JulieChv/ARC
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
41eb36a489e0417cacb559d0e2e51e2d4fd9833d
ARC/backend/app/sandbox/rules/ci.yaml

10095 lines
356 KiB
YAML
Raw Blame History

rules:
- id: generic.nginx.security.insecure-ssl-version.insecure-ssl-version
patterns:
- pattern-not: ssl_protocols TLSv1.2 TLSv1.3;
- pattern-not: ssl_protocols TLSv1.3 TLSv1.2;
- pattern-not: ssl_protocols TLSv1.2;
- pattern-not: ssl_protocols TLSv1.3;
- pattern: ssl_protocols ...;
paths:
include:
- '*.conf'
- '*.vhost'
- '**/sites-available/*'
- '**/sites-enabled/*'
languages:
- generic
severity: WARNING
message: Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2
and TLS1.3; older versions are known to be broken and are susceptible to attacks.
Prefer use of TLSv1.2 or later.
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
references:
- https://www.acunetix.com/blog/web-security-zone/hardening-nginx/
- https://www.acunetix.com/blog/articles/tls-ssl-cipher-hardening/
category: security
technology:
- nginx
confidence: HIGH
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- audit
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/generic.nginx.security.insecure-ssl-version.insecure-ssl-version
shortlink: https://sg.run/gLKy
semgrep.dev:
rule:
r_id: 9041
rv_id: 1262676
rule_id: WAUo9k
version_id: vdT06O4
url: https://semgrep.dev/playground/r/vdT06O4/generic.nginx.security.insecure-ssl-version.insecure-ssl-version
origin: community
- id: go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection
metadata:
cwe:
- 'CWE-300: Channel Accessible by Non-Endpoint'
references:
- https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption
category: security
technology:
- grpc
confidence: HIGH
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection
shortlink: https://sg.run/J9yZ
semgrep.dev:
rule:
r_id: 9090
rv_id: 1262916
rule_id: PeUZ4X
version_id: YDTZeZB
url: https://semgrep.dev/playground/r/YDTZeZB/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection
origin: community
message: 'Found an insecure gRPC connection using ''grpc.WithInsecure()''. This
creates a connection without encryption to a gRPC server. A malicious attacker
could tamper with the gRPC message, which could compromise the machine. Instead,
establish a secure connection with an SSL certificate using the ''grpc.WithTransportCredentials()''
function. You can create a create credentials using a ''tls.Config{}'' struct
with ''credentials.NewTLS()''. The final fix looks like this: ''grpc.WithTransportCredentials(credentials.NewTLS(<config>))''.'
languages:
- go
severity: ERROR
pattern: $GRPC.Dial($ADDR, ..., $GRPC.WithInsecure(...), ...)
fix-regex:
regex: (.*)WithInsecure\(.*?\)
replacement: \1WithTransportCredentials(credentials.NewTLS(<your_tls_config_here>))
- id: go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection
metadata:
cwe:
- 'CWE-300: Channel Accessible by Non-Endpoint'
references:
- https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption
category: security
technology:
- grpc
confidence: HIGH
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection
shortlink: https://sg.run/5Q5l
semgrep.dev:
rule:
r_id: 9091
rv_id: 1262917
rule_id: JDUy0B
version_id: 6xT2923
url: https://semgrep.dev/playground/r/6xT2923/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection
origin: community
message: Found an insecure gRPC server without 'grpc.Creds()' or options with credentials.
This allows for a connection without encryption to this server. A malicious attacker
could tamper with the gRPC message, which could compromise the machine. Include
credentials derived from an SSL certificate in order to create a secure gRPC connection.
You can create credentials using 'credentials.NewServerTLSFromFile("cert.pem",
"cert.key")'.
languages:
- go
severity: ERROR
mode: taint
pattern-sinks:
- requires: OPTIONS and not CREDS
pattern: grpc.NewServer($OPT, ...)
- requires: EMPTY_CONSTRUCTOR
pattern: grpc.NewServer()
pattern-sources:
- label: OPTIONS
pattern: grpc.ServerOption{ ... }
- label: CREDS
pattern: grpc.Creds(...)
- label: EMPTY_CONSTRUCTOR
pattern: grpc.NewServer()
- id: go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm
message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm
assumes the integrity of the token has already been verified. This would allow
a malicious actor to forge a JWT token that will automatically be verified. Do
not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
category: security
technology:
- jwt
confidence: HIGH
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm
shortlink: https://sg.run/Gej1
semgrep.dev:
rule:
r_id: 9092
rv_id: 1262919
rule_id: 5rUOWQ
version_id: zyTb2bz
url: https://semgrep.dev/playground/r/zyTb2bz/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm
origin: community
languages:
- go
severity: ERROR
patterns:
- pattern-either:
- pattern-inside: |
import "github.com/golang-jwt/jwt"
...
- pattern-inside: |
import "github.com/dgrijalva/jwt-go"
...
- pattern-either:
- pattern: |
jwt.SigningMethodNone
- pattern: jwt.UnsafeAllowNoneSignatureType
- id: go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion
message: '`MinVersion` is missing from this TLS configuration. By default, as of
Go 1.22, TLS 1.2 is currently used as the minimum. General purpose web applications
should default to TLS 1.3 with all other protocols disabled. Only where it is
known that a web server must support legacy clients with unsupported an insecure
browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0
to provide support. Add `MinVersion: tls.VersionTLS13'' to the TLS configuration
to bump the minimum version to TLS 1.3.'
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go
references:
- https://go.dev/doc/go1.22#minor_library_changes
- https://pkg.go.dev/crypto/tls#:~:text=MinVersion
- https://www.us-cert.gov/ncas/alerts/TA14-290A
category: security
technology:
- go
confidence: HIGH
subcategory:
- audit
likelihood: MEDIUM
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion
shortlink: https://sg.run/oxEN
semgrep.dev:
rule:
r_id: 9116
rv_id: 1262924
rule_id: NbUk4X
version_id: 1QTypyp
url: https://semgrep.dev/playground/r/1QTypyp/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion
origin: community
languages:
- go
severity: WARNING
patterns:
- pattern: |
tls.Config{ $...CONF }
- pattern-not: |
tls.Config{..., MinVersion: ..., ...}
fix: |
tls.Config{ $...CONF, MinVersion: tls.VersionTLS13 }
- id: go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure
message: SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14,
SSLv3 will be removed. Instead, use 'tls.VersionTLS13'.
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go
references:
- https://golang.org/doc/go1.14#crypto/tls
- https://www.us-cert.gov/ncas/alerts/TA14-290A
category: security
technology:
- go
confidence: HIGH
subcategory:
- vuln
likelihood: MEDIUM
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure
shortlink: https://sg.run/zvE1
semgrep.dev:
rule:
r_id: 9117
rv_id: 1262926
rule_id: kxUkJ2
version_id: yeTxpxj
url: https://semgrep.dev/playground/r/yeTxpxj/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure
origin: community
languages:
- go
severity: WARNING
fix-regex:
regex: VersionSSL30
replacement: VersionTLS13
pattern: 'tls.Config{..., MinVersion: $TLS.VersionSSL30, ...}'
- id: go.lang.security.audit.crypto.tls.tls-with-insecure-cipher
message: Detected an insecure CipherSuite via the 'tls' module. This suite is considered
weak. Use the function 'tls.CipherSuites()' to get a list of good cipher suites.
See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other
cipher suites to use.
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls.go
references:
- https://golang.org/pkg/crypto/tls/#InsecureCipherSuites
category: security
technology:
- go
confidence: HIGH
subcategory:
- vuln
likelihood: HIGH
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher
shortlink: https://sg.run/px8N
semgrep.dev:
rule:
r_id: 9118
rv_id: 1262927
rule_id: wdUJYk
version_id: rxTAKAZ
url: https://semgrep.dev/playground/r/rxTAKAZ/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher
origin: community
languages:
- go
severity: WARNING
pattern-either:
- pattern: |
tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_RC4_128_SHA, ...}}
- pattern: |
tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...}}
- pattern: |
tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_AES_128_CBC_SHA256, ...}}
- pattern: |
tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...}}
- pattern: |
tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...}}
- pattern: |
tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...}}
- pattern: |
tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...}}
- pattern: |
tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...}}
- pattern: |
tls.CipherSuite{..., TLS_RSA_WITH_RC4_128_SHA, ...}
- pattern: |
tls.CipherSuite{..., TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...}
- pattern: |
tls.CipherSuite{..., TLS_RSA_WITH_AES_128_CBC_SHA256, ...}
- pattern: |
tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...}
- pattern: |
tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...}
- pattern: |
tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...}
- pattern: |
tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...}
- pattern: |
tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...}
- id: go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key
message: RSA keys should be at least 2048 bits
languages:
- go
severity: WARNING
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://github.com/securego/gosec/blob/master/rules/rsa.go
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms
category: security
technology:
- go
confidence: HIGH
subcategory:
- audit
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key
shortlink: https://sg.run/9oY4
semgrep.dev:
rule:
r_id: 9123
rv_id: 1262932
rule_id: d8UjY3
version_id: xyTjz8L
url: https://semgrep.dev/playground/r/xyTjz8L/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key
origin: community
patterns:
- pattern-either:
- pattern: |
rsa.GenerateKey(..., $BITS)
- pattern: |
rsa.GenerateMultiPrimeKey(..., $BITS)
- metavariable-comparison:
metavariable: $BITS
comparison: $BITS < 2048
- focus-metavariable:
- $BITS
fix: |
2048
- id: go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces
message: Detected a network listener listening on 0.0.0.0 or an empty string. This
could unexpectedly expose the server publicly as it binds to all available interfaces.
Instead, specify another IP address that is not 0.0.0.0 nor the empty string.
languages:
- go
severity: WARNING
metadata:
cwe:
- 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
source-rule-url: https://github.com/securego/gosec
category: security
technology:
- go
confidence: HIGH
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces
shortlink: https://sg.run/rdE0
semgrep.dev:
rule:
r_id: 9125
rv_id: 1262939
rule_id: nJUz3J
version_id: ExTExoK
url: https://semgrep.dev/playground/r/ExTExoK/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces
origin: community
pattern-either:
- pattern: tls.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...)
- pattern: net.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...)
- pattern: tls.Listen($NETWORK, "=~/^:.*$/", ...)
- pattern: net.Listen($NETWORK, "=~/^:.*$/", ...)
- id: java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
technology:
- java
- secrets
- jwt
category: security
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret
shortlink: https://sg.run/RoDK
semgrep.dev:
rule:
r_id: 9149
rv_id: 1262980
rule_id: oqUeAn
version_id: d6Tyx8j
url: https://semgrep.dev/playground/r/d6Tyx8j/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret
origin: community
languages:
- java
severity: WARNING
patterns:
- pattern-either:
- pattern: |
(Algorithm $ALG) = $ALGO.$HMAC("$Y");
- pattern: |
$SECRET = "$Y";
...
(Algorithm $ALG) = $ALGO.$HMAC($SECRET);
- pattern: |
class $CLASS {
...
$TYPE $SECRET = "$Y";
...
$RETURNTYPE $FUNC (...) {
...
(Algorithm $ALG) = $ALGO.$HMAC($SECRET);
...
}
...
}
- focus-metavariable: $Y
- metavariable-regex:
metavariable: $HMAC
regex: (HMAC384|HMAC256|HMAC512)
- id: java.java-jwt.security.jwt-none-alg.java-jwt-none-alg
message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm
assumes the integrity of the token has already been verified. This would allow
a malicious actor to forge a JWT token that will automatically be verified. Do
not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
category: security
technology:
- jwt
confidence: HIGH
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg
shortlink: https://sg.run/Av14
semgrep.dev:
rule:
r_id: 9150
rv_id: 1262981
rule_id: zdUkzR
version_id: ZRTKADq
url: https://semgrep.dev/playground/r/ZRTKADq/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg
origin: community
languages:
- java
severity: ERROR
pattern-either:
- pattern: |
$JWT.sign(com.auth0.jwt.algorithms.Algorithm.none());
- pattern: |
$NONE = com.auth0.jwt.algorithms.Algorithm.none();
...
$JWT.sign($NONE);
- pattern: |-
class $CLASS {
...
$TYPE $NONE = com.auth0.jwt.algorithms.Algorithm.none();
...
$RETURNTYPE $FUNC (...) {
...
$JWT.sign($NONE);
...
}
...
}
- id: java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#BLOWFISH_KEY_SIZE
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.5 Insecure Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size
shortlink: https://sg.run/9o74
semgrep.dev:
rule:
r_id: 9167
rv_id: 1262989
rule_id: d8UjJ3
version_id: 3ZT4X2r
url: https://semgrep.dev/playground/r/3ZT4X2r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size
origin: community
message: Using less than 128 bits for Blowfish is considered insecure. Use 128 bits
or more, or switch to use AES instead.
severity: WARNING
languages:
- java
patterns:
- pattern: |
$KEYGEN = KeyGenerator.getInstance("Blowfish");
...
$KEYGEN.init($SIZE);
- metavariable-comparison:
metavariable: $SIZE
comparison: $SIZE < 128
- id: java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle
message: Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A
malicious actor could discern the difference between plaintext with valid or invalid
padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding'
instead.
