,...],...) - pattern: $CMD - metavariable-regex: metavariable: $METHOD regex: (execv|execve|execvp|execvpe) - metavariable-regex: metavariable: $BASH regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) - patterns: - pattern-not: os.$METHOD("...", $PATH, "...", "...",...) - pattern-inside: os.$METHOD($BASH, $PATH, "-c", $CMD,...) - pattern: $CMD - metavariable-regex: metavariable: $METHOD regex: (execl|execle|execlp|execlpe) - metavariable-regex: metavariable: $BASH regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. metadata: cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.8 OS Command Injection control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements version: '4' confidence: MEDIUM category: security technology: - python cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.lang.security.dangerous-os-exec.dangerous-os-exec shortlink: https://sg.run/yL9x semgrep.dev: rule: r_id: 27268 rv_id: 1263523 rule_id: qNUR13 version_id: 6xT29rz url: https://semgrep.dev/playground/r/6xT29rz/python.lang.security.dangerous-os-exec.dangerous-os-exec origin: community languages: - python severity: ERROR - id: python.lang.security.dangerous-spawn-process.dangerous-spawn-process mode: taint options: symbolic_propagation: true pattern-sources: - patterns: - pattern-either: - patterns: - pattern-either: - pattern: flask.request.form.get(...) - pattern: flask.request.form[...] - pattern: flask.request.args.get(...) - pattern: flask.request.args[...] - pattern: flask.request.values.get(...) - pattern: flask.request.values[...] - pattern: flask.request.cookies.get(...) - pattern: flask.request.cookies[...] - pattern: flask.request.stream - pattern: flask.request.headers.get(...) - pattern: flask.request.headers[...] - pattern: flask.request.data - pattern: flask.request.full_path - pattern: flask.request.url - pattern: flask.request.json - pattern: flask.request.get_json() - pattern: flask.request.view_args.get(...) - pattern: flask.request.view_args[...] - patterns: - pattern-inside: | @$APP.route(...) def $FUNC(..., $ROUTEVAR, ...): ... - pattern: $ROUTEVAR - patterns: - pattern-inside: | def $FUNC(request, ...): ... - pattern-either: - pattern: request.$PROPERTY.get(...) - pattern: request.$PROPERTY[...] - patterns: - pattern-either: - pattern-inside: | @rest_framework.decorators.api_view(...) def $FUNC($REQ, ...): ... - patterns: - pattern-either: - pattern-inside: | class $VIEW(..., rest_framework.views.APIView, ...): ... - pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n ... \n" - pattern-inside: | def $METHOD(self, $REQ, ...): ... - metavariable-regex: metavariable: $METHOD regex: (get|post|put|patch|delete|head) - pattern-either: - pattern: $REQ.POST.get(...) - pattern: $REQ.POST[...] - pattern: $REQ.FILES.get(...) - pattern: $REQ.FILES[...] - pattern: $REQ.DATA.get(...) - pattern: $REQ.DATA[...] - pattern: $REQ.QUERY_PARAMS.get(...) - pattern: $REQ.QUERY_PARAMS[...] - pattern: $REQ.data.get(...) - pattern: $REQ.data[...] - pattern: $REQ.query_params.get(...) - pattern: $REQ.query_params[...] - pattern: $REQ.content_type - pattern: $REQ.content_type - pattern: $REQ.stream - pattern: $REQ.stream - patterns: - pattern-either: - pattern-inside: | class $SERVER(..., http.server.BaseHTTPRequestHandler, ...): ... - pattern-inside: | class $SERVER(..., http.server.StreamRequestHandler, ...): ... - pattern-inside: | class $SERVER(..., http.server.DatagramRequestHandler, ...): ... - pattern-either: - pattern: self.requestline - pattern: self.path - pattern: self.headers[...] - pattern: self.headers.get(...) - pattern: self.rfile - patterns: - pattern-inside: | @pyramid.view.view_config( ... ) def $VIEW($REQ): ... - pattern: $REQ.$ANYTHING - pattern-not: $REQ.dbsession - patterns: - pattern-either: - pattern: os.environ['$ANYTHING'] - pattern: os.environ.get('$FOO', ...) - pattern: os.environb['$ANYTHING'] - pattern: os.environb.get('$FOO', ...) - pattern: os.getenv('$ANYTHING', ...) - pattern: os.getenvb('$ANYTHING', ...) - patterns: - pattern-either: - patterns: - pattern-either: - pattern: sys.argv[...] - pattern: sys.orig_argv[...] - patterns: - pattern-inside: | $PARSER = argparse.ArgumentParser(...) ... - pattern-inside: | $ARGS = $PARSER.parse_args() - pattern: <... $ARGS ...> - patterns: - pattern-inside: | $PARSER = optparse.OptionParser(...) ... - pattern-inside: | $ARGS = $PARSER.parse_args() - pattern: <... $ARGS ...> - patterns: - pattern-either: - pattern-inside: | $OPTS, $ARGS = getopt.getopt(...) ... - pattern-inside: | $OPTS, $ARGS = getopt.gnu_getopt(...) ... - pattern-either: - patterns: - pattern-inside: | for $O, $A in $OPTS: ... - pattern: $A - pattern: $ARGS pattern-sinks: - patterns: - pattern-either: - patterns: - pattern-not: os.$METHOD($MODE, "...", ...) - pattern-inside: os.$METHOD($MODE, $CMD, ...) - pattern: $CMD - metavariable-regex: metavariable: $METHOD regex: (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile) - patterns: - pattern-not: os.$METHOD($MODE, "...", ["...","...",...], ...) - pattern-inside: os.$METHOD($MODE, $BASH, ["-c",$CMD,...],...) - pattern: $CMD - metavariable-regex: metavariable: $METHOD regex: (spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp) - metavariable-regex: metavariable: $BASH regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) - patterns: - pattern-not: os.$METHOD($MODE, "...", "...", "...", ...) - pattern-inside: os.$METHOD($MODE, $BASH, "-c", $CMD,...) - pattern: $CMD - metavariable-regex: metavariable: $METHOD regex: (spawnl|spawnle|spawnlp|spawnlpe) - metavariable-regex: metavariable: $BASH regex: (.