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PADDING_ORACLE
references:
- https://capec.mitre.org/data/definitions/463.html
- https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes
- https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY
category: security
technology:
- java
subcategory:
- audit
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle
shortlink: https://sg.run/ydxr
semgrep.dev:
rule:
r_id: 9168
rv_id: 1262990
rule_id: ZqU5oD
version_id: 44TEjbE
url: https://semgrep.dev/playground/r/44TEjbE/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle
origin: community
severity: WARNING
fix: |
"AES/GCM/NoPadding"
languages:
- java
patterns:
- pattern-inside: Cipher.getInstance("=~/.*\/CBC\/PKCS5Padding/")
- pattern: |
"=~/.*\/CBC\/PKCS5Padding/"
- id: java.lang.security.audit.weak-ssl-context.weak-ssl-context
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source_rule_url: https://find-sec-bugs.github.io/bugs.htm#SSL_CONTEXT
references:
- https://tools.ietf.org/html/rfc7568
- https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html
category: security
technology:
- java
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.weak-ssl-context.weak-ssl-context
shortlink: https://sg.run/4x7E
semgrep.dev:
rule:
r_id: 9188
rv_id: 1263050
rule_id: KxUb1k
version_id: 5PTo1rW
url: https://semgrep.dev/playground/r/5PTo1rW/java.lang.security.audit.weak-ssl-context.weak-ssl-context
origin: community
message: An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL
versions are considered weak encryption and are deprecated. Use SSLContext.getInstance("TLSv1.2")
for the best security.
severity: WARNING
languages:
- java
patterns:
- pattern-not: SSLContext.getInstance("TLSv1.3")
- pattern-not: SSLContext.getInstance("TLSv1.2")
- pattern: SSLContext.getInstance("...")
fix-regex:
regex: (.*?)\.getInstance\(.*?\)
replacement: \1.getInstance("TLSv1.2")
- id: java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated
message: DES is considered deprecated. AES is the recommended cipher. Upgrade to
use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard
for more information.
metadata:
functional-categories:
- crypto::search::symmetric-algorithm::javax.crypto
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#DES_USAGE
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.5 Insecure Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
references:
- https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard
- https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms
category: security
technology:
- java
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated
shortlink: https://sg.run/5Q73
semgrep.dev:
rule:
r_id: 9191
rv_id: 1262996
rule_id: PeUZNg
version_id: A8TgdEn
url: https://semgrep.dev/playground/r/A8TgdEn/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated
origin: community
severity: WARNING
patterns:
- pattern-either:
- pattern-inside: $CIPHER.getInstance("=~/DES/.*/")
- pattern-inside: $CIPHER.getInstance("DES")
- pattern-either:
- pattern: |
"=~/DES/.*/"
- pattern: |
"DES"
fix: |
"AES/GCM/NoPadding"
languages:
- java
- kt
- id: java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated
message: Triple DES (3DES or DESede) is considered deprecated. AES is the recommended
cipher. Upgrade to use AES.
metadata:
functional-categories:
- crypto::search::symmetric-algorithm::javax.crypto
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#TDES_USAGE
references:
- https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA
category: security
technology:
- java
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated
shortlink: https://sg.run/Geqn
semgrep.dev:
rule:
r_id: 9192
rv_id: 1262997
rule_id: JDUy8J
version_id: BjTkZyQ
url: https://semgrep.dev/playground/r/BjTkZyQ/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated
origin: community
severity: WARNING
patterns:
- pattern-either:
- pattern: |
$CIPHER.getInstance("=~/DESede.*/")
- pattern: |
$CRYPTO.KeyGenerator.getInstance("DES")
languages:
- java
- kt
- id: java.lang.security.audit.crypto.ecb-cipher.ecb-cipher
metadata:
functional-categories:
- crypto::search::mode::javax.crypto
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#ECB_MODE
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.ecb-cipher.ecb-cipher
shortlink: https://sg.run/Ro9K
semgrep.dev:
rule:
r_id: 9193
rv_id: 1262998
rule_id: 5rUOb6
version_id: DkTRbwL
url: https://semgrep.dev/playground/r/DkTRbwL/java.lang.security.audit.crypto.ecb-cipher.ecb-cipher
origin: community
message: Cipher in ECB mode is detected. ECB mode produces the same output for the
same input each time which allows an attacker to intercept and replay the data.
Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY.
severity: WARNING
languages:
- java
patterns:
- pattern: |
Cipher $VAR = $CIPHER.getInstance($MODE);
- metavariable-regex:
metavariable: $MODE
regex: .*ECB.*
- id: java.lang.security.audit.crypto.no-null-cipher.no-null-cipher
patterns:
- pattern-either:
- pattern: new NullCipher(...);
- pattern: new javax.crypto.NullCipher(...);
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#NULL_CIPHER
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.5 Insecure Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher
shortlink: https://sg.run/AvA4
semgrep.dev:
rule:
r_id: 9194
rv_id: 1263001
rule_id: GdU7pw
version_id: K3TKkgB
url: https://semgrep.dev/playground/r/K3TKkgB/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher
origin: community
message: 'NullCipher was detected. This will not encrypt anything; the cipher text
will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING").
See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for
more information.'
severity: WARNING
languages:
- java
- id: java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector
message: Initialization Vectors (IVs) for block ciphers should be randomly generated
each time they are used. Using a static IV means the same plaintext encrypts to
the same ciphertext every time, weakening the strength of the encryption.
metadata:
cwe:
- 'CWE-329: Generation of Predictable IV with CBC Mode'
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#STATIC_IV
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.5 Insecure Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
references:
- https://cwe.mitre.org/data/definitions/329.html
category: security
technology:
- java
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector
shortlink: https://sg.run/BkB5
semgrep.dev:
rule:
r_id: 9195
rv_id: 1263002
rule_id: ReUgj1
version_id: qkTR7vP
url: https://semgrep.dev/playground/r/qkTR7vP/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector
origin: community
severity: WARNING
languages:
- java
pattern-either:
- pattern: |
byte[] $IV = {
...
};
...
new IvParameterSpec($IV, ...);
- pattern: |
class $CLASS {
byte[] $IV = {
...
};
...
$METHOD(...) {
...
new IvParameterSpec($IV, ...);
...
}
}
- id: java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding
metadata:
functional-categories:
- crypto::search::mode::javax.crypto
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#RSA_NO_PADDING
references:
- https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.5 Insecure Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
category: security
technology:
- java
- kotlin
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding
shortlink: https://sg.run/DoOj
semgrep.dev:
rule:
r_id: 9196
rv_id: 1263003
rule_id: AbUzoj
version_id: l4TJRpK
url: https://semgrep.dev/playground/r/l4TJRpK/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding
origin: community
message: Using RSA without OAEP mode weakens the encryption.
severity: WARNING
languages:
- java
- kt
pattern: $CIPHER.getInstance("=~/RSA/[Nn][Oo][Nn][Ee]/NoPadding/")
- id: java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket
metadata:
functional-categories:
- net::search::crypto-config::java.net
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNENCRYPTED_SOCKET
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.5 Insecure Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket
shortlink: https://sg.run/W8zA
semgrep.dev:
rule:
r_id: 9197
rv_id: 1263008
rule_id: BYUN3X
version_id: RGT0LEj
url: https://semgrep.dev/playground/r/RGT0LEj/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket
origin: community
message: Detected use of a Java socket that is not encrypted. As a result, the traffic
could be read by an attacker intercepting the network traffic. Use an SSLSocket
created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead.
severity: WARNING
languages:
- java
pattern-either:
- pattern: new ServerSocket(...)
- pattern: new Socket(...)
- id: java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key
message: RSA keys should be at least 2048 bits based on NIST recommendation.
languages:
- java
severity: WARNING
metadata:
functional-categories:
- crypto::search::key-length::java.security
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#RSA_KEY_SIZE
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.5 Insecure Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms
category: security
technology:
- java
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key
shortlink: https://sg.run/4x6x
semgrep.dev:
rule:
r_id: 9200
rv_id: 1263019
rule_id: 0oU5P5
version_id: o5TbDLY
url: https://semgrep.dev/playground/r/o5TbDLY/java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key
origin: community
patterns:
- pattern: |
KeyPairGenerator $KEY = $G.getInstance("RSA");
...
$KEY.initialize($BITS);
- metavariable-comparison:
metavariable: $BITS
comparison: $BITS < 2048
- id: javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled
message: $sceProvider is set to false. Disabling Strict Contextual escaping (SCE)
in an AngularJS application could provide additional attack surface for XSS vulnerabilities.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://docs.angularjs.org/api/ng/service/$sce
- https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
category: security
technology:
- angular
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled
shortlink: https://sg.run/N4DG
semgrep.dev:
rule:
r_id: 9227
rv_id: 1263094
rule_id: EwU20Z
version_id: 5PTo1EW
url: https://semgrep.dev/playground/r/5PTo1EW/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled
origin: community
languages:
- javascript
- typescript
severity: ERROR
pattern: |
$sceProvider.enabled(false);
- id: javascript.browser.security.open-redirect.js-open-redirect
message: The application accepts potentially user-controlled input `$PROP` which
can control the location of the current window context. This can lead two types
of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript
URIs. It is recommended to validate user-controllable input before allowing it
to control the redirection.
options:
interfile: true
metadata:
interfile: true
cwe:
- 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.1 Insecue Redirect
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation
version: '4'
category: security
confidence: HIGH
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html
technology:
- browser
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Open Redirect
source: https://semgrep.dev/r/javascript.browser.security.open-redirect.js-open-redirect
shortlink: https://sg.run/3xRe
semgrep.dev:
rule:
r_id: 9243
rv_id: 1263122
rule_id: WAUopl
version_id: pZT03x0
url: https://semgrep.dev/playground/r/pZT03x0/javascript.browser.security.open-redirect.js-open-redirect
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
new URLSearchParams($WINDOW. ... .location.search).get('...')
- pattern: |
new URLSearchParams(location.search).get('...')
- pattern: |
new URLSearchParams($WINDOW. ... .location.hash.substring(1)).get('...')
- pattern: |
new URLSearchParams(location.hash.substring(1)).get('...')
- patterns:
- pattern-either:
- pattern-inside: |
$PROPS = new URLSearchParams($WINDOW. ... .location.search)
...
- pattern-inside: |
$PROPS = new URLSearchParams(location.search)
...
- pattern-inside: |
$PROPS = new URLSearchParams($WINDOW. ... .location.hash.substring(1))
...
- pattern-inside: |
$PROPS = new URLSearchParams(location.hash.substring(1))
...
- pattern: $PROPS.get('...')
- patterns:
- pattern-either:
- pattern-inside: |
$PROPS = new URL($WINDOW. ... .location.href)
...
- pattern-inside: |
$PROPS = new URL(location.href)
...
- pattern: $PROPS.searchParams.get('...')
- patterns:
- pattern-either:
- pattern: |
new URL($WINDOW. ... .location.href).searchParams.get('...')
- pattern: |
new URL(location.href).searchParams.get('...')
pattern-sinks:
- patterns:
- pattern-either:
- pattern: location.href = $SINK
- pattern: $THIS. ... .location.href = $SINK
- pattern: location.replace($SINK)
- pattern: $THIS. ... .location.replace($SINK)
- pattern: location = $SINK
- pattern: $WINDOW. ... .location = $SINK
- focus-metavariable: $SINK
- metavariable-pattern:
patterns:
- pattern-not: |
"..." + $VALUE
- pattern-not: |
`...${$VALUE}`
metavariable: $SINK
- id: javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
options:
interfile: true
metadata:
interfile: true
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
category: security
technology:
- express
- secrets
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret
shortlink: https://sg.run/Do1d
semgrep.dev:
rule:
r_id: 9252
rv_id: 1263166
rule_id: pKUOjy
version_id: pZT03Q0
url: https://semgrep.dev/playground/r/pZT03Q0/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-either:
- pattern-inside: |
$JWT = require('express-jwt');
...
- pattern-inside: |
import $JWT from 'express-jwt';
...
- pattern-inside: |
import * as $JWT from 'express-jwt';
...
- pattern-inside: |
import { ..., $JWT, ... } from 'express-jwt';
...
- pattern-either:
- pattern: |
$JWT({...,secret: "$Y",...},...)
- pattern: |
$OPTS = "$Y";
...
$JWT({...,secret: $OPTS},...);
- focus-metavariable: $Y
- id: javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
metadata:
interfile: true
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
asvs:
section: 'V3: Session Management Verification Requirements'
control_id: 3.5.2 Static API keys or secret
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
version: '4'
category: security
technology:
- jose
- jwt
- secrets
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret
shortlink: https://sg.run/Ro1g
semgrep.dev:
rule:
r_id: 9293
rv_id: 1263182
rule_id: JDUyRl
version_id: d6TyxbX
url: https://semgrep.dev/playground/r/d6TyxbX/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
$JOSE = require("jose");
...
- pattern-either:
- pattern-inside: |
var {JWT} = $JOSE;
...
- pattern-inside: |
var {JWK, JWT} = $JOSE;
...
- pattern-inside: |
const {JWT} = $JOSE;
...
- pattern-inside: |
const {JWK, JWT} = $JOSE;
...
- pattern-inside: |
let {JWT} = $JOSE;
...
- pattern-inside: |
let {JWK, JWT} = $JOSE;
...
- pattern-either:
- pattern: |
JWT.verify($P, "...", ...);
- pattern: |
JWT.sign($P, "...", ...);
- pattern: "JWT.verify($P, JWK.asKey(\"...\"), ...); \n"
- pattern: |
$JWT.sign($P, JWK.asKey("..."), ...);
options:
symbolic_propagation: true
interfile: true
- id: javascript.jose.security.jwt-none-alg.jwt-none-alg
message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm
assumes the integrity of the token has already been verified. This would allow
a malicious actor to forge a JWT token that will automatically be verified. Do
not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
asvs:
section: 'V3: Session Management Verification Requirements'
control_id: 3.5.3 Insecue Stateless Session Tokens
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
version: '4'
category: security
technology:
- jose
- jwt
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg
shortlink: https://sg.run/AvRL
semgrep.dev:
rule:
r_id: 9294
rv_id: 1263183
rule_id: 5rUOGN
version_id: ZRTKAyb
url: https://semgrep.dev/playground/r/ZRTKAyb/javascript.jose.security.jwt-none-alg.jwt-none-alg
origin: community
languages:
- javascript
- typescript
severity: ERROR
pattern-either:
- pattern: |
var $JOSE = require("jose");
...
var { JWK, JWT } = $JOSE;
...
var $T = JWT.verify($P, JWK.None,...);
- pattern: |
var $JOSE = require("jose");
...
var { JWK, JWT } = $JOSE;
...
$T = JWT.verify($P, JWK.None,...);
- pattern: |
var $JOSE = require("jose");
...
var { JWK, JWT } = $JOSE;
...
JWT.verify($P, JWK.None,...);
- id: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
asvs:
section: 'V3: Session Management Verification Requirements'
control_id: 3.5.2 Static API keys or secret
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
version: '4'
category: security
technology:
- jwt
- javascript
- secrets
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret
shortlink: https://sg.run/4xN9
semgrep.dev:
rule:
r_id: 9300
rv_id: 1263189
rule_id: WAUon7
version_id: gETB75D
url: https://semgrep.dev/playground/r/gETB75D/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern: "$X = '...' \n"
- pattern: "$X = '$Y' \n"
- patterns:
- pattern-either:
- pattern-inside: |
$JWT.sign($DATA,"...",...);
- pattern-inside: |
$JWT.verify($DATA,"...",...);
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
$JWT = require("jsonwebtoken")
...
- pattern-inside: |
import $JWT from "jsonwebtoken"
...
- pattern-inside: |
import * as $JWT from "jsonwebtoken"
...
- pattern-inside: |
import {...,$JWT,...} from "jsonwebtoken"
...
- pattern-either:
- pattern-inside: |
$JWT.sign($DATA,$VALUE,...);
- pattern-inside: |
$JWT.verify($DATA,$VALUE,...);
- focus-metavariable: $VALUE
- id: javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
asvs:
section: 'V3: Session Management Verification Requirements'
control_id: 3.5.2 Static API keys or secret
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
version: '4'
category: security
technology:
- jwt
- nodejs
- secrets
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret
shortlink: https://sg.run/vz70
semgrep.dev:
rule:
r_id: 9333
rv_id: 1263225
rule_id: QrUzq6
version_id: X0TzyoE
url: https://semgrep.dev/playground/r/X0TzyoE/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- by-side-effect: true
patterns:
- pattern-either:
- pattern: |
{..., clientSecret: "...", ...}
- pattern: |
{..., secretOrKey: "...", ...}
- pattern: |
{..., consumerSecret: "...", ...}
- patterns:
- pattern-inside: |
$OBJ = {}
...
- pattern-either:
- pattern: |
$OBJ.clientSecret = "..."
- pattern: |
$OBJ.secretOrKey = "..."
- pattern: |
$OBJ.consumerSecret = "..."
- pattern: $OBJ
- patterns:
- pattern-inside: |
$SECRET = '...'
...
- pattern-either:
- pattern: |
{..., clientSecret: $SECRET, ...}
- pattern: |
{..., secretOrKey: $SECRET, ...}
- pattern: |
{..., consumerSecret: $SECRET, ...}
- patterns:
- pattern-inside: |
$SECRET = '...'
...
- pattern-either:
- pattern-inside: |
$VALUE = {..., clientSecret: $SECRET, ...}
...
- pattern-inside: |
$VALUE = {..., secretOrKey: $SECRET, ...}
...
- pattern-inside: |
$VALUE = {..., consumerSecret: $SECRET, ...}
...
- pattern: $VALUE
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
$F = require("$I").Strategy
...
- pattern-inside: |
$F = require("$I")
...
- pattern-inside: |
import { $STRAT as $F } from '$I'
...
- pattern-inside: |
import $F from '$I'
...
- metavariable-regex:
metavariable: $I
regex: (passport-.*)
- pattern-inside: |
new $F($VALUE,...)
- focus-metavariable: $VALUE
- id: php.lang.security.assert-use.assert-use
mode: taint
pattern-sources:
- pattern-either:
- patterns:
- pattern-either:
- pattern: $_GET
- pattern: $_POST
- pattern: $_COOKIE
- pattern: $_REQUEST
- pattern: $_SERVER
- patterns:
- pattern: |
Route::$METHOD($ROUTENAME, function(..., $ARG, ...) { ... })
- focus-metavariable: $ARG
pattern-sinks:
- patterns:
- pattern: assert($SINK, ...);
- pattern-not: assert("...", ...);
- pattern: $SINK
message: Calling assert with user input is equivalent to eval'ing.
metadata:
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
references:
- https://www.php.net/manual/en/function.assert
- https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/AssertsSniff.php
category: security
technology:
- php
confidence: HIGH
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/php.lang.security.assert-use.assert-use
shortlink: https://sg.run/3xXW
semgrep.dev:
rule:
r_id: 9387
rv_id: 1263272
rule_id: DbUpjk
version_id: 9lT4bLx
url: https://semgrep.dev/playground/r/9lT4bLx/php.lang.security.assert-use.assert-use
origin: community
languages:
- php
severity: ERROR
- id: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host
message: Running flask app with host 0.0.0.0 could expose the server publicly.
metadata:
cwe:
- 'CWE-668: Exposure of Resource to Wrong Sphere'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
category: security
technology:
- flask
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host
shortlink: https://sg.run/eLby
semgrep.dev:
rule:
r_id: 9532
rv_id: 1263414
rule_id: L1Uy1n
version_id: BjTkZOY
url: https://semgrep.dev/playground/r/BjTkZOY/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host
origin: community
languages:
- python
severity: WARNING
pattern-either:
- pattern: app.run(..., host="0.0.0.0", ...)
- pattern: app.run(..., "0.0.0.0", ...)
- id: python.flask.security.audit.debug-enabled.debug-enabled
patterns:
- pattern-inside: |
import flask
...
- pattern: $APP.run(..., debug=True, ...)
message: Detected Flask app with debug=True. Do not deploy to production with this
flag enabled as it will leak sensitive information. Instead, consider using Flask
configuration variables or setting 'debug' using system environment variables.
metadata:
cwe:
- 'CWE-489: Active Debug Code'
owasp: A06:2017 - Security Misconfiguration
references:
- https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/
category: security
technology:
- flask
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Active Debug Code
source: https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled
shortlink: https://sg.run/dKrd
semgrep.dev:
rule:
r_id: 9534
rv_id: 946206
rule_id: gxU1bd
version_id: 8KTKjwR
url: https://semgrep.dev/playground/r/8KTKjwR/python.flask.security.audit.debug-enabled.debug-enabled
origin: community
severity: WARNING
languages:
- python
- id: python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret
message: 'Hardcoded JWT secret or private key is used. This is a Insufficiently
Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html
Consider using an appropriate security mechanism to protect the credentials (e.g.
keeping secrets in environment variables)'
metadata:
cwe:
- 'CWE-522: Insufficiently Protected Credentials'
owasp:
- A02:2017 - Broken Authentication
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
references:
- https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
category: security
technology:
- jwt
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret
shortlink: https://sg.run/l2E9
semgrep.dev:
rule:
r_id: 9557
rv_id: 1263452
rule_id: X5U8P5
version_id: PkTR3X3
url: https://semgrep.dev/playground/r/PkTR3X3/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret
origin: community
patterns:
- pattern: |
jwt.encode($_, "...", ...)
languages:
- python
severity: ERROR
- id: python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces
message: Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose
the server publicly as it binds to all available interfaces. Consider instead
getting correct address from an environment variable or configuration file.
metadata:
cwe:
- 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
category: security
technology:
- python
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces
shortlink: https://sg.run/rdln
semgrep.dev:
rule:
r_id: 9669
rv_id: 1263505
rule_id: OrU3og
version_id: 0bTKzDL
url: https://semgrep.dev/playground/r/0bTKzDL/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces
origin: community
languages:
- python
severity: INFO
pattern-either:
- pattern: |
$S = socket.socket(...)
...
$S.bind(("0.0.0.0", ...))
- pattern: |
$S = socket.socket(...)
...
$S.bind(("::", ...))
- pattern: |
$S = socket.socket(...)
...
$S.bind(("", ...))
- id: python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size
message: Detected an insufficient key size for DSA. NIST recommends a key size of
2048 or higher.
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py
references:
- https://www.pycryptodome.org/src/public_key/dsa
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf
category: security
technology:
- pycryptodome
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
functional-categories:
- crypto::search::key-length::pycryptodome
- crypto::search::key-length::pycryptodomex
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size
shortlink: https://sg.run/4y8l
semgrep.dev:
rule:
r_id: 9688
rv_id: 1263554
rule_id: AbUWje
version_id: JdTzxbQ
url: https://semgrep.dev/playground/r/JdTzxbQ/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size
origin: community
options:
symbolic_propagation: true
languages:
- python
severity: WARNING
patterns:
- pattern-either:
- pattern: Crypto.PublicKey.DSA.generate(..., bits=$SIZE, ...)
- pattern: Crypto.PublicKey.DSA.generate($SIZE, ...)
- pattern: Cryptodome.PublicKey.DSA.generate(..., bits=$SIZE, ...)
- pattern: Cryptodome.PublicKey.DSA.generate($SIZE, ...)
- metavariable-comparison:
metavariable: $SIZE
comparison: $SIZE < 2048
- id: python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size
message: Detected an insufficient key size for RSA. NIST recommends a key size of
3072 or higher.
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py
references:
- https://www.pycryptodome.org/src/public_key/rsa#rsa
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf
category: security
technology:
- pycryptodome
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
functional-categories:
- crypto::search::key-length::pycryptodome
- crypto::search::key-length::pycryptodomex
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size
shortlink: https://sg.run/PprY
semgrep.dev:
rule:
r_id: 9689
rv_id: 1263555
rule_id: BYUBWe
version_id: 5PTo1jL
url: https://semgrep.dev/playground/r/5PTo1jL/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size
origin: community
options:
symbolic_propagation: true
languages:
- python
severity: WARNING
patterns:
- pattern-either:
- pattern: Crypto.PublicKey.RSA.generate(..., bits=$SIZE, ...)
- pattern: Crypto.PublicKey.RSA.generate($SIZE, ...)
- pattern: Cryptodome.PublicKey.RSA.generate(..., bits=$SIZE, ...)
- pattern: Cryptodome.PublicKey.RSA.generate($SIZE, ...)
- metavariable-comparison:
metavariable: $SIZE
comparison: $SIZE < 3072
- id: ruby.lang.security.force-ssl-false.force-ssl-false
message: Checks for configuration setting of force_ssl to false. Force_ssl forces
usage of HTTPS, which could lead to network interception of unencrypted application
traffic. To fix, set config.force_ssl = true.
metadata:
cwe:
- 'CWE-311: Missing Encryption of Sensitive Data'
references:
- https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_force_ssl.rb
category: security
technology:
- ruby
owasp:
- A03:2017 - Sensitive Data Exposure
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/ruby.lang.security.force-ssl-false.force-ssl-false
shortlink: https://sg.run/YgkW
semgrep.dev:
rule:
r_id: 9714
rv_id: 1263605
rule_id: 2ZU4lx
version_id: WrTqKB3
url: https://semgrep.dev/playground/r/WrTqKB3/ruby.lang.security.force-ssl-false.force-ssl-false
origin: community
languages:
- ruby
severity: WARNING
pattern: config.force_ssl = false
fix-regex:
regex: =\s*false
replacement: = true
- id: ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller
patterns:
- pattern-inside: |
class $CONTROLLER < ApplicationController
...
http_basic_authenticate_with ..., :password => "$SECRET", ...
end
- focus-metavariable: $SECRET
message: Detected hardcoded password used in basic authentication in a controller
class. Including this password in version control could expose this credential.
Consider refactoring to use environment variables or configuration files.
severity: WARNING
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/basic_auth/index.markdown
category: security
technology:
- ruby
- secrets
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller
shortlink: https://sg.run/6r0w
semgrep.dev:
rule:
r_id: 9715
rv_id: 1263606
rule_id: X5UZWK
version_id: 0bTKzNK
url: https://semgrep.dev/playground/r/0bTKzNK/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller
origin: community
languages:
- ruby
- id: yaml.docker-compose.security.privileged-service.privileged-service
patterns:
- pattern-inside: |
version: ...
...
services:
...
$SERVICE:
...
privileged: $TRUE
- focus-metavariable: $TRUE
- metavariable-regex:
metavariable: $TRUE
regex: (true)
fix: |
false
message: Service '$SERVICE' is running in privileged mode. This grants the container
the equivalent of root capabilities on the host machine. This can lead to container
escapes, privilege escalation, and other security concerns. Remove the 'privileged'
key to disable this capability.
metadata:
cwe:
- 'CWE-250: Execution with Unnecessary Privileges'
owasp:
- A06:2017 - Security Misconfiguration
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
references:
- https://www.trendmicro.com/en_us/research/19/l/why-running-a-privileged-container-in-docker-is-a-bad-idea.html
- https://containerjournal.com/topics/container-security/why-running-a-privileged-container-is-not-a-good-idea/
category: security
technology:
- docker-compose
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/yaml.docker-compose.security.privileged-service.privileged-service
shortlink: https://sg.run/AlX0
semgrep.dev:
rule:
r_id: 10006
rv_id: 1263922
rule_id: DbUW17
version_id: 0bTKzXZ
url: https://semgrep.dev/playground/r/0bTKzXZ/yaml.docker-compose.security.privileged-service.privileged-service
origin: community
languages:
- yaml
severity: WARNING
- id: csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization
severity: WARNING
languages:
- C#
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
references:
- https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide
category: security
technology:
- .net
confidence: HIGH
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization
shortlink: https://sg.run/ZeXW
semgrep.dev:
rule:
r_id: 11135
rv_id: 1262635
rule_id: bwUOjK
version_id: nWT2LGp
url: https://semgrep.dev/playground/r/nWT2LGp/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization
origin: community
message: The BinaryFormatter type is dangerous and is not recommended for data processing.
Applications should stop using BinaryFormatter as soon as possible, even if they
believe the data they're processing to be trustworthy. BinaryFormatter is insecure
and can't be made secure
patterns:
- pattern-inside: |
using System.Runtime.Serialization.Formatters.Binary;
...