*)(sh|bash|ksh|csh|tcsh|zsh) message: Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands. metadata: source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.8 OS Command Injection control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements version: '4' category: security technology: - python confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.lang.security.dangerous-spawn-process.dangerous-spawn-process shortlink: https://sg.run/r8Zn semgrep.dev: rule: r_id: 27269 rv_id: 1263524 rule_id: lBUJrn version_id: o5TbDO5 url: https://semgrep.dev/playground/r/o5TbDO5/python.lang.security.dangerous-spawn-process.dangerous-spawn-process origin: community languages: - python severity: ERROR - id: python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use mode: taint options: symbolic_propagation: true pattern-sources: - patterns: - pattern-either: - patterns: - pattern-either: - pattern: flask.request.form.get(...) - pattern: flask.request.form[...] - pattern: flask.request.args.get(...) - pattern: flask.request.args[...] - pattern: flask.request.values.get(...) - pattern: flask.request.values[...] - pattern: flask.request.cookies.get(...) - pattern: flask.request.cookies[...] - pattern: flask.request.stream - pattern: flask.request.headers.get(...) - pattern: flask.request.headers[...] - pattern: flask.request.data - pattern: flask.request.full_path - pattern: flask.request.url - pattern: flask.request.json - pattern: flask.request.get_json() - pattern: flask.request.view_args.get(...) - pattern: flask.request.view_args[...] - patterns: - pattern-inside: | @$APP.route(...) def $FUNC(..., $ROUTEVAR, ...): ... - focus-metavariable: $ROUTEVAR - patterns: - pattern-inside: | def $FUNC(request, ...): ... - pattern-either: - pattern: request.$PROPERTY.get(...) - pattern: request.$PROPERTY[...] - patterns: - pattern-either: - pattern-inside: | @rest_framework.decorators.api_view(...) def $FUNC($REQ, ...): ... - patterns: - pattern-either: - pattern-inside: | class $VIEW(..., rest_framework.views.APIView, ...): ... - pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n ... \n" - pattern-inside: | def $METHOD(self, $REQ, ...): ... - metavariable-regex: metavariable: $METHOD regex: (get|post|put|patch|delete|head) - pattern-either: - pattern: $REQ.POST.get(...) - pattern: $REQ.POST[...] - pattern: $REQ.FILES.get(...) - pattern: $REQ.FILES[...] - pattern: $REQ.DATA.get(...) - pattern: $REQ.DATA[...] - pattern: $REQ.QUERY_PARAMS.get(...) - pattern: $REQ.QUERY_PARAMS[...] - pattern: $REQ.data.get(...) - pattern: $REQ.data[...] - pattern: $REQ.query_params.get(...) - pattern: $REQ.query_params[...] - pattern: $REQ.content_type - pattern: $REQ.content_type - pattern: $REQ.stream - pattern: $REQ.stream - patterns: - pattern-either: - pattern-inside: | class $SERVER(..., http.server.BaseHTTPRequestHandler, ...): ... - pattern-inside: | class $SERVER(..., http.server.StreamRequestHandler, ...): ... - pattern-inside: | class $SERVER(..., http.server.DatagramRequestHandler, ...): ... - pattern-either: - pattern: self.requestline - pattern: self.path - pattern: self.headers[...] - pattern: self.headers.get(...) - pattern: self.rfile - patterns: - pattern-inside: | @pyramid.view.view_config( ... ) def $VIEW($REQ): ... - pattern: $REQ.$ANYTHING - pattern-not: $REQ.dbsession pattern-sinks: - patterns: - pattern-either: - patterns: - pattern-not: subprocess.$FUNC("...", ...) - pattern-not: subprocess.$FUNC(["...",...], ...) - pattern-not: subprocess.$FUNC(("...",...), ...) - pattern-not: subprocess.CalledProcessError(...) - pattern-not: subprocess.SubprocessError(...) - pattern: subprocess.$FUNC($CMD, ...) - patterns: - pattern-not: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...) - pattern: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD) - patterns: - pattern-not: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...],...) - pattern-not: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...),...) - pattern-either: - pattern: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD], ...) - pattern: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD), ...) - patterns: - pattern-not: subprocess.$FUNC("=~/(python)/","...",...) - pattern: subprocess.$FUNC("=~/(python)/", $CMD) - patterns: - pattern-not: subprocess.$FUNC(["=~/(python)/","...",...],...) - pattern-not: subprocess.$FUNC(("=~/(python)/","...",...),...) - pattern-either: - pattern: subprocess.$FUNC(["=~/(python)/", $CMD],...) - pattern: subprocess.$FUNC(("=~/(python)/", $CMD),...) - focus-metavariable: $CMD message: Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'. metadata: owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.8 OS Command Injection control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements version: '4' references: - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess - https://docs.python.org/3/library/subprocess.html - https://docs.python.org/3/library/shlex.html - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ category: security technology: - python confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use shortlink: https://sg.run/NWxp semgrep.dev: rule: r_id: 27271 rv_id: 1263526 rule_id: JDUz3R version_id: pZT038J url: https://semgrep.dev/playground/r/pZT038J/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use origin: community languages: - python severity: ERROR - id: python.lang.security.dangerous-system-call.dangerous-system-call mode: taint options: symbolic_propagation: true pattern-sources: - patterns: - pattern-either: - patterns: - pattern-either: - pattern: flask.request.form.get(...) - pattern: flask.request.form[...] - pattern: flask.request.args.get(...) - pattern: flask.request.args[...] - pattern: flask.request.values.get(...) - pattern: flask.request.values[...] - pattern: flask.request.cookies.get(...) - pattern: flask.request.cookies[...] - pattern: flask.request.stream - pattern: flask.request.headers.get(...) - pattern: flask.request.headers[...] - pattern: flask.request.data - pattern: flask.request.full_path - pattern: flask.request.url - pattern: flask.request.json - pattern: flask.request.get_json() - pattern: flask.request.view_args.get(...) - pattern: flask.request.view_args[...] - patterns: - pattern-inside: | @$APP.route(...) def $FUNC(..., $ROUTEVAR, ...): ... - focus-metavariable: $ROUTEVAR - patterns: - pattern-inside: | def $FUNC(request, ...): ... - pattern-either: - pattern: request.$PROPERTY.get(...) - pattern: request.