- pattern: |
new BinaryFormatter();
- id: java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse
metadata:
functional-categories:
- crypto::search::randomness::javax.crypto
cwe:
- 'CWE-323: Reusing a Nonce, Key Pair in Encryption'
category: security
source-rule-url: https://www.youtube.com/watch?v=r1awgAl90wM
technology:
- java
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse
shortlink: https://sg.run/Dww2
semgrep.dev:
rule:
r_id: 11908
rv_id: 1263000
rule_id: GdUZZ3
version_id: 0bTKzGk
url: https://semgrep.dev/playground/r/0bTKzGk/java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse
origin: community
languages:
- java
message: 'GCM IV/nonce is reused: encryption can be totally useless'
patterns:
- pattern-either:
- pattern: new GCMParameterSpec(..., "...".getBytes(...), ...);
- pattern: byte[] $NONCE = "...".getBytes(...); ... new GCMParameterSpec(...,
$NONCE, ...);
severity: ERROR
- id: javascript.lang.security.audit.code-string-concat.code-string-concat
message: Found data from an Express or Next web request flowing to `eval`. If this
data is user-controllable this can lead to execution of arbitrary system commands
in the context of your application process. Avoid `eval` whenever possible.
options:
interfile: true
metadata:
interfile: true
confidence: HIGH
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
references:
- https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval
- https://nodejs.org/api/child_process.html#child_processexeccommand-options-callback
- https://www.stackhawk.com/blog/nodejs-command-injection-examples-and-prevention/
- https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_server_side_js_injection.html
category: security
technology:
- node.js
- Express
- Next.js
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/javascript.lang.security.audit.code-string-concat.code-string-concat
shortlink: https://sg.run/96Yk
semgrep.dev:
rule:
r_id: 13023
rv_id: 1263192
rule_id: DbUKEz
version_id: 44TEjYX
url: https://semgrep.dev/playground/r/44TEjYX/javascript.lang.security.audit.code-string-concat.code-string-concat
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- pattern-either:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT)
{...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
import { ...,$IMPORT,... } from 'next/router'
...
- pattern-inside: |
import $IMPORT from 'next/router';
...
- pattern-either:
- patterns:
- pattern-inside: |
$ROUTER = $IMPORT()
...
- pattern-either:
- pattern-inside: |
const { ...,$PROPS,... } = $ROUTER.query
...
- pattern-inside: |
var { ...,$PROPS,... } = $ROUTER.query
...
- pattern-inside: |
let { ...,$PROPS,... } = $ROUTER.query
...
- focus-metavariable: $PROPS
- patterns:
- pattern-inside: |
$ROUTER = $IMPORT()
...
- pattern: "$ROUTER.query.$VALUE \n"
- patterns:
- pattern: $IMPORT().query.$VALUE
pattern-sinks:
- patterns:
- pattern: |
eval(...)
- id: yaml.github-actions.security.run-shell-injection.run-shell-injection
languages:
- yaml
message: 'Using variable interpolation `${{...}}` with `github` context data in
a `run:` step could allow an attacker to inject their own code into the runner.
This would allow them to steal secrets and code. `github` context data can have
arbitrary user input and should be treated as untrusted. Instead, use an intermediate
environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like
this: "$ENVVAR".'
metadata:
category: security
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
- https://securitylab.github.com/research/github-actions-untrusted-input/
technology:
- github-actions
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection
shortlink: https://sg.run/pkzk
semgrep.dev:
rule:
r_id: 13162
rv_id: 1423395
rule_id: v8UjQj
version_id: GxTl1DQ
url: https://semgrep.dev/playground/r/GxTl1DQ/yaml.github-actions.security.run-shell-injection.run-shell-injection
origin: community
patterns:
- pattern-inside: 'steps: [...]'
- pattern-inside: |
- run: ...
...
- pattern: 'run: $SHELL'
- metavariable-pattern:
language: generic
metavariable: $SHELL
patterns:
- pattern-either:
- pattern: ${{ ... github.event.issue.title ... }}
- pattern: ${{ ... github.event.issue.body ... }}
- pattern: ${{ ... github.event.pull_request.title ... }}
- pattern: ${{ ... github.event.pull_request.body ... }}
- pattern: ${{ ... github.event.comment.body ... }}
- pattern: ${{ ... github.event.review.body ... }}
- pattern: ${{ ... github.event.review_comment.body ... }}
- pattern: ${{ ... github.event.pages ... .page_name ... }}
- pattern: ${{ ... github.event.head_commit.message ... }}
- pattern: ${{ ... github.event.head_commit.author.email ... }}
- pattern: ${{ ... github.event.head_commit.author.name ... }}
- pattern: ${{ ... github.event.commits ... .author.email ... }}
- pattern: ${{ ... github.event.commits ... .author.name ... }}
- pattern: ${{ ... github.event.commits ... .message ... }}
- pattern: ${{ ... github.event.pull_request.head.ref ... }}
- pattern: ${{ ... github.event.pull_request.head.label ... }}
- pattern: ${{ ... github.event.pull_request.head.repo.default_branch ...
}}
- pattern: ${{ ... github.ref ... }}
- pattern: ${{ ... github.base_ref ... }}
- pattern: ${{ ... github.head_ref ... }}
- pattern: ${{ ... github.ref_name ... }}
- pattern: ${{ ... github.workflow ... }}
- pattern: ${{ ... github.event.inputs ... }}
- pattern: ${{ ... github.event.discussion.title ... }}
- pattern: ${{ ... github.event.discussion.body ... }}
- pattern: ${{ ... github.event.workflow_run.head_branch ... }}
- pattern: ${{ ... github.event.workflow_run.head_commit.message ... }}
- pattern: ${{ ... github.event.milestone.title ... }}
- pattern: ${{ ... github.event.milestone.description ... }}
- pattern: ${{ ... github.event.project_card.note ... }}
- pattern: ${{ ... github.event.project.name ... }}
- pattern: ${{ ... github.event.project_column.name ... }}
- pattern: ${{ ... github.event.release.name ... }}
- pattern: ${{ ... github.event.release.body ... }}
- pattern: ${{ ... github.event.deployment.ref ... }}
- pattern: ${{ ... inputs ... }}
- pattern-not: ${{ ... github.event.issue.title && ... }}
- pattern-not: ${{ ... github.event.issue.body && ... }}
- pattern-not: ${{ ... github.event.pull_request.title && ... }}
- pattern-not: ${{ ... github.event.pull_request.body && ... }}
- pattern-not: ${{ ... github.event.comment.body && ... }}
- pattern-not: ${{ ... github.event.review.body && ... }}
- pattern-not: ${{ ... github.event.review_comment.body && ... }}
- pattern-not: ${{ ... github.event.pages ... .page_name && ... }}
- pattern-not: ${{ ... github.event.head_commit.message && ... }}
- pattern-not: ${{ ... github.event.head_commit.author.email && ... }}
- pattern-not: ${{ ... github.event.head_commit.author.name && ... }}
- pattern-not: ${{ ... github.event.commits ... .author.email && ... }}
- pattern-not: ${{ ... github.event.commits ... .author.name && ... }}
- pattern-not: ${{ ... github.event.commits ... .message && ... }}
- pattern-not: ${{ ... github.event.pull_request.head.ref && ... }}
- pattern-not: ${{ ... github.event.pull_request.head.label && ... }}
- pattern-not: ${{ ... github.event.pull_request.head.repo.default_branch &&
... }}
- pattern-not: ${{ ... github.event.workflow_run.head_commit.message && ...
}}
- pattern-not: ${{ ... github.ref && ... }}
- pattern-not: ${{ ... github.base_ref && ... }}
- pattern-not: ${{ ... github.head_ref && ... }}
- pattern-not: ${{ ... github.ref_name && ... }}
- pattern-not: ${{ ... github.workflow && ... }}
- pattern-not: ${{ ... github.event.inputs && ... }}
- pattern-not: ${{ ... github.event.discussion.title && ... }}
- pattern-not: ${{ ... github.event.discussion.body && ... }}
- pattern-not: ${{ ... github.event.workflow_run.head_branch && ... }}
- pattern-not: ${{ ... github.event.milestone.title && ... }}
- pattern-not: ${{ ... github.event.milestone.description && ... }}
- pattern-not: ${{ ... github.event.project_card.note && ... }}
- pattern-not: ${{ ... github.event.project.name && ... }}
- pattern-not: ${{ ... github.event.project_column.name && ... }}
- pattern-not: ${{ ... github.event.release.name && ... }}
- pattern-not: ${{ ... github.event.release.body && ... }}
- pattern-not: ${{ ... github.event.deployment.ref && ... }}
severity: ERROR
- id: yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout
languages:
- yaml
message: This GitHub Actions workflow file uses `pull_request_target` and checks
out code from the incoming pull request. When using `pull_request_target`, the
Action runs in the context of the target repository, which includes access to
all repository secrets. Normally, this is safe because the Action only runs code
from the target repository, not the incoming PR. However, by checking out the
incoming PR code, you're now using the incoming code for the rest of the action.
You may be inadvertently executing arbitrary code from the incoming PR with access
to repository secrets, which would let an attacker steal repository secrets. This
normally happens by running build scripts (e.g., `npm build` and `make`) or dependency
installation scripts (e.g., `python setup.py install`). Audit your workflow file
to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
for additional mitigations.
metadata:
category: security
owasp:
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software and Data Integrity Failures
cwe:
- 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere'
references:
- https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
- https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
- https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md
technology:
- github-actions
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout
shortlink: https://sg.run/jkdn
semgrep.dev:
rule:
r_id: 13365
rv_id: 1413423
rule_id: d8Ulkd
version_id: O9TQ2nX
url: https://semgrep.dev/playground/r/O9TQ2nX/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout
origin: community
patterns:
- pattern-either:
- pattern-inside: |
on:
...
pull_request_target: ...
...
...
- pattern-inside: |
on: [..., pull_request_target, ...]
...
- pattern-inside: |
on: pull_request_target
...
- pattern-inside: |
jobs:
...
$JOBNAME:
...
steps:
...
- pattern: |
...
uses: "$ACTION"
with:
...
ref: $EXPR
- metavariable-regex:
metavariable: $ACTION
regex: actions/checkout@.*
- metavariable-pattern:
language: generic
metavariable: $EXPR
patterns:
- pattern-inside: ${{ ... }}
- pattern-either:
- pattern: github.event.pull_request ...
- pattern: github.head_ref ...
severity: ERROR
- id: go.lang.security.injection.tainted-url-host.tainted-url-host
languages:
- go
message: A request was found to be crafted from user-input `$REQUEST`. This can
lead to Server-Side Request Forgery (SSRF) vulnerabilities, potentially exposing
sensitive data. It is recommend where possible to not allow user-input to craft
the base request, but to be treated as part of the path or query parameter. When
user-input is necessary to craft the request, it is recommended to follow OWASP
best practices to prevent abuse, including using an allowlist.
options:
interfile: true
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://goteleport.com/blog/ssrf-attacks/
category: security
technology:
- go
confidence: HIGH
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host
shortlink: https://sg.run/5DjW
semgrep.dev:
rule:
r_id: 14391
rv_id: 1262970
rule_id: AbUQLr
version_id: yeTxpOj
url: https://semgrep.dev/playground/r/yeTxpOj/go.lang.security.injection.tainted-url-host.tainted-url-host
origin: community
mode: taint
pattern-sources:
- label: INPUT
patterns:
- pattern-either:
- pattern: |
($REQUEST : *http.Request).$ANYTHING
- pattern: |
($REQUEST : http.Request).$ANYTHING
- metavariable-regex:
metavariable: $ANYTHING
regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
- label: CLEAN
requires: INPUT
patterns:
- pattern-either:
- pattern: |
"$URLSTR" + $INPUT
- patterns:
- pattern-either:
- pattern: fmt.Fprintf($F, "$URLSTR", $INPUT, ...)
- pattern: fmt.Sprintf("$URLSTR", $INPUT, ...)
- pattern: fmt.Printf("$URLSTR", $INPUT, ...)
- metavariable-regex:
metavariable: $URLSTR
regex: .*//[a-zA-Z0-10]+\..*
pattern-sinks:
- requires: INPUT and not CLEAN
patterns:
- pattern-either:
- patterns:
- pattern-either:
- patterns:
- pattern-inside: |
$CLIENT := &http.Client{...}
...
- pattern: $CLIENT.$METHOD($URL, ...)
- pattern: http.$METHOD($URL, ...)
- metavariable-regex:
metavariable: $METHOD
regex: ^(Get|Head|Post|PostForm)$
- patterns:
- pattern: |
http.NewRequest("$METHOD", $URL, ...)
- metavariable-regex:
metavariable: $METHOD
regex: ^(GET|HEAD|POST|POSTFORM)$
- focus-metavariable: $URL
severity: WARNING
- id: go.lang.security.injection.tainted-sql-string.tainted-sql-string
languages:
- go
message: User data flows into this manually-constructed SQL string. User data can
be safely inserted into SQL strings using prepared statements or an object-relational
mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL
injection, which could let an attacker steal or manipulate data from the database.
Instead, use prepared statements (`db.Query("SELECT * FROM t WHERE id = ?", id)`)
or a safe library.
options:
interfile: true
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://golang.org/doc/database/sql-injection
- https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/
category: security
technology:
- go
confidence: HIGH
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string
shortlink: https://sg.run/PbEq
semgrep.dev:
rule:
r_id: 14689
rv_id: 1409388
rule_id: PeUoqy
version_id: nWTQ5qD
url: https://semgrep.dev/playground/r/nWTQ5qD/go.lang.security.injection.tainted-sql-string.tainted-sql-string
origin: community
mode: taint
severity: ERROR
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
($REQUEST : *http.Request).$ANYTHING
- pattern: |
($REQUEST : http.Request).$ANYTHING
- metavariable-regex:
metavariable: $ANYTHING
regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: |
"$SQLSTR" + ...
- patterns:
- pattern-inside: |
$VAR = "$SQLSTR";
...
- pattern: $VAR += ...
- patterns:
- pattern-inside: |
var $SB strings.Builder
...
- pattern-inside: |
$SB.WriteString("$SQLSTR")
...
$SB.String(...)
- pattern: |
$SB.WriteString(...)
- metavariable-regex:
metavariable: $SQLSTR
regex: (?i)(select|delete|insert|create|update|alter|drop).*
- patterns:
- pattern-either:
- pattern: fmt.Fprintf($F, "$SQLSTR", ...)
- pattern: fmt.Sprintf("$SQLSTR", ...)
- pattern: fmt.Printf("$SQLSTR", ...)
- metavariable-regex:
metavariable: $SQLSTR
regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).*
pattern-sanitizers:
- pattern-either:
- pattern: strconv.Atoi(...)
- pattern: |
($X: bool)
- id: scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret
languages:
- scala
message: 'Hardcoded JWT secret or private key is used. This is a Insufficiently
Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html
Consider using an appropriate security mechanism to protect the credentials (e.g.
keeping secrets in environment variables)'
metadata:
category: security
cwe:
- 'CWE-522: Insufficiently Protected Credentials'
owasp:
- A02:2017 - Broken Authentication
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
technology:
- jwt
confidence: HIGH
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
cwe2021-top25: true
subcategory:
- audit
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret
shortlink: https://sg.run/Z40o
semgrep.dev:
rule:
r_id: 15079
rv_id: 1263691
rule_id: OrU6W1
version_id: 7ZTE3kr
url: https://semgrep.dev/playground/r/7ZTE3kr/scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret
origin: community
pattern-either:
- pattern: |
com.auth0.jwt.algorithms.Algorithm.HMAC256("...");
- pattern: |
$SECRET = "...";
...
com.auth0.jwt.algorithms.Algorithm.HMAC256($SECRET);
- pattern: |
class $CLASS {
...
$DECL $SECRET = "...";
...
def $FUNC (...): $RETURNTYPE = {
...
com.auth0.jwt.algorithms.Algorithm.HMAC256($SECRET);
...
}
...
}
- pattern: |
com.auth0.jwt.algorithms.Algorithm.HMAC384("...");
- pattern: |
$SECRET = "...";
...
com.auth0.jwt.algorithms.Algorithm.HMAC384($SECRET);
- pattern: |
class $CLASS {
...
$DECL $SECRET = "...";
...
def $FUNC (...): $RETURNTYPE = {
...
com.auth0.jwt.algorithms.Algorithm.HMAC384($SECRET);
...
}
...
}
- pattern: |
com.auth0.jwt.algorithms.Algorithm.HMAC512("...");
- pattern: |
$SECRET = "...";
...
com.auth0.jwt.algorithms.Algorithm.HMAC512($SECRET);
- pattern: |
class $CLASS {
...
$DECL $SECRET = "...";
...
def $FUNC (...): $RETURNTYPE = {
...
com.auth0.jwt.algorithms.Algorithm.HMAC512($SECRET);
...
}
...
}
severity: ERROR
- id: terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy
message: Detected an AppService that was not configured to use TLS 1.2. Add `site_config.min_tls_version
= "1.2"` in your resource block.
patterns:
- pattern: min_tls_version = $ANYTHING
- pattern-inside: |
resource "azurerm_app_service" "$NAME" {
...
}
- pattern-not-inside: min_tls_version = "1.2"
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
category: security
technology:
- terraform
- azure
references:
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#min_tls_version
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy
shortlink: https://sg.run/AXRp
semgrep.dev:
rule:
r_id: 15106
rv_id: 1263759
rule_id: YGUDbZ
version_id: RGT0L4x
url: https://semgrep.dev/playground/r/RGT0L4x/terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy
origin: community
languages:
- hcl
severity: ERROR
- id: kotlin.lang.security.weak-rsa.use-of-weak-rsa-key
message: RSA keys should be at least 2048 bits based on NIST recommendation.
languages:
- kt
severity: WARNING
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#RSA_KEY_SIZE
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.5 Insecure Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms
category: security
technology:
- kotlin
subcategory:
- audit
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/kotlin.lang.security.weak-rsa.use-of-weak-rsa-key
shortlink: https://sg.run/krq7
semgrep.dev:
rule:
r_id: 15128
rv_id: 1263269
rule_id: nJUZNL
version_id: X0TzypE
url: https://semgrep.dev/playground/r/X0TzypE/kotlin.lang.security.weak-rsa.use-of-weak-rsa-key
origin: community
patterns:
- pattern-either:
- pattern: |
$KEY = $G.getInstance("RSA")
...
$KEY.initialize($BITS)
- metavariable-comparison:
metavariable: $BITS
comparison: $BITS < 2048
- id: scala.lang.security.audit.rsa-padding-set.rsa-padding-set
metadata:
cwe:
- 'CWE-780: Use of RSA Algorithm without OAEP'
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
category: security
technology:
- scala
- cryptography
resources:
- https://blog.codacy.com/9-scala-security-issues/
confidence: HIGH
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/scala.lang.security.audit.rsa-padding-set.rsa-padding-set
shortlink: https://sg.run/GO5p
semgrep.dev:
rule:
r_id: 15192
rv_id: 1263677
rule_id: 3qUj1Q
version_id: yeTxpoX
url: https://semgrep.dev/playground/r/yeTxpoX/scala.lang.security.audit.rsa-padding-set.rsa-padding-set
origin: community
message: Usage of RSA without OAEP (Optimal Asymmetric Encryption Padding) may weaken
encryption. This could lead to sensitive data exposure. Instead, use RSA with
`OAEPWithMD5AndMGF1Padding` instead.
severity: WARNING
languages:
- scala
patterns:
- pattern: |
$VAR = $CIPHER.getInstance($MODE)
- metavariable-regex:
metavariable: $MODE
regex: .*RSA/.*/NoPadding.*
- id: generic.ci.security.bash-reverse-shell.bash_reverse_shell
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
category: security
technology:
- ci
confidence: HIGH
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
subcategory:
- audit
likelihood: MEDIUM
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/generic.ci.security.bash-reverse-shell.bash_reverse_shell
shortlink: https://sg.run/4l9l
semgrep.dev:
rule:
r_id: 16200
rv_id: 1262664
rule_id: gxUJrJ
version_id: jQTn5QE
url: https://semgrep.dev/playground/r/jQTn5QE/generic.ci.security.bash-reverse-shell.bash_reverse_shell
origin: community
message: Semgrep found a bash reverse shell
severity: ERROR
languages:
- generic
pattern-either:
- pattern: |
sh -i >& /dev/udp/.../... 0>&1
- pattern: |
<...>/dev/tcp/.../...; sh <&... >&... 2>&
- pattern: |
<...>/dev/tcp/.../...; cat <&... | while read line; do $line 2>&... >&...;done
- pattern: |
sh -i ...<...> /dev/tcp/.../... ...<&... 1>&... 2>&
- id: java.lang.security.audit.crypto.use-of-md5.use-of-md5
message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision
resistant and is therefore not suitable as a cryptographic signature. Use HMAC
instead.
languages:
- java
severity: WARNING
metadata:
functional-categories:
- crypto::search::hash-algorithm::java.security
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-328: Use of Weak Hash'
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_MD5
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5.use-of-md5
shortlink: https://sg.run/ryJn
semgrep.dev:
rule:
r_id: 17325
rv_id: 1263013
rule_id: KxU5lW
version_id: 0bTKzGX
url: https://semgrep.dev/playground/r/0bTKzGX/java.lang.security.audit.crypto.use-of-md5.use-of-md5
origin: community
patterns:
- pattern: |
java.security.MessageDigest.getInstance($ALGO, ...);
- metavariable-regex:
metavariable: $ALGO
regex: (?i)(.MD5.)
- focus-metavariable: $ALGO
fix: |
"SHA-512"
- id: java.lang.security.audit.crypto.use-of-sha1.use-of-sha1
message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not
collision resistant and is therefore not suitable as a cryptographic signature.
Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function
applications.
languages:
- java
severity: WARNING
metadata:
functional-categories:
- crypto::search::hash-algorithm::javax.crypto
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-328: Use of Weak Hash'
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_SHA1
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.5 Insecure Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1
shortlink: https://sg.run/bXNp
semgrep.dev:
rule:
r_id: 17326
rv_id: 1263016
rule_id: qNUWNn
version_id: l4TJRpL
url: https://semgrep.dev/playground/r/l4TJRpL/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1
origin: community
pattern-either:
- patterns:
- pattern: |
java.security.MessageDigest.getInstance("$ALGO", ...);
- metavariable-regex:
metavariable: $ALGO
regex: (SHA1|SHA-1)
- pattern: |
$DU.getSha1Digest().digest(...)
- id: java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request
message: Detected input from a HTTPServletRequest going into a SQL sink or statement.
This could lead to SQL injection if variables in the SQL statement are not properly
sanitized. Use parameterized SQL queries or properly sanitize user input instead.
severity: WARNING
metadata:
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
category: security
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
cwe2021-top25: true
cwe2022-top25: true
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
- https://owasp.org/www-community/attacks/SQL_Injection
subcategory:
- vuln
technology:
- sql
- java
- servlets
- spring
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request
shortlink: https://sg.run/Lg56
semgrep.dev:
rule:
r_id: 18239
rv_id: 1409390
rule_id: oqUBJG
version_id: 7ZTKJNj
url: https://semgrep.dev/playground/r/7ZTKJNj/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request
origin: community
languages:
- java
mode: taint
options:
taint_assume_safe_numbers: true
taint_assume_safe_booleans: true
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
(HttpServletRequest $REQ).$REQFUNC(...)
- pattern: "(ServletRequest $REQ).$REQFUNC(...) \n"
- metavariable-regex:
metavariable: $REQFUNC
regex: (getInputStream|getParameter|getParameterMap|getParameterValues|getReader|getCookies|getHeader|getHeaderNames|getHeaders|getPart|getParts|getQueryString)
pattern-sinks:
- patterns:
- pattern-either:
- pattern: "(java.sql.CallableStatement $STMT) = ...; \n"
- pattern: |
(java.sql.Statement $STMT) = ...;
...
$OUTPUT = $STMT.$FUNC(...);
- pattern: |
(java.sql.PreparedStatement $STMT) = ...;
- pattern: |
$VAR = $CONN.prepareStatement(...)
- pattern: |
$PATH.queryForObject(...);
- pattern: |
(java.util.Map<String, Object> $STMT) = $PATH.queryForMap(...);
- pattern: |
(org.springframework.jdbc.support.rowset.SqlRowSet $STMT) = ...;
- pattern: |
(org.springframework.jdbc.core.JdbcTemplate $TEMPL).batchUpdate(...)
- patterns:
- pattern-inside: |
(String $SQL) = "$SQLSTR" + ...;
...
- pattern: $PATH.$SQLCMD(..., $SQL, ...);
- metavariable-regex:
metavariable: $SQLSTR
regex: (?i)(^SELECT.* | ^INSERT.* | ^UPDATE.*)
- metavariable-regex:
metavariable: $SQLCMD
regex: (execute|query|executeUpdate|batchUpdate)
- id: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false
severity: ERROR
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://blog.sonarsource.com/secure-xml-processor
- https://xerces.apache.org/xerces2-j/features.html
category: security
technology:
- java
- xml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false
shortlink: https://sg.run/4Dv5
semgrep.dev:
rule:
r_id: 18244
rv_id: 1263057
rule_id: j2UrJ8
version_id: 0bTKzgX
url: https://semgrep.dev/playground/r/0bTKzgX/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false
origin: community
message: DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external
entity declarations, this is vulnerable to XML external entity attacks. Disable
this by setting the feature "http://apache.org/xml/features/disallow-doctype-decl"
to true. Alternatively, allow DOCTYPE declarations and only prohibit external
entities declarations. This can be done by setting the features "http://xml.org/sax/features/external-general-entities"
and "http://xml.org/sax/features/external-parameter-entities" to false.
patterns:
- pattern: $DBFACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl",
false);
- pattern-not-inside: |
$RETURNTYPE $METHOD(...){
...
$DBF.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
$DBF.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
}
- pattern-not-inside: |
$RETURNTYPE $METHOD(...){
...
$DBF.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
$DBF.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
}
- pattern-not-inside: |
$RETURNTYPE $METHOD(...){
...
$DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
...
$DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
...
}
- pattern-not-inside: |
$RETURNTYPE $METHOD(...){
...
$DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
...
$DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
...
}
languages:
- java
- id: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing
severity: ERROR
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://blog.sonarsource.com/secure-xml-processor
- https://xerces.apache.org/xerces2-j/features.html
category: security
technology:
- java
- xml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing
shortlink: https://sg.run/PYBz
semgrep.dev:
rule:
r_id: 18245
rv_id: 1263058
rule_id: 10UPQB
version_id: K3TKk80
url: https://semgrep.dev/playground/r/K3TKk80/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing
origin: community
message: DOCTYPE declarations are enabled for this DocumentBuilderFactory. This
is vulnerable to XML external entity attacks. Disable this by setting the feature
"http://apache.org/xml/features/disallow-doctype-decl" to true. Alternatively,
allow DOCTYPE declarations and only prohibit external entities declarations. This
can be done by setting the features "http://xml.org/sax/features/external-general-entities"
and "http://xml.org/sax/features/external-parameter-entities" to false.
mode: taint
pattern-sources:
- by-side-effect: true
patterns:
- pattern-either:
- pattern: |
$FACTORY = DocumentBuilderFactory.newInstance();
- patterns:
- pattern: $FACTORY
- pattern-inside: |
class $C {
...
$V $FACTORY = DocumentBuilderFactory.newInstance();
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = DocumentBuilderFactory.newInstance();
static {
...
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
...
}
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = DocumentBuilderFactory.newInstance();
static {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
}
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = DocumentBuilderFactory.newInstance();
static {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
}
...
}
pattern-sinks:
- patterns:
- pattern: $FACTORY.newDocumentBuilder();
pattern-sanitizers:
- by-side-effect: true
pattern-either:
- patterns:
- pattern-either:
- pattern: |
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
- pattern: |
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
- pattern: |
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
- focus-metavariable: $FACTORY
- patterns:
- pattern-either:
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl",
true);
...
}
...
}
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
}
...
}
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities",false);
...
}
...