$PROPERTY[...] - patterns: - pattern-either: - pattern-inside: | @rest_framework.decorators.api_view(...) def $FUNC($REQ, ...): ... - patterns: - pattern-either: - pattern-inside: | class $VIEW(..., rest_framework.views.APIView, ...): ... - pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n ... \n" - pattern-inside: | def $METHOD(self, $REQ, ...): ... - metavariable-regex: metavariable: $METHOD regex: (get|post|put|patch|delete|head) - pattern-either: - pattern: $REQ.POST.get(...) - pattern: $REQ.POST[...] - pattern: $REQ.FILES.get(...) - pattern: $REQ.FILES[...] - pattern: $REQ.DATA.get(...) - pattern: $REQ.DATA[...] - pattern: $REQ.QUERY_PARAMS.get(...) - pattern: $REQ.QUERY_PARAMS[...] - pattern: $REQ.data.get(...) - pattern: $REQ.data[...] - pattern: $REQ.query_params.get(...) - pattern: $REQ.query_params[...] - pattern: $REQ.content_type - pattern: $REQ.content_type - pattern: $REQ.stream - pattern: $REQ.stream - patterns: - pattern-either: - pattern-inside: | class $SERVER(..., http.server.BaseHTTPRequestHandler, ...): ... - pattern-inside: | class $SERVER(..., http.server.StreamRequestHandler, ...): ... - pattern-inside: | class $SERVER(..., http.server.DatagramRequestHandler, ...): ... - pattern-either: - pattern: self.requestline - pattern: self.path - pattern: self.headers[...] - pattern: self.headers.get(...) - pattern: self.rfile - patterns: - pattern-inside: | @pyramid.view.view_config( ... ) def $VIEW($REQ): ... - pattern: $REQ.$ANYTHING - pattern-not: $REQ.dbsession pattern-sinks: - patterns: - pattern-not: os.$W("...", ...) - pattern-either: - pattern: os.system(...) - pattern: getattr(os, "system")(...) - pattern: __import__("os").system(...) - pattern: getattr(__import__("os"), "system")(...) - pattern: | $X = __import__("os") ... $X.system(...) - pattern: | $X = __import__("os") ... getattr($X, "system")(...) - pattern: | $X = getattr(os, "system") ... $X(...) - pattern: | $X = __import__("os") ... $Y = getattr($X, "system") ... $Y(...) - pattern: os.popen(...) - pattern: os.popen2(...) - pattern: os.popen3(...) - pattern: os.popen4(...) message: Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. metadata: source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.2.4 Dyanmic Code Execution Features control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements version: '4' category: security technology: - python confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.lang.security.dangerous-system-call.dangerous-system-call shortlink: https://sg.run/k0W7 semgrep.dev: rule: r_id: 27272 rv_id: 1263527 rule_id: 5rUoP1 version_id: 2KTv2Zn url: https://semgrep.dev/playground/r/2KTv2Zn/python.lang.security.dangerous-system-call.dangerous-system-call origin: community languages: - python severity: ERROR - id: python.django.security.injection.command.subprocess-injection.subprocess-injection languages: - python mode: taint options: symbolic_propagation: true pattern-sources: - patterns: - pattern-inside: | def $FUNC(..., $REQUEST, ...): ... - focus-metavariable: $REQUEST - metavariable-pattern: metavariable: $REQUEST patterns: - pattern: request - pattern-not-inside: request.build_absolute_uri pattern-sinks: - patterns: - pattern-either: - patterns: - pattern: subprocess.$FUNC(...) - pattern-not: subprocess.$FUNC("...", ...) - pattern-not: subprocess.$FUNC(["...", ...], ...) - pattern-not-inside: | $CMD = ["...", ...] ... subprocess.$FUNC($CMD, ...) - patterns: - pattern: subprocess.$FUNC(["$SHELL", "-c", ...], ...) - metavariable-regex: metavariable: $SHELL regex: ^(sh|bash|ksh|csh|tcsh|zsh)$ - patterns: - pattern: subprocess.$FUNC(["$INTERPRETER", ...], ...) - metavariable-regex: metavariable: $INTERPRETER regex: ^(python|python\d)$ pattern-sanitizers: - patterns: - pattern: $DICT[$KEY] - focus-metavariable: $KEY severity: ERROR message: Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands. metadata: category: security technology: - flask owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' references: - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ confidence: HIGH cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection shortlink: https://sg.run/49BE semgrep.dev: rule: r_id: 31144 rv_id: 1263388 rule_id: EwUepx version_id: 7ZTE3qK url: https://semgrep.dev/playground/r/7ZTE3qK/python.django.security.injection.command.subprocess-injection.subprocess-injection origin: community - id: python.flask.security.injection.subprocess-injection.subprocess-injection languages: - python mode: taint options: symbolic_propagation: true pattern-sources: - pattern-either: - patterns: - pattern-either: - pattern: flask.request.form.get(...) - pattern: flask.request.form[...] - pattern: flask.request.args.get(...) - pattern: flask.request.args[...] - pattern: flask.request.values.get(...) - pattern: flask.request.values[...] - pattern: flask.request.cookies.get(...) - pattern: flask.request.cookies[...] - pattern: flask.request.stream - pattern: flask.request.headers.get(...) - pattern: flask.request.headers[...] - pattern: flask.request.data - pattern: flask.request.full_path - pattern: flask.request.url - pattern: flask.request.json - pattern: flask.request.get_json() - pattern: flask.request.view_args.get(...) - pattern: flask.request.view_args[...] - patterns: - pattern-inside: | @$APP.route($ROUTE, ...) def $FUNC(..., $ROUTEVAR, ...): ... - focus-metavariable: $ROUTEVAR pattern-sinks: - patterns: - pattern-either: - patterns: - pattern: subprocess.$FUNC(...) - pattern-not: subprocess.$FUNC("...", ...) - pattern-not: subprocess.$FUNC(["...", ...], ...) - pattern-not-inside: | $CMD = ["...", ...] ... subprocess.$FUNC($CMD, ...) - patterns: - pattern: subprocess.$FUNC(["$SHELL", "-c", ...], ...) - metavariable-regex: metavariable: $SHELL regex: ^(sh|bash|ksh|csh|tcsh|zsh)$ - patterns: - pattern: subprocess.$FUNC(["$INTERPRETER", ...], ...) - metavariable-regex: metavariable: $INTERPRETER regex: ^(python|python\d)$ pattern-sanitizers: - patterns: - pattern: $DICT[$KEY] - focus-metavariable: $KEY severity: ERROR message: Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands. metadata: category: security technology: - flask owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' references: - https://semgrep.dev/docs/cheat-sheets/python-command-injection/ confidence: HIGH cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection shortlink: https://sg.run/5gW3 semgrep.dev: rule: r_id: 31147 rv_id: 1263433 rule_id: 8GU3qp version_id: bZT53gQ url: https://semgrep.dev/playground/r/bZT53gQ/python.flask.security.injection.subprocess-injection.subprocess-injection origin: community - id: yaml.github-actions.security.github-script-injection.github-script-injection languages: - yaml message: 'Using variable interpolation `${{...