}
- pattern: $M($X)
- focus-metavariable: $X
fix: |
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
$FACTORY.newDocumentBuilder();
languages:
- java
- id: java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true
severity: ERROR
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://blog.sonarsource.com/secure-xml-processor
category: security
technology:
- java
- xml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true
shortlink: https://sg.run/JgPy
semgrep.dev:
rule:
r_id: 18246
rv_id: 1263059
rule_id: 9AUJ6r
version_id: qkTR7Lk
url: https://semgrep.dev/playground/r/qkTR7Lk/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true
origin: community
message: External entities are allowed for $DBFACTORY. This is vulnerable to XML
external entity attacks. Disable this by setting the feature "http://xml.org/sax/features/external-general-entities"
to false.
pattern: $DBFACTORY.setFeature("http://xml.org/sax/features/external-general-entities",
true);
fix: $DBFACTORY.setFeature("http://xml.org/sax/features/external-general-entities",
false);
languages:
- java
- id: java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true
severity: ERROR
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://blog.sonarsource.com/secure-xml-processor
category: security
technology:
- java
- xml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true
shortlink: https://sg.run/5Lv0
semgrep.dev:
rule:
r_id: 18247
rv_id: 1263060
rule_id: yyUNeo
version_id: l4TJRoL
url: https://semgrep.dev/playground/r/l4TJRoL/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true
origin: community
message: External entities are allowed for $DBFACTORY. This is vulnerable to XML
external entity attacks. Disable this by setting the feature "http://xml.org/sax/features/external-parameter-entities"
to false.
pattern: $DBFACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities",
true);
fix: $DBFACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities",
false);
languages:
- java
- id: scala.play.security.tainted-slick-sqli.tainted-slick-sqli
mode: taint
metadata:
references:
- https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values
- https://scala-slick.org/doc/3.2.0/sql-to-slick.html#non-optimal-sql-code
category: security
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
technology:
- scala
- slick
- play
confidence: HIGH
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/scala.play.security.tainted-slick-sqli.tainted-slick-sqli
shortlink: https://sg.run/k9K2
semgrep.dev:
rule:
r_id: 18328
rv_id: 1263687
rule_id: GdUDWO
version_id: d6TyxJe
url: https://semgrep.dev/playground/r/d6TyxJe/scala.play.security.tainted-slick-sqli.tainted-slick-sqli
origin: community
message: Detected a tainted SQL statement. This could lead to SQL injection if variables
in the SQL statement are not properly sanitized. Avoid using using user input
for generating SQL strings.
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern: $REQ
- pattern-either:
- pattern-inside: "Action {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action(...) {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action.async {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action.async(...) {\n $REQ: Request[$T] => \n ...\n}\n"
- patterns:
- pattern: $PARAM
- pattern-either:
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action(...) {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action.async {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action.async(...) {
...
}
pattern-sinks:
- patterns:
- pattern-either:
- pattern: $MODEL.overrideSql(...)
- pattern: sql"..."
- pattern-inside: |
import slick.$DEPS
...
severity: ERROR
languages:
- scala
- id: php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv
patterns:
- pattern-either:
- pattern: openssl_encrypt($D, $M, $K, $FLAGS, "...",...);
- pattern: openssl_decrypt($D, $M, $K, $FLAGS, "...",...);
- metavariable-comparison:
metavariable: $M
comparison: re.match(".*-CBC",$M)
message: Static IV used with AES in CBC mode. Static IVs enable chosen-plaintext
attacks against encrypted data.
languages:
- php
severity: ERROR
metadata:
cwe:
- 'CWE-329: Generation of Predictable IV with CBC Mode'
references:
- https://csrc.nist.gov/publications/detail/sp/800-38a/final
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
technology:
- php
- openssl
category: security
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv
shortlink: https://sg.run/LgWJ
semgrep.dev:
rule:
r_id: 19039
rv_id: 1263295
rule_id: DbUGbE
version_id: JdTzxOD
url: https://semgrep.dev/playground/r/JdTzxOD/php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv
origin: community
- id: scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode
patterns:
- pattern-inside: |
import pdi.jwt.$DEPS
...
- pattern-either:
- pattern: $JWT.encode($X, "...", ...)
- pattern: $JWT.decode($X, "...", ...)
- pattern: $JWT.decodeRawAll($X, "...", ...)
- pattern: $JWT.decodeRaw($X, "...", ...)
- pattern: $JWT.decodeAll($X, "...", ...)
- pattern: $JWT.validate($X, "...", ...)
- pattern: $JWT.isValid($X, "...", ...)
- pattern: $JWT.decodeJson($X, "...", ...)
- pattern: $JWT.decodeJsonAll($X, "...", ...)
- patterns:
- pattern-either:
- pattern: $JWT.encode($X, $KEY, ...)
- pattern: $JWT.decode($X, $KEY, ...)
- pattern: $JWT.decodeRawAll($X, $KEY, ...)
- pattern: $JWT.decodeRaw($X, $KEY, ...)
- pattern: $JWT.decodeAll($X, $KEY, ...)
- pattern: $JWT.validate($X, $KEY, ...)
- pattern: $JWT.isValid($X, $KEY, ...)
- pattern: $JWT.decodeJson($X, $KEY, ...)
- pattern: $JWT.decodeJsonAll($X, $KEY, ...)
- pattern: $JWT.encode($X, this.$KEY, ...)
- pattern: $JWT.decode($X, this.$KEY, ...)
- pattern: $JWT.decodeRawAll($X, this.$KEY, ...)
- pattern: $JWT.decodeRaw($X, this.$KEY, ...)
- pattern: $JWT.decodeAll($X, this.$KEY, ...)
- pattern: $JWT.validate($X, this.$KEY, ...)
- pattern: $JWT.isValid($X, this.$KEY, ...)
- pattern: $JWT.decodeJson($X, this.$KEY, ...)
- pattern: $JWT.decodeJsonAll($X, this.$KEY, ...)
- pattern-either:
- pattern-inside: |
class $CL {
...
$KEY = "..."
...
}
- pattern-inside: |
object $CL {
...
$KEY = "..."
...
}
- metavariable-pattern:
metavariable: $JWT
patterns:
- pattern-either:
- pattern: Jwt
- pattern: JwtArgonaut
- pattern: JwtCirce
- pattern: JwtJson4s
- pattern: JwtJson
- pattern: JwtUpickle
message: 'Hardcoded JWT secret or private key is used. This is a Insufficiently
Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html
Consider using an appropriate security mechanism to protect the credentials (e.g.
keeping secrets in environment variables)'
languages:
- scala
severity: WARNING
metadata:
references:
- https://jwt-scala.github.io/jwt-scala/
category: security
cwe:
- 'CWE-522: Insufficiently Protected Credentials'
owasp:
- A02:2017 - Broken Authentication
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
technology:
- scala
confidence: HIGH
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode
shortlink: https://sg.run/8zE7
semgrep.dev:
rule:
r_id: 19040
rv_id: 1263669
rule_id: WAUdK0
version_id: o5TbDA8
url: https://semgrep.dev/playground/r/o5TbDA8/scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode
origin: community
- id: scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled
patterns:
- pattern-either:
- pattern: |
$DF = DocumentBuilderFactory.newInstance(...)
...
$DB = $DF.newDocumentBuilder(...)
- patterns:
- pattern: $DB = DocumentBuilderFactory.newInstance(...)
- pattern-not-inside: |
...
$X = $DB.newDocumentBuilder(...)
- pattern: $DB = DocumentBuilderFactory.newInstance(...).newDocumentBuilder(...)
- pattern-not-inside: |
...
$DB.setXIncludeAware(true)
...
$DB.setNamespaceAware(true)
...
$DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
...
$DB.setFeature("http://xml.org/sax/features/external-general-entities", false)
...
$DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
- pattern-not-inside: |
...
$DB.setXIncludeAware(true)
...
$DB.setNamespaceAware(true)
...
$DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
...
$DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
...
$DB.setFeature("http://xml.org/sax/features/external-general-entities", false)
- pattern-not-inside: |
...
$DB.setXIncludeAware(true)
...
$DB.setNamespaceAware(true)
...
$DB.setFeature("http://xml.org/sax/features/external-general-entities", false)
...
$DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
...
$DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
- pattern-not-inside: |
...
$DB.setXIncludeAware(true)
...
$DB.setNamespaceAware(true)
...
$DB.setFeature("http://xml.org/sax/features/external-general-entities", false)
...
$DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
...
$DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
message: Document Builder being instantiated without calling the `setFeature` functions
that are generally used for disabling entity processing. User controlled data
in XML Document builder can result in XML Internal Entity Processing vulnerabilities
like the disclosure of confidential data, denial of service, Server Side Request
Forgery (SSRF), port scanning. Make sure to disable entity processing functionality.
languages:
- scala
severity: WARNING
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
category: security
technology:
- scala
confidence: HIGH
references:
- https://owasp.org/Top10/A05_2021-Security_Misconfiguration
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled
shortlink: https://sg.run/gRQn
semgrep.dev:
rule:
r_id: 19041
rv_id: 1263673
rule_id: 0oUwzP
version_id: X0TzyRq
url: https://semgrep.dev/playground/r/X0TzyRq/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled
origin: community
- id: scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled
patterns:
- pattern-either:
- pattern: $SR = new SAXReader(...)
- pattern: |
$SF = SAXParserFactory.newInstance(...)
...
$SR = $SF.newSAXParser(...)
- patterns:
- pattern: $SR = SAXParserFactory.newInstance(...)
- pattern-not-inside: |
...
$X = $SR.newSAXParser(...)
- pattern: $SR = SAXParserFactory.newInstance(...).newSAXParser(...)
- pattern: $SR = new SAXBuilder(...)
- pattern-not-inside: |
...
$SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
...
$SR.setFeature("http://xml.org/sax/features/external-general-entities", false)
...
$SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
- pattern-not-inside: |
...
$SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
...
$SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
...
$SR.setFeature("http://xml.org/sax/features/external-general-entities", false)
- pattern-not-inside: |
...
$SR.setFeature("http://xml.org/sax/features/external-general-entities", false)
...
$SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
...
$SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
- pattern-not-inside: |
...
$SR.setFeature("http://xml.org/sax/features/external-general-entities", false)
...
$SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
...
$SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
message: XML processor being instantiated without calling the `setFeature` functions
that are generally used for disabling entity processing. User controlled data
in XML Parsers can result in XML Internal Entity Processing vulnerabilities like
the disclosure of confidential data, denial of service, Server Side Request Forgery
(SSRF), port scanning. Make sure to disable entity processing functionality.
languages:
- scala
severity: WARNING
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
category: security
technology:
- scala
confidence: HIGH
references:
- https://owasp.org/Top10/A05_2021-Security_Misconfiguration
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled
shortlink: https://sg.run/QbYP
semgrep.dev:
rule:
r_id: 19042
rv_id: 1263678
rule_id: KxUrkq
version_id: rxTAKWY
url: https://semgrep.dev/playground/r/rxTAKWY/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled
origin: community
- id: scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled
patterns:
- pattern-not-inside: |
...
$XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", false)
- pattern-either:
- pattern: $XMLFACTORY = XMLInputFactory.newFactory(...)
- pattern: $XMLFACTORY = XMLInputFactory.newInstance(...)
- pattern: $XMLFACTORY = new XMLInputFactory(...)
message: XMLInputFactory being instantiated without calling the setProperty functions
that are generally used for disabling entity processing. User controlled data
in XML Document builder can result in XML Internal Entity Processing vulnerabilities
like the disclosure of confidential data, denial of service, Server Side Request
Forgery (SSRF), port scanning. Make sure to disable entity processing functionality.
languages:
- scala
severity: WARNING
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
category: security
technology:
- scala
confidence: HIGH
references:
- https://owasp.org/Top10/A05_2021-Security_Misconfiguration
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled
shortlink: https://sg.run/3BEb
semgrep.dev:
rule:
r_id: 19043
rv_id: 1263683
rule_id: qNUQ7w
version_id: xyTjzkA
url: https://semgrep.dev/playground/r/xyTjzkA/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled
origin: community
- id: terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version
pattern: |
resource "aws_elasticsearch_domain" $ANYTHING {
...
domain_endpoint_options {
...
enforce_https = true
tls_security_policy = "Policy-Min-TLS-1-0-2019-07"
...
}
...
}
message: Detected an AWS Elasticsearch domain using an insecure version of TLS.
To fix this, set "tls_security_policy" equal to "Policy-Min-TLS-1-2-2019-07".
languages:
- terraform
severity: WARNING
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
category: security
technology:
- aws
- terraform
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version
shortlink: https://sg.run/PYlq
semgrep.dev:
rule:
r_id: 19045
rv_id: 1263718
rule_id: YGUle7
version_id: DkTRbA5
url: https://semgrep.dev/playground/r/DkTRbA5/terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version
origin: community
- id: scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request
languages:
- scala
severity: ERROR
mode: taint
message: User data flows into this manually-constructed SQL string. User data can
be safely inserted into SQL strings using prepared statements or an object-relational
mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL
injection, which could let an attacker steal or manipulate data from the database.
Instead, use prepared statements (`connection.PreparedStatement`) or a safe library.
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html
category: security
technology:
- scala
- play
confidence: HIGH
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request
shortlink: https://sg.run/BeW9
semgrep.dev:
rule:
r_id: 20051
rv_id: 1263688
rule_id: 0oUpon
version_id: ZRTKAoG
url: https://semgrep.dev/playground/r/ZRTKAoG/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request
origin: community
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern: $REQ
- pattern-either:
- pattern-inside: "Action {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action(...) {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action.async {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action.async(...) {\n $REQ: Request[$T] => \n ...\n}\n"
- patterns:
- pattern: $PARAM
- pattern-either:
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action(...) {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action.async {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action.async(...) {
...
}
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: |
"$SQLSTR" + ...
- pattern: |
"$SQLSTR".format(...)
- patterns:
- pattern-inside: |
$SB = new StringBuilder("$SQLSTR");
...
- pattern: $SB.append(...)
- patterns:
- pattern-inside: |
$VAR = "$SQLSTR"
...
- pattern: $VAR += ...
- metavariable-regex:
metavariable: $SQLSTR
regex: (?i)(select|delete|insert|create|update|alter|drop)\b
- patterns:
- pattern: s"..."
- pattern-regex: |
.*\b(?i)(select|delete|insert|create|update|alter|drop)\b.*
- pattern-not-inside: println(...)
- id: ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase
message: Found the use of an hardcoded passphrase for RSA. The passphrase can be
easily discovered, and therefore should not be stored in source-code. It is recommended
to remove the passphrase from source-code, and use system environment variables
or a restricted configuration file.
languages:
- ruby
severity: WARNING
metadata:
technology:
- ruby
- secrets
category: security
references:
- https://cwe.mitre.org/data/definitions/522.html
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase
shortlink: https://sg.run/xPEe
semgrep.dev:
rule:
r_id: 20730
rv_id: 1263607
rule_id: bwULyN
version_id: K3TKkEo
url: https://semgrep.dev/playground/r/K3TKkEo/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase
origin: community
patterns:
- pattern-either:
- pattern: OpenSSL::PKey::RSA.new(..., '...')
- pattern: OpenSSL::PKey::RSA.new(...).to_pem(..., '...')
- pattern: OpenSSL::PKey::RSA.new(...).export(..., '...')
- patterns:
- pattern-inside: |
$OPENSSL = OpenSSL::PKey::RSA.new(...)
...
- pattern-either:
- pattern: |
$OPENSSL.export(...,'...')
- pattern: |
$OPENSSL.to_pem(...,'...')
- patterns:
- pattern-either:
- patterns:
- pattern-inside: |
$ASSIGN = '...'
...
- pattern: OpenSSL::PKey::RSA.new(..., $ASSIGN)
- patterns:
- pattern-inside: |
def $METHOD1(...)
...
$ASSIGN = '...'
...
end
...
def $METHOD2(...)
...
end
- pattern: OpenSSL::PKey::RSA.new(..., $ASSIGN)
- patterns:
- pattern-inside: |
$ASSIGN = '...'
...
def $METHOD(...)
$OPENSSL = OpenSSL::PKey::RSA.new(...)
...
end
...
- pattern-either:
- pattern: $OPENSSL.export(...,$ASSIGN)
- pattern: $OPENSSL.to_pem(...,$ASSIGN)
- patterns:
- pattern-inside: |
def $METHOD1(...)
...
$OPENSSL = OpenSSL::PKey::RSA.new(...)
...
$ASSIGN = '...'
...
end
...
- pattern-either:
- pattern: $OPENSSL.export(...,$ASSIGN)
- pattern: $OPENSSL.to_pem(...,$ASSIGN)
- patterns:
- pattern-inside: |
def $METHOD1(...)
...
$ASSIGN = '...'
...
end
...
def $METHOD2(...)
...
$OPENSSL = OpenSSL::PKey::RSA.new(...)
...
end
...
- pattern-either:
- pattern: $OPENSSL.export(...,$ASSIGN)
- pattern: $OPENSSL.to_pem(...,$ASSIGN)
- id: ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size
message: The RSA key size $SIZE is insufficent by NIST standards. It is recommended
to use a key length of 2048 or higher.
languages:
- ruby
severity: WARNING
metadata:
technology:
- ruby
category: security
references:
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size
shortlink: https://sg.run/O4Re
semgrep.dev:
rule:
r_id: 20731
rv_id: 1263608
rule_id: NbUe4N
version_id: qkTR76v
url: https://semgrep.dev/playground/r/qkTR76v/ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size
origin: community
patterns:
- pattern-either:
- pattern: OpenSSL::PKey::RSA.generate($SIZE,...)
- pattern: OpenSSL::PKey::RSA.new($SIZE, ...)
- patterns:
- pattern-either:
- patterns:
- pattern-inside: |
$ASSIGN = $SIZE
...
- pattern-either:
- pattern: OpenSSL::PKey::RSA.new($ASSIGN, ...)
- pattern: OpenSSL::PKey::RSA.generate($ASSIGN, ...)
- patterns:
- pattern-inside: |
def $METHOD1(...)
...
$ASSIGN = $SIZE
...
end
...
- pattern-either:
- pattern: OpenSSL::PKey::RSA.new($ASSIGN, ...)
- pattern: OpenSSL::PKey::RSA.generate($ASSIGN, ...)
- metavariable-comparison:
metavariable: $SIZE
comparison: $SIZE < 2048
- id: java.spring.security.injection.tainted-file-path.tainted-file-path
languages:
- java
severity: ERROR
message: Detected user input controlling a file path. An attacker could control
the location of this file, to include going backwards in the directory with '../'.
To address this, ensure that user-controlled variables in file paths are sanitized.
You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...)
to only retrieve the file name from the path.
options:
interfile: true
metadata:
cwe:
- 'CWE-23: Relative Path Traversal'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://owasp.org/www-community/attacks/Path_Traversal
category: security
technology:
- java
- spring
subcategory:
- vuln
impact: HIGH
likelihood: MEDIUM
confidence: HIGH
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/java.spring.security.injection.tainted-file-path.tainted-file-path
shortlink: https://sg.run/x9o0
semgrep.dev:
rule:
r_id: 22074
rv_id: 1263084
rule_id: lBUxok
version_id: ExTEx6Y
url: https://semgrep.dev/playground/r/ExTEx6Y/java.spring.security.injection.tainted-file-path.tainted-file-path
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
$METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {
...
}
- pattern-inside: |
$METHODNAME(..., @$REQ $TYPE $SOURCE,...) {
...
}
- metavariable-regex:
metavariable: $TYPE
regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean))
- metavariable-regex:
metavariable: $REQ
regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute)
- focus-metavariable: $SOURCE
pattern-sinks:
- patterns:
- pattern-either:
- pattern: new File(...)
- pattern: new java.io.File(...)
- pattern: new FileReader(...)
- pattern: new java.io.FileReader(...)
- pattern: new FileInputStream(...)
- pattern: new java.io.FileInputStream(...)
- pattern: (Paths $PATHS).get(...)
- patterns:
- pattern: |
$CLASS.$FUNC(...)
- metavariable-regex:
metavariable: $FUNC
regex: ^(getResourceAsStream|getResource)$
- patterns:
- pattern-either:
- pattern: new ClassPathResource($FILE, ...)
- pattern: ResourceUtils.getFile($FILE, ...)
- pattern: new FileOutputStream($FILE, ...)
- pattern: new java.io.FileOutputStream($FILE, ...)
- pattern: new StreamSource($FILE, ...)
- pattern: new javax.xml.transform.StreamSource($FILE, ...)
- pattern: FileUtils.openOutputStream($FILE, ...)
- focus-metavariable: $FILE
pattern-sanitizers:
- pattern: org.apache.commons.io.FilenameUtils.getName(...)
- id: java.spring.security.injection.tainted-system-command.tainted-system-command
languages:
- java
severity: ERROR
mode: taint
pattern-propagators:
- pattern: (StringBuilder $STRB).append($INPUT)
from: $INPUT
to: $STRB
label: CONCAT
requires: INPUT
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
$METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {
...
}
- pattern-inside: |
$METHODNAME(..., @$REQ $TYPE $SOURCE,...) {
...
}
- metavariable-regex:
metavariable: $TYPE
regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean))
- metavariable-regex:
metavariable: $REQ
regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute)
- focus-metavariable: $SOURCE
label: INPUT
- patterns:
- pattern-either:
- pattern: $X + $SOURCE
- pattern: $SOURCE + $Y
- pattern: String.format("...", ..., $SOURCE, ...)
- pattern: String.join("...", ..., $SOURCE, ...)
- pattern: (String $STR).concat($SOURCE)
- pattern: $SOURCE.concat(...)
- pattern: $X += $SOURCE
- pattern: $SOURCE += $X
label: CONCAT
requires: INPUT
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
(Process $P) = new Process(...);
- pattern: |
(ProcessBuilder $PB).command(...);
- patterns:
- pattern-either:
- pattern: |
(Runtime $R).$EXEC(...);
- pattern: |
Runtime.getRuntime(...).$EXEC(...);
- metavariable-regex:
metavariable: $EXEC
regex: (exec|loadLibrary|load)
- patterns:
- pattern: |
(ProcessBuilder $PB).command(...).$ADD(...);
- metavariable-regex:
metavariable: $ADD
regex: (add|addAll)
- patterns:
- pattern-either:
- patterns:
- pattern-inside: |
$BUILDER = new ProcessBuilder(...);
...
- pattern: $BUILDER.start(...)
- pattern: |
new ProcessBuilder(...). ... .start(...);
requires: CONCAT
message: 'Detected user input entering a method which executes a system command.
This could result in a command injection vulnerability, which allows an attacker
to inject an arbitrary system command onto the server. The attacker could download
malware onto or steal data from the server. Instead, use ProcessBuilder, separating
the command into individual arguments, like this: `new ProcessBuilder("ls", "-al",
targetDirectory)`. Further, make sure you hardcode or allowlist the actual command
so that attackers can''t run arbitrary commands.'
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- java
- spring
confidence: HIGH
references:
- https://www.stackhawk.com/blog/command-injection-java/
- https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html
- https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.java
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/java.spring.security.injection.tainted-system-command.tainted-system-command
shortlink: https://sg.run/epY0
semgrep.dev:
rule:
r_id: 22076
rv_id: 1263087
rule_id: 6JUxGN
version_id: 8KT5rnP
url: https://semgrep.dev/playground/r/8KT5rnP/java.spring.security.injection.tainted-system-command.tainted-system-command
origin: community
- id: javascript.express.security.audit.express-libxml-noent.express-libxml-noent
message: The libxml library processes user-input with the `noent` attribute is set
to `true` which can lead to being vulnerable to XML External Entities (XXE) type
attacks. It is recommended to set `noent` to `false` when using this feature to
ensure you are protected.
options:
interfile: true
metadata:
interfile: true
references:
- https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
technology:
- express
category: security
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent
shortlink: https://sg.run/Z75x
semgrep.dev:
rule:
r_id: 22079
rv_id: 1263138
rule_id: pKUNeD
version_id: d6TyxpX
url: https://semgrep.dev/playground/r/d6TyxpX/javascript.express.security.audit.express-libxml-noent.express-libxml-noent
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- pattern: $REQ.files.$ANYTHING.data.toString('utf8')
- pattern: $REQ.files.$ANYTHING['data'].toString('utf8')
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
- pattern: files.$ANYTHING.data.toString('utf8')
- pattern: files.$ANYTHING['data'].toString('utf8')
pattern-sinks:
- pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
$XML = require('$IMPORT')
...
- pattern-inside: |
import $XML from '$IMPORT'
...
- pattern-inside: |
import * as $XML from '$IMPORT'
...
- metavariable-regex:
metavariable: $IMPORT
regex: ^(libxmljs|libxmljs2)$
- pattern-inside: $XML.$FUNC($QUERY, {...,noent:true,...})
- metavariable-regex:
metavariable: $FUNC
regex: ^(parseXmlString|parseXml)$
- focus-metavariable: $QUERY
- id: javascript.express.security.audit.express-open-redirect.express-open-redirect
message: The application redirects to a URL specified by user-supplied input `$REQ`
that is not validated. This could redirect users to malicious locations. Consider
using an allow-list approach to validate URLs, or warn users they are being redirected
to a third-party website.
metadata:
technology:
- express
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html
cwe:
- 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')'
category: security
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Open Redirect
source: https://semgrep.dev/r/javascript.express.security.audit.express-open-redirect.express-open-redirect
shortlink: https://sg.run/EpoP
semgrep.dev:
rule:
r_id: 22081
rv_id: 1263140
rule_id: X5ULkq
version_id: nWT2L0v
url: https://semgrep.dev/playground/r/nWT2L0v/javascript.express.security.audit.express-open-redirect.express-open-redirect
origin: community
languages:
- javascript
- typescript
severity: WARNING
options:
taint_unify_mvars: true
symbolic_propagation: true
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern-either:
- pattern: $RES.redirect("$HTTP"+$REQ. ... .$VALUE)
- pattern: $RES.redirect("$HTTP"+$REQ. ... .$VALUE + $...A)
- pattern: $RES.redirect(`$HTTP${$REQ. ... .$VALUE}...`)
- pattern: $RES.redirect("$HTTP"+$REQ.$VALUE[...])
- pattern: $RES.redirect("$HTTP"+$REQ.$VALUE[...] + $...A)
- pattern: $RES.redirect(`$HTTP${$REQ.$VALUE[...]}...`)
- metavariable-regex:
metavariable: $HTTP
regex: ^https?:\/\/$
- pattern-either:
- pattern: $REQ. ... .$VALUE
- patterns:
- pattern-either:
- pattern: $RES.redirect($REQ. ... .$VALUE)
- pattern: $RES.redirect($REQ. ... .$VALUE + $...A)
- pattern: $RES.redirect(`${$REQ. ... .$VALUE}...`)
- pattern: $REQ. ... .$VALUE
- patterns:
- pattern-either:
- pattern: $RES.redirect($REQ.$VALUE['...'])
- pattern: $RES.redirect($REQ.$VALUE['...'] + $...A)
- pattern: $RES.redirect(`${$REQ.$VALUE['...']}...`)
- pattern: $REQ.$VALUE
- patterns:
- pattern-either:
- pattern-inside: |
$ASSIGN = $REQ. ... .$VALUE
...
- pattern-inside: |
$ASSIGN = $REQ.$VALUE['...']
...
- pattern-inside: |
$ASSIGN = $REQ. ... .$VALUE + $...A
...
- pattern-inside: "$ASSIGN = $REQ.$VALUE['...'] + $...A\n... \n"
- pattern-inside: |
$ASSIGN = `${$REQ. ... .$VALUE}...`
...
- pattern-inside: "$ASSIGN = `${$REQ.$VALUE['...']}...`\n... \n"
- pattern-either:
- pattern: $RES.redirect($ASSIGN)
- pattern: $RES.redirect($ASSIGN + $...FOO)
- pattern: $RES.redirect(`${$ASSIGN}...`)
- focus-metavariable: $ASSIGN
- id: javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
options:
interfile: true
metadata:
interfile: true
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
category: security
technology:
- express
- secrets
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret
shortlink: https://sg.run/LYvG
semgrep.dev:
rule:
r_id: 22083
rv_id: 1263143
rule_id: 10Uo39
version_id: LjTkgle
url: https://semgrep.dev/playground/r/LjTkgle/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-either:
- pattern-inside: |
$SESSION = require('express-session');
...
- pattern-inside: |
import $SESSION from 'express-session'
...
- pattern-inside: |
import {..., $SESSION, ...} from 'express-session'
...