}}` with `github` context data in a `actions/github-script`''s `script:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".' metadata: category: security cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections - https://securitylab.github.com/research/github-actions-untrusted-input/ - https://github.com/actions/github-script technology: - github-actions cwe2022-top25: true subcategory: - vuln likelihood: HIGH impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/yaml.github-actions.security.github-script-injection.github-script-injection shortlink: https://sg.run/g1G0 semgrep.dev: rule: r_id: 31441 rv_id: 1423394 rule_id: OrUQvK version_id: 5PT7Zyw url: https://semgrep.dev/playground/r/5PT7Zyw/yaml.github-actions.security.github-script-injection.github-script-injection origin: community patterns: - pattern-inside: 'steps: [...]' - pattern-inside: | uses: $ACTION ... - pattern-inside: | with: ... script: ... ... - pattern: 'script: $SHELL' - metavariable-regex: metavariable: $ACTION regex: actions/github-script@.* - metavariable-pattern: language: generic metavariable: $SHELL patterns: - pattern-either: - pattern: ${{ ... github.event.issue.title ... }} - pattern: ${{ ... github.event.issue.body ... }} - pattern: ${{ ... github.event.pull_request.title ... }} - pattern: ${{ ... github.event.pull_request.body ... }} - pattern: ${{ ... github.event.comment.body ... }} - pattern: ${{ ... github.event.review.body ... }} - pattern: ${{ ... github.event.review_comment.body ... }} - pattern: ${{ ... github.event.pages ... .page_name ... }} - pattern: ${{ ... github.event.head_commit.message ... }} - pattern: ${{ ... github.event.head_commit.author.email ... }} - pattern: ${{ ... github.event.head_commit.author.name ... }} - pattern: ${{ ... github.event.commits ... .author.email ... }} - pattern: ${{ ... github.event.commits ... .author.name ... }} - pattern: ${{ ... github.event.commits ... .message ... }} - pattern: ${{ ... github.event.pull_request.head.ref ... }} - pattern: ${{ ... github.event.pull_request.head.label ... }} - pattern: ${{ ... github.event.pull_request.head.repo.default_branch ... }} - pattern: ${{ ... github.ref ... }} - pattern: ${{ ... github.base_ref ... }} - pattern: ${{ ... github.head_ref ... }} - pattern: ${{ ... github.ref_name ... }} - pattern: ${{ ... github.workflow ... }} - pattern: ${{ ... github.event.inputs ... }} - pattern: ${{ ... github.event.discussion.title ... }} - pattern: ${{ ... github.event.discussion.body ... }} - pattern: ${{ ... github.event.workflow_run.head_branch ... }} - pattern: ${{ ... github.event.workflow_run.head_commit.message ... }} - pattern: ${{ ... github.event.milestone.title ... }} - pattern: ${{ ... github.event.milestone.description ... }} - pattern: ${{ ... github.event.project_card.note ... }} - pattern: ${{ ... github.event.project.name ... }} - pattern: ${{ ... github.event.project_column.name ... }} - pattern: ${{ ... github.event.release.name ... }} - pattern: ${{ ... github.event.release.body ... }} - pattern: ${{ ... github.event.deployment.ref ... }} - pattern: ${{ ... inputs ... }} - pattern-not: ${{ ... github.event.issue.title && ... }} - pattern-not: ${{ ... github.event.issue.body && ... }} - pattern-not: ${{ ... github.event.pull_request.title && ... }} - pattern-not: ${{ ... github.event.pull_request.body && ... }} - pattern-not: ${{ ... github.event.comment.body && ... }} - pattern-not: ${{ ... github.event.review.body && ... }} - pattern-not: ${{ ... github.event.review_comment.body && ... }} - pattern-not: ${{ ... github.event.pages ... .page_name && ... }} - pattern-not: ${{ ... github.event.head_commit.message && ... }} - pattern-not: ${{ ... github.event.head_commit.author.email && ... }} - pattern-not: ${{ ... github.event.head_commit.author.name && ... }} - pattern-not: ${{ ... github.event.commits ... .author.email && ... }} - pattern-not: ${{ ... github.event.commits ... .author.name && ... }} - pattern-not: ${{ ... github.event.commits ... .message && ... }} - pattern-not: ${{ ... github.event.pull_request.head.ref && ... }} - pattern-not: ${{ ... github.event.pull_request.head.label && ... }} - pattern-not: ${{ ... github.event.pull_request.head.repo.default_branch && ... }} - pattern-not: ${{ ... github.ref && ... }} - pattern-not: ${{ ... github.base_ref && ... }} - pattern-not: ${{ ... github.head_ref && ... }} - pattern-not: ${{ ... github.ref_name && ... }} - pattern-not: ${{ ... github.workflow && ... }} - pattern-not: ${{ ... github.event.inputs && ... }} - pattern-not: ${{ ... github.event.discussion.title && ... }} - pattern-not: ${{ ... github.event.discussion.body && ... }} - pattern-not: ${{ ... github.event.workflow_run.head_branch && ... }} - pattern-not: ${{ ... github.event.workflow_run.head_commit.message && ... }} - pattern-not: ${{ ... github.event.milestone.title && ... }} - pattern-not: ${{ ... github.event.milestone.description && ... }} - pattern-not: ${{ ... github.event.project_card.note && ... }} - pattern-not: ${{ ... github.event.project.name && ... }} - pattern-not: ${{ ... github.event.project_column.name && ... }} - pattern-not: ${{ ... github.event.release.name && ... }} - pattern-not: ${{ ... github.event.release.body && ... }} - pattern-not: ${{ ... github.event.deployment.ref && ... }} severity: ERROR - id: php.lang.security.injection.echoed-request.echoed-request mode: taint message: '`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users.' languages: - php severity: ERROR pattern-sources: - pattern: $_REQUEST - pattern: $_GET - pattern: $_POST pattern-sinks: - pattern: echo $...VARS; pattern-sanitizers: - pattern: htmlentities(...) - pattern: htmlspecialchars(...) - pattern: strip_tags(...) - pattern: isset(...) - pattern: empty(...) - pattern: esc_html(...) - pattern: esc_attr(...) - pattern: wp_kses(...) - pattern: e(...) - pattern: twig_escape_filter(...) - pattern: xss_clean(...) - pattern: html_escape(...) - pattern: Html::escape(...) - pattern: Xss::filter(...) - pattern: escapeHtml(...) - pattern: escapeHtml(...) - pattern: escapeHtmlAttr(...) fix: echo htmlentities($...VARS); metadata: technology: - php cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection category: security references: - https://www.php.net/manual/en/function.htmlentities.php - https://www.php.net/manual/en/reserved.variables.request.php - https://www.php.net/manual/en/reserved.variables.post.php - https://www.php.net/manual/en/reserved.variables.get.php - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/php.lang.security.injection.echoed-request.echoed-request shortlink: https://sg.run/Bqqb semgrep.dev: rule: r_id: 31707 rv_id: 1263283 rule_id: BYUyyg version_id: d6TyxE9 url: https://semgrep.dev/playground/r/d6TyxE9/php.lang.security.injection.echoed-request.echoed-request origin: community - id: java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing severity: ERROR metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://blog.sonarsource.com/secure-xml-processor - https://xerces.apache.org/xerces2-j/features.html category: security technology: - java - xml cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing shortlink: https://sg.run/Gj32 semgrep.dev: rule: r_id: 59048 rv_id: 1263061 rule_id: j2Udpk version_id: YDTZeko url: https://semgrep.dev/playground/r/YDTZeko/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing origin: community message: DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl` to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities` and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE - The previous links are not meant to be clicked. They are the literal config key values that are supposed to be used to disable these features. For more information, see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory. mode: taint pattern-sources: - by-side-effect: true patterns: - pattern-either: - pattern: | $FACTORY = SAXParserFactory.newInstance(); - patterns: - pattern: $FACTORY - pattern-inside: | class $C { ... $V $FACTORY = SAXParserFactory.newInstance(); ... } - pattern-not-inside: | class $C { ... $V $FACTORY = SAXParserFactory.newInstance(); static { ... $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); ... } ... } - pattern-not-inside: | class $C { ... $V $FACTORY = SAXParserFactory.newInstance(); static { ... $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); ... } ... } - pattern-not-inside: | class $C { ... $V $FACTORY = SAXParserFactory.newInstance(); static { ... $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... } ... } pattern-sinks: - patterns: - pattern: $FACTORY.newSAXParser(); pattern-sanitizers: - by-side-effect: true pattern-either: - patterns: - pattern-either: - pattern: | $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); - pattern: | $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); - pattern: | $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); - focus-metavariable: $FACTORY - patterns: - pattern-either: - pattern-inside: | class $C { ... $T $M(...) { ... $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); ... } ... } - pattern-inside: | class $C { ... $T $M(...) { ... $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... } ... } - pattern-inside: | class $C { ... $T $M(...) { ... $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities",false); ... } ... } - pattern: $M($X) - focus-metavariable: $X fix: | $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); $FACTORY.newSAXParser(); languages: - java - id: java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled severity: ERROR metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://blog.sonarsource.com/secure-xml-processor - https://xerces.apache.org/xerces2-j/features.html category: security technology: - java - xml cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled shortlink: https://sg.run/1wyQ semgrep.dev: rule: r_id: 59622 rv_id: 1263062 rule_id: v8UeQ1 version_id: 6xT29GK url: https://semgrep.dev/playground/r/6xT29GK/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled origin: community message: DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable to XML external entity attacks. Disable this by setting the attributes "accessExternalDTD" and "accessExternalStylesheet" to "". mode: taint pattern-sources: - by-side-effect: true patterns: - pattern-either: - pattern: | $FACTORY = TransformerFactory.newInstance(); - patterns: - pattern: $FACTORY - pattern-inside: | class $C { ... $V $FACTORY = TransformerFactory.newInstance(); ... } - pattern-not-inside: | class $C { ... $V $FACTORY = TransformerFactory.newInstance(); static { ... $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); ... $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); ... } ... } - pattern-not-inside: | class $C { ... $V $FACTORY = TransformerFactory.newInstance(); static { ... $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); ... $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); ... } ... } - pattern-not-inside: | class $C { ... $V $FACTORY = TransformerFactory.newInstance(); static { ... $FACTORY.setAttribute("=~/.*accessExternalDTD.*/", ""); ... $FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", ""); ... } ... } - pattern-not-inside: | class $C { ... $V $FACTORY = TransformerFactory.newInstance(); static { ... $FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", ""); ... $FACTORY.setAttribute("=~/.*accessExternalDTD.*/", ""); ... } ... } pattern-sinks: - patterns: - pattern: $FACTORY.newTransformer(...); pattern-sanitizers: - by-side-effect: true pattern-either: - patterns: - pattern-either: - pattern: | $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); ... $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); - pattern: | $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); ... $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); - pattern: | $FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", ""); ... $FACTORY.setAttribute("=~/.*accessExternalDTD.*/", ""); - pattern: | $FACTORY.setAttribute("=~/.*accessExternalDTD.*/", ""); ... $FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", ""); - focus-metavariable: $FACTORY - patterns: - pattern-either: - pattern-inside: | class $C { ... $T $M(...) { ... $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); ... $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); ... } ... } - pattern-inside: | class $C { ... $T $M(...) { ... $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); ... $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); ... } ... } - pattern-inside: | class $C { ... $T $M(...) { ... $FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", ""); ... $FACTORY.setAttribute("=~/.*accessExternalDTD.*/", ""); ... } ... } - pattern-inside: | class $C { ... $T $M(...) { ... $FACTORY.setAttribute("=~/.*accessExternalDTD.*/", ""); ... $FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", ""); ... } ... } - pattern: $M($X) - focus-metavariable: $X fix: | $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); $FACTORY.newTransformer(...); languages: - java - id: java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request message: Detected input from a HTTPServletRequest going into the environment variables of an 'exec' command. Instead, call the command with user-supplied arguments by using the overloaded method with one String array as the argument. `exec({"command", "arg1", "arg2"})`. languages: - java severity: ERROR mode: taint pattern-sources: - patterns: - pattern-either: - pattern: | (HttpServletRequest $REQ) - patterns: - pattern-inside: | (javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...); ... for (javax.servlet.http.Cookie $COOKIE: $COOKIES) { ... } - pattern: | $COOKIE.getValue(...) pattern-sinks: - patterns: - pattern: (java.lang.Runtime $R).exec($CMD, $ENV_ARGS, ...); - focus-metavariable: $ENV_ARGS metadata: category: security technology: - java cwe: - 'CWE-454: External Initialization of Trusted Variables or Data Stores' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: false cwe2021-top25: false subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Other source: https://semgrep.dev/r/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request shortlink: https://sg.run/EJAB semgrep.dev: rule: r_id: 70981 rv_id: 1409391 rule_id: nJULjy version_id: LjTRL6W url: https://semgrep.dev/playground/r/LjTRL6W/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request origin: community - id: clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe languages: - clojure severity: ERROR metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://xerces.apache.org/xerces2-j/features.html source-rule-url: https://github.com/clj-holmes/clj-holmes-rules/blob/main/security/xxe-clojure-xml/xxe-clojure-xml.yml category: security technology: - clojure - xml cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe shortlink: https://sg.run/v7An semgrep.dev: rule: r_id: 71533 rv_id: 1262608 rule_id: bwU3Gj version_id: WrTqKyD url: https://semgrep.dev/playground/r/WrTqKyD/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe origin: community message: DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature "http://apache.org/xml/features/disallow-doctype-decl" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features "http://xml.org/sax/features/external-general-entities" and "http://xml.org/sax/features/external-parameter-entities" to false. patterns: - pattern-inside: | (ns ... (:require [clojure.xml :as ...])) ... - pattern-either: - pattern-inside: | (def ... ... ( ... )) - pattern-inside: | (defn ... ... ( ... )) - pattern-either: - pattern: (clojure.xml/parse $INPUT) - patterns: - pattern-inside: | (doto (javax.xml.parsers.SAXParserFactory/newInstance) ...) - pattern: (.setFeature "http://apache.org/xml/features/disallow-doctype-decl" false) - pattern-not-inside: | (doto (javax.xml.parsers.SAXParserFactory/newInstance) ... (.setFeature "http://xml.org/sax/features/external-general-entities" false) ... (.setFeature "http://xml.org/sax/features/external-parameter-entities" false) ...) - pattern-not-inside: | (doto (javax.xml.parsers.SAXParserFactory/newInstance) ... (.setFeature "http://xml.org/sax/features/external-parameter-entities" false) ... (.setFeature "http://xml.org/sax/features/external-general-entities" false) ...) - id: generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param languages: - generic severity: ERROR message: To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts. Please update your code to use either the JSENCODE method to escape URL parameters or the escape="true" attribute on tags. Passing URL parameters directly into scripts and DOM sinks creates an opportunity for Cross-Site Scripting attacks. Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. To remediate this issue, ensure that all URL parameters are properly escaped before including them in scripts. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/pages_security_tips_xss.htm category: security subcategory: - vuln technology: - salesforce - visualforce cwe2022-top25: true cwe2021-top25: true likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param shortlink: https://sg.run/9bGk semgrep.dev: rule: r_id: 72423 rv_id: 1262906 rule_id: BYUAJ2 version_id: GxTkekB url: https://semgrep.dev/playground/r/GxTkekB/generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param origin: community patterns: - pattern-either: - pattern: - pattern: - pattern: - pattern-not: paths: include: - '*.component' - '*.page' - id: generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute languages: - generic severity: INFO message: Visualforce Pages must have the cspHeader attribute set to true. This attribute is available in API version 55 or higher. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://help.salesforce.com/s/articleView?id=sf.csp_trusted_sites.htm&type=5 category: security subcategory: - vuln technology: - salesforce - visualforce cwe2022-top25: true cwe2021-top25: true likelihood: HIGH impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute shortlink: https://sg.run/yoj8 semgrep.dev: rule: r_id: 72424 rv_id: 1262907 rule_id: DbUj7d version_id: RGT0L0r url: https://semgrep.dev/playground/r/RGT0L0r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute origin: community patterns: - pattern: ... - pattern-not: ... - pattern-not: ...... - pattern-not: ...... paths: include: - '*.page' - id: generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version languages: - generic severity: WARNING message: Visualforce Pages must use API version 55 or higher for required use of the cspHeader attribute set to true. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_pages.htm category: security subcategory: - vuln technology: - salesforce - visualforce cwe2022-top25: true cwe2021-top25: true likelihood: HIGH impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version shortlink: https://sg.run/rWr6 semgrep.dev: rule: r_id: 72425 rv_id: 1262908 rule_id: WAUwJW version_id: A8Tgdgn url: https://semgrep.dev/playground/r/A8Tgdgn/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version origin: community patterns: - pattern-inside: - pattern-either: - pattern-regex: '[>][0-9].[0-9][<]' - pattern-regex: '[>][1-4][0-9].[0-9][<]' - pattern-regex: '[>][5][0-4].[0-9][<]' paths: include: - '*.page-meta.xml' - id: python.lang.security.use-defused-xml-parse.use-defused-xml-parse metadata: owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' references: - https://docs.python.org/3/library/xml.html - https://github.com/tiran/defusedxml - https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing category: security technology: - python cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse shortlink: https://sg.run/n3jG semgrep.dev: rule: r_id: 72436 rv_id: 1263541 rule_id: X5Uqnx version_id: vdT06ER url: https://semgrep.dev/playground/r/vdT06ER/python.lang.security.use-defused-xml-parse.use-defused-xml-parse origin: community message: The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python documentation recommends using `defusedxml`. languages: - python severity: ERROR patterns: - pattern: xml.etree.ElementTree.parse($...ARGS) - pattern-not: xml.etree.ElementTree.parse("...") fix: defusedxml.etree.ElementTree.parse($...ARGS) - id: php.lang.security.tainted-exec.tainted-exec mode: taint pattern-sources: - pattern: $_REQUEST - pattern: $_GET - pattern: $_POST - pattern: $_COOKIE pattern-sinks: - pattern: exec(...) - pattern: system(...) - pattern: popen(...) - pattern: passthru(...) - pattern: shell_exec(...) - pattern: pcntl_exec(...) - pattern: proc_open(...) pattern-sanitizers: - pattern: escapeshellarg(...) message: Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. metadata: cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' references: - https://www.stackhawk.com/blog/php-command-injection/ - https://brightsec.com/blog/code-injection-php/ - https://www.acunetix.com/websitesecurity/php-security-2/ category: security technology: - php owasp: - A03:2021 - Injection - A05:2025 - Injection cwe2022-top25: true subcategory: - vuln likelihood: HIGH impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/php.lang.security.tainted-exec.tainted-exec shortlink: https://sg.run/JAkP semgrep.dev: rule: r_id: 73146 rv_id: 1263300 rule_id: 9AUw06 version_id: BjTkZ4y url: https://semgrep.dev/playground/r/BjTkZ4y/php.lang.security.tainted-exec.tainted-exec origin: community languages: - php severity: ERROR - id: php.lang.security.injection.tainted-session.tainted-session severity: WARNING message: Session key based on user input risks session poisoning. The user can determine the key used for the session, and thus write any session variable. Session variables are typically trusted to be set only by the application, and manipulating the session can result in access control issues. metadata: technology: - php category: security cwe: - 'CWE-284: Improper Access Control' owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://en.wikipedia.org/wiki/Session_poisoning cwe2022-top25: true cwe2021-top25: true subcategory: - vuln impact: MEDIUM likelihood: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authorization source: https://semgrep.dev/r/php.lang.security.injection.tainted-session.tainted-session shortlink: https://sg.run/bxNp semgrep.dev: rule: r_id: 73470 rv_id: 1263289 rule_id: 4bUdoP version_id: 8KT5rPE url: https://semgrep.dev/playground/r/8KT5rPE/php.lang.security.injection.tainted-session.tainted-session origin: community languages: - php mode: taint pattern-sources: - patterns: - pattern-either: - pattern: $_GET - pattern: $_POST - pattern: $_COOKIE - pattern: $_REQUEST pattern-sanitizers: - patterns: - pattern-either: - pattern: $A . $B - pattern: bin2hex(...) - pattern: crc32(...) - pattern: crypt(...) - pattern: filter_input(...) - pattern: filter_var(...) - pattern: hash(...) - pattern: md5(...) - pattern: preg_filter(...) - pattern: preg_grep(...) - pattern: preg_match_all(...) - pattern: sha1(...) - pattern: sprintf(...) - pattern: str_contains(...) - pattern: str_ends_with(...) - pattern: str_starts_with(...) - pattern: strcasecmp(...) - pattern: strchr(...) - pattern: stripos(...) - pattern: stristr(...) - pattern: strnatcasecmp(...) - pattern: strnatcmp(...) - pattern: strncmp(...) - pattern: strpbrk(...) - pattern: strpos(...) - pattern: strripos(...) - pattern: strrpos(...) - pattern: strspn(...) - pattern: strstr(...) - pattern: strtok(...) - pattern: substr_compare(...) - pattern: substr_count(...) - pattern: vsprintf(...) pattern-sinks: - patterns: - pattern-inside: $_SESSION[$KEY] = $VAL; - pattern: $KEY - id: php.lang.security.injection.printed-request.printed-request mode: taint message: '`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users.' languages: - php severity: ERROR pattern-sources: - pattern: $_REQUEST - pattern: $_GET - pattern: $_POST pattern-sinks: - pattern: print($...VARS); pattern-sanitizers: - pattern: htmlentities(...) - pattern: htmlspecialchars(...) - pattern: strip_tags(...) - pattern: isset(...) - pattern: empty(...) - pattern: esc_html(...) - pattern: esc_attr(...) - pattern: wp_kses(...) - pattern: e(...) - pattern: twig_escape_filter(...) - pattern: xss_clean(...) - pattern: html_escape(...) - pattern: Html::escape(...) - pattern: Xss::filter(...) - pattern: escapeHtml(...) - pattern: escapeHtml(...) - pattern: escapeHtmlAttr(...) fix: print(htmlentities($...VARS)); metadata: technology: - php cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection category: security references: - https://www.php.net/manual/en/function.htmlentities.php - https://www.php.net/manual/en/reserved.variables.request.php - https://www.php.net/manual/en/reserved.variables.post.php - https://www.php.net/manual/en/reserved.variables.get.php - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/php.lang.security.injection.printed-request.printed-request shortlink: https://sg.run/QrxEJ semgrep.dev: rule: r_id: 128886 rv_id: 1263284 rule_id: KxUvRBw version_id: ZRTKAk4 url: https://semgrep.dev/playground/r/ZRTKAk4/php.lang.security.injection.printed-request.printed-request origin: community - id: kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded message: A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy. severity: WARNING metadata: likelihood: LOW impact: HIGH confidence: MEDIUM category: security subcategory: - vuln cwe: - 'CWE-798: Use of Hard-coded Credentials' cwe2020-top25: true cwe2021-top25: true cwe2022-top25: true owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures technology: - secrets vulnerability_class: - Hard-coded Secrets source_rule_url: https://semgrep.dev/playground/r/d8Ur5BA/achufistov6_personal_org.build-gradle-password-hardcoded license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license source: https://semgrep.dev/r/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded shortlink: https://sg.run/qN29x semgrep.dev: rule: r_id: 137856 rv_id: 1263257 rule_id: ReUD6Kg version_id: DkTRbLX url: https://semgrep.dev/playground/r/DkTRbLX/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded origin: community languages: - kotlin options: symbolic_propagation: true patterns: - pattern-either: - pattern: '$PASS = env[...] ?: $VALUE' - metavariable-regex: metavariable: $PASS regex: (password|pass|passwd|loginPassword) - metavariable-pattern: language: generic metavariable: $VALUE patterns: - pattern-either: - pattern-regex: ^[A-Za-z0-9/+=]+$ paths: include: - '*build.gradle.kts' - id: yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor languages: - yaml message: The Shai-hulud backdoor creates a purposefully vulnerable github action with the name `discussion.yaml`. paths: include: - '**/.github/workflows/discussion.yaml' metadata: category: security cwe: - 'CWE-509: Replicating Malicious Code (Virus or Worm)' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection technology: - github-actions cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source_rule_url: https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack references: - https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains source: https://semgrep.dev/r/yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor shortlink: https://sg.run/JdYPZ semgrep.dev: rule: r_id: 238946 rv_id: 1263927 rule_id: 7KUDRPj version_id: 6xT29ol url: https://semgrep.dev/playground/r/6xT29ol/yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor origin: community patterns: - pattern-inside: 'steps: [...]' - pattern-inside: | - run: ... ... - pattern: 'run: $SHELL' - metavariable-pattern: language: generic metavariable: $SHELL patterns: - pattern-either: - pattern: ${{ github.event.issue.title }} - pattern: ${{ github.event.issue.body }} - pattern: ${{ github.event.pull_request.title }} - pattern: ${{ github.event.pull_request.body }} - pattern: ${{ github.event.comment.body }} - pattern: ${{ github.event.review.body }} - pattern: ${{ github.event.review_comment.body }} - pattern: ${{ github.event.pages. ... .page_name}} - pattern: ${{ github.event.head_commit.message }} - pattern: ${{ github.event.head_commit.author.email }} - pattern: ${{ github.event.head_commit.author.name }} - pattern: ${{ github.event.commits ... .author.email }} - pattern: ${{ github.event.commits ... .author.name }} - pattern: ${{ github.event.pull_request.head.ref }} - pattern: ${{ github.event.pull_request.head.label }} - pattern: ${{ github.event.pull_request.head.repo.default_branch }} - pattern: ${{ github.head_ref }} - pattern: ${{ github.event.inputs ... }} - pattern: ${{ github.event.discussion.title }} - pattern: ${{ github.event.discussion.body }} - pattern: ${{ inputs ... }} severity: ERROR - id: yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell languages: - yaml message: "A `run:` step pipes the output of `curl` or `wget` directly into a shell interpreter. This is the \"curl | bash\" install pattern \u2014 if the remote server is compromised or the URL is hijacked, an attacker can execute arbitrary code in your CI runner. Consider downloading the file first, verifying its checksum or signature, and then executing it." metadata: category: security cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A03:2021 - Injection - A03:2025 - Injection references: - https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions - https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ technology: - github-actions - bash - curl cwe2021-top25: true cwe2022-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell shortlink: https://sg.run/GR8K1 semgrep.dev: rule: r_id: 309392 rv_id: 1443456 rule_id: x8UAgrE version_id: 9lT3zYb url: https://semgrep.dev/playground/r/9lT3zYb/yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell origin: community patterns: - pattern-inside: 'steps: [...]' - pattern-inside: | - run: ... ... - pattern: 'run: $SHELL' - metavariable-pattern: language: bash metavariable: $SHELL patterns: - pattern-either: - pattern: curl ... | $CMD ... - pattern: wget ... | $CMD ... - metavariable-regex: metavariable: $CMD regex: ^(bash|sh|python3?|ruby|perl)$ severity: ERROR - id: scala.play.security.tainted-slick-sqli.tainted-slick-sqli mode: taint metadata: references: - https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values - https://scala-slick.org/doc/3.2.0/sql-to-slick.html#non-optimal-sql-code category: security cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection technology: - scala - slick - play confidence: HIGH cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/scala.play.security.tainted-slick-sqli.tainted-slick-sqli shortlink: https://sg.run/k9K2 semgrep.dev: rule: r_id: 18328 rv_id: 1263687 rule_id: GdUDWO version_id: d6TyxJe url: https://semgrep.dev/playground/r/d6TyxJe/scala.play.security.tainted-slick-sqli.tainted-slick-sqli origin: community message: Detected a tainted SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Avoid using using user input for generating SQL strings. pattern-sources: - patterns: - pattern-either: - patterns: - pattern: $REQ - pattern-either: - pattern-inside: "Action {\n $REQ: Request[$T] => \n ...\n}\n" - pattern-inside: "Action(...) {\n $REQ: Request[$T] => \n ...\n}\n" - pattern-inside: "Action.async {\n $REQ: Request[$T] => \n ...\n}\n" - pattern-inside: "Action.async(...) {\n $REQ: Request[$T] => \n ...\n}\n" - patterns: - pattern: $PARAM - pattern-either: - pattern-inside: | def $CTRL(..., $PARAM: $TYPE, ...) = Action { ... } - pattern-inside: | def $CTRL(..., $PARAM: $TYPE, ...) = Action(...) { ... } - pattern-inside: | def $CTRL(..., $PARAM: $TYPE, ...) = Action.async { ... } - pattern-inside: | def $CTRL(..., $PARAM: $TYPE, ...) = Action.async(...) { ... } pattern-sinks: - patterns: - pattern-either: - pattern: $MODEL.overrideSql(...) - pattern: sql"..." - pattern-inside: | import slick.$DEPS ... severity: ERROR languages: - scala