- pattern-inside: |
import * as $SESSION from 'express-session'
...
- patterns:
- pattern-either:
- pattern-inside: $APP.use($SESSION({...}))
- pattern: |
$SECRET = $VALUE
...
$APP.use($SESSION($SECRET))
- pattern: |
secret: '$Y'
- id: javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization
message: The following function call $SER.$FUNC accepts user controlled data which
can result in Remote Code Execution (RCE) through Object Deserialization. It is
recommended to use secure data processing alternatives such as JSON.parse() and
Buffer.from().
options:
interfile: true
metadata:
interfile: true
technology:
- express
category: security
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html
source_rule_url:
- https://github.com/ajinabraham/njsscan/blob/75bfbeb9c8d72999e4d527dfa2548f7f0f3cc48a/njsscan/rules/semantic_grep/eval/eval_deserialize.yaml
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization
shortlink: https://sg.run/8W5j
semgrep.dev:
rule:
r_id: 22084
rv_id: 1263145
rule_id: 9AUyqj
version_id: gETB7nD
url: https://semgrep.dev/playground/r/gETB7nD/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- pattern: $REQ.files.$ANYTHING.data.toString('utf8')
- pattern: $REQ.files.$ANYTHING['data'].toString('utf8')
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
- pattern: files.$ANYTHING.data.toString('utf8')
- pattern: files.$ANYTHING['data'].toString('utf8')
pattern-sinks:
- pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
$SER = require('$IMPORT')
...
- pattern-inside: |
import $SER from '$IMPORT'
...
- pattern-inside: |
import * as $SER from '$IMPORT'
...
- metavariable-regex:
metavariable: $IMPORT
regex: ^(node-serialize|serialize-to-js)$
- pattern: $SER.$FUNC(...)
- metavariable-regex:
metavariable: $FUNC
regex: ^(unserialize|deserialize)$
- id: javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection
message: Detected a sequelize statement that is tainted by user-input. This could
lead to SQL injection if the variable is user-controlled and is not properly sanitized.
In order to prevent SQL injection, it is recommended to use parameterized queries
or prepared statements.
options:
interfile: true
metadata:
interfile: true
references:
- https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements
category: security
technology:
- express
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection
shortlink: https://sg.run/gjoe
semgrep.dev:
rule:
r_id: 22085
rv_id: 1263241
rule_id: yyU0GX
version_id: nWT2Llx
url: https://semgrep.dev/playground/r/nWT2Llx/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- pattern: $REQ.files.$ANYTHING.data.toString('utf8')
- pattern: $REQ.files.$ANYTHING['data'].toString('utf8')
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
- pattern: files.$ANYTHING.data.toString('utf8')
- pattern: files.$ANYTHING['data'].toString('utf8')
pattern-sinks:
- pattern-either:
- patterns:
- pattern-either:
- pattern: sequelize.query($QUERY,...)
- pattern: $DB.sequelize.query($QUERY,...)
- focus-metavariable: $QUERY
pattern-sanitizers:
- pattern-either:
- pattern: parseInt(...)
- pattern: $FUNC. ... .hash(...)
- id: go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage
message: Detected usage of dangerous method $METHOD which does not escape inputs
(see link in references). If the argument is user-controlled, this can lead to
SQL injection. When using $METHOD function, do not trust user-submitted data and
only allow approved list of input (possibly, use an allowlist approach).
severity: WARNING
languages:
- go
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
($REQUEST : http.Request).$ANYTHING
- pattern: |
($REQUEST : *http.Request).$ANYTHING
- metavariable-regex:
metavariable: $ANYTHING
regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
pattern-sinks:
- patterns:
- pattern-inside: |
import ("gorm.io/gorm")
...
- patterns:
- pattern-inside: |
func $VAL(..., $GORM *gorm.DB,... ) {
...
}
- pattern-either:
- pattern: |
$GORM. ... .$METHOD($VALUE)
- pattern: |
$DB := $GORM. ... .$ANYTHING(...)
...
$DB. ... .$METHOD($VALUE)
- focus-metavariable: $VALUE
- metavariable-regex:
metavariable: $METHOD
regex: ^(Order|Exec|Raw|Group|Having|Distinct|Select|Pluck)$
pattern-sanitizers:
- pattern-either:
- pattern: strconv.Atoi(...)
- pattern: |
($X: bool)
options:
interfile: true
metadata:
category: security
technology:
- gorm
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://gorm.io/docs/security.html#SQL-injection-Methods
- https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
confidence: HIGH
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage
shortlink: https://sg.run/R4qg
semgrep.dev:
rule:
r_id: 24693
rv_id: 1262915
rule_id: AbU5o3
version_id: l4TJRJK
url: https://semgrep.dev/playground/r/l4TJRJK/go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage
origin: community
- id: csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure
patterns:
- pattern: $APP.UseDeveloperExceptionPage(...);
- pattern-not-inside: |
if ($ENV.IsDevelopment(...)) {
...
}
- pattern-not-inside: |
if ($ENV.EnvironmentName == "Development") {
...
}
message: Stacktrace information is displayed in a non-Development environment. Accidentally
disclosing sensitive stack trace information in a production environment aids
an attacker in reconnaissance and information gathering.
metadata:
category: security
technology:
- csharp
owasp:
- A06:2017 - Security Misconfiguration
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
cwe:
- 'CWE-209: Generation of Error Message Containing Sensitive Information'
references:
- https://cwe.mitre.org/data/definitions/209.html
- https://owasp.org/Top10/A04_2021-Insecure_Design/
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure
shortlink: https://sg.run/XvkA
semgrep.dev:
rule:
r_id: 26720
rv_id: 1262653
rule_id: lBU6Dv
version_id: 0bTKzrB
url: https://semgrep.dev/playground/r/0bTKzrB/csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure
origin: community
languages:
- csharp
severity: WARNING
- id: csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation
patterns:
- pattern-either:
- patterns:
- pattern: $LIFETIME = $FALSE
- pattern-inside: new TokenValidationParameters {...}
- patterns:
- pattern: |
(TokenValidationParameters $OPTS). ... .$LIFETIME = $FALSE
- metavariable-regex:
metavariable: $LIFETIME
regex: (RequireExpirationTime|ValidateLifetime)
- metavariable-regex:
metavariable: $FALSE
regex: (false)
- focus-metavariable: $FALSE
fix: |
true
message: The TokenValidationParameters.$LIFETIME is set to $FALSE, this means the
JWT tokens lifetime is not validated. This can lead to an JWT token being used
after it has expired, which has security implications. It is recommended to validate
the JWT lifetime to ensure only valid tokens are used.
metadata:
category: security
technology:
- csharp
owasp:
- A02:2017 - Broken Authentication
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe:
- 'CWE-613: Insufficient Session Expiration'
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/
- https://cwe.mitre.org/data/definitions/613.html
- https://docs.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationparameters?view=azure-dotnet
subcategory:
- audit
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation
shortlink: https://sg.run/KA0d
semgrep.dev:
rule:
r_id: 28955
rv_id: 1262628
rule_id: bwU5kK
version_id: w8TRolJ
url: https://semgrep.dev/playground/r/w8TRolJ/csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation
origin: community
languages:
- csharp
severity: WARNING
- id: python.django.security.injection.command.subprocess-injection.subprocess-injection
languages:
- python
mode: taint
options:
symbolic_propagation: true
pattern-sources:
- patterns:
- pattern-inside: |
def $FUNC(..., $REQUEST, ...):
...
- focus-metavariable: $REQUEST
- metavariable-pattern:
metavariable: $REQUEST
patterns:
- pattern: request
- pattern-not-inside: request.build_absolute_uri
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: subprocess.$FUNC(...)
- pattern-not: subprocess.$FUNC("...", ...)
- pattern-not: subprocess.$FUNC(["...", ...], ...)
- pattern-not-inside: |
$CMD = ["...", ...]
...
subprocess.$FUNC($CMD, ...)
- patterns:
- pattern: subprocess.$FUNC(["$SHELL", "-c", ...], ...)
- metavariable-regex:
metavariable: $SHELL
regex: ^(sh|bash|ksh|csh|tcsh|zsh)$
- patterns:
- pattern: subprocess.$FUNC(["$INTERPRETER", ...], ...)
- metavariable-regex:
metavariable: $INTERPRETER
regex: ^(python|python\d)$
pattern-sanitizers:
- patterns:
- pattern: $DICT[$KEY]
- focus-metavariable: $KEY
severity: ERROR
message: Detected user input entering a `subprocess` call unsafely. This could result
in a command injection vulnerability. An attacker could use this vulnerability
to execute arbitrary commands on the host, which allows them to download malware,
scan sensitive data, or run any command they wish on the server. Do not let users
choose the command to run. In general, prefer to use Python API versions of system
commands. If you must use subprocess, use a dictionary to allowlist a set of commands.
metadata:
category: security
technology:
- flask
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
references:
- https://semgrep.dev/docs/cheat-sheets/python-command-injection/
confidence: HIGH
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection
shortlink: https://sg.run/49BE
semgrep.dev:
rule:
r_id: 31144
rv_id: 1263388
rule_id: EwUepx
version_id: 7ZTE3qK
url: https://semgrep.dev/playground/r/7ZTE3qK/python.django.security.injection.command.subprocess-injection.subprocess-injection
origin: community
- id: python.flask.security.injection.subprocess-injection.subprocess-injection
languages:
- python
mode: taint
options:
symbolic_propagation: true
pattern-sources:
- pattern-either:
- patterns:
- pattern-either:
- pattern: flask.request.form.get(...)
- pattern: flask.request.form[...]
- pattern: flask.request.args.get(...)
- pattern: flask.request.args[...]
- pattern: flask.request.values.get(...)
- pattern: flask.request.values[...]
- pattern: flask.request.cookies.get(...)
- pattern: flask.request.cookies[...]
- pattern: flask.request.stream
- pattern: flask.request.headers.get(...)
- pattern: flask.request.headers[...]
- pattern: flask.request.data
- pattern: flask.request.full_path
- pattern: flask.request.url
- pattern: flask.request.json
- pattern: flask.request.get_json()
- pattern: flask.request.view_args.get(...)
- pattern: flask.request.view_args[...]
- patterns:
- pattern-inside: |
@$APP.route($ROUTE, ...)
def $FUNC(..., $ROUTEVAR, ...):
...
- focus-metavariable: $ROUTEVAR
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: subprocess.$FUNC(...)
- pattern-not: subprocess.$FUNC("...", ...)
- pattern-not: subprocess.$FUNC(["...", ...], ...)
- pattern-not-inside: |
$CMD = ["...", ...]
...
subprocess.$FUNC($CMD, ...)
- patterns:
- pattern: subprocess.$FUNC(["$SHELL", "-c", ...], ...)
- metavariable-regex:
metavariable: $SHELL
regex: ^(sh|bash|ksh|csh|tcsh|zsh)$
- patterns:
- pattern: subprocess.$FUNC(["$INTERPRETER", ...], ...)
- metavariable-regex:
metavariable: $INTERPRETER
regex: ^(python|python\d)$
pattern-sanitizers:
- patterns:
- pattern: $DICT[$KEY]
- focus-metavariable: $KEY
severity: ERROR
message: Detected user input entering a `subprocess` call unsafely. This could result
in a command injection vulnerability. An attacker could use this vulnerability
to execute arbitrary commands on the host, which allows them to download malware,
scan sensitive data, or run any command they wish on the server. Do not let users
choose the command to run. In general, prefer to use Python API versions of system
commands. If you must use subprocess, use a dictionary to allowlist a set of commands.
metadata:
category: security
technology:
- flask
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
references:
- https://semgrep.dev/docs/cheat-sheets/python-command-injection/
confidence: HIGH
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection
shortlink: https://sg.run/5gW3
semgrep.dev:
rule:
r_id: 31147
rv_id: 1263433
rule_id: 8GU3qp
version_id: bZT53gQ
url: https://semgrep.dev/playground/r/bZT53gQ/python.flask.security.injection.subprocess-injection.subprocess-injection
origin: community
- id: yaml.github-actions.security.github-script-injection.github-script-injection
languages:
- yaml
message: 'Using variable interpolation `${{...}}` with `github` context data in
a `actions/github-script`''s `script:` step could allow an attacker to inject
their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted.
Instead, use an intermediate environment variable with `env:` to store the data
and use the environment variable in the `run:` script. Be sure to use double-quotes
the environment variable, like this: "$ENVVAR".'
metadata:
category: security
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
- https://securitylab.github.com/research/github-actions-untrusted-input/
- https://github.com/actions/github-script
technology:
- github-actions
cwe2022-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/yaml.github-actions.security.github-script-injection.github-script-injection
shortlink: https://sg.run/g1G0
semgrep.dev:
rule:
r_id: 31441
rv_id: 1423394
rule_id: OrUQvK
version_id: 5PT7Zyw
url: https://semgrep.dev/playground/r/5PT7Zyw/yaml.github-actions.security.github-script-injection.github-script-injection
origin: community
patterns:
- pattern-inside: 'steps: [...]'
- pattern-inside: |
uses: $ACTION
...
- pattern-inside: |
with:
...
script: ...
...
- pattern: 'script: $SHELL'
- metavariable-regex:
metavariable: $ACTION
regex: actions/github-script@.*
- metavariable-pattern:
language: generic
metavariable: $SHELL
patterns:
- pattern-either:
- pattern: ${{ ... github.event.issue.title ... }}
- pattern: ${{ ... github.event.issue.body ... }}
- pattern: ${{ ... github.event.pull_request.title ... }}
- pattern: ${{ ... github.event.pull_request.body ... }}
- pattern: ${{ ... github.event.comment.body ... }}
- pattern: ${{ ... github.event.review.body ... }}
- pattern: ${{ ... github.event.review_comment.body ... }}
- pattern: ${{ ... github.event.pages ... .page_name ... }}
- pattern: ${{ ... github.event.head_commit.message ... }}
- pattern: ${{ ... github.event.head_commit.author.email ... }}
- pattern: ${{ ... github.event.head_commit.author.name ... }}
- pattern: ${{ ... github.event.commits ... .author.email ... }}
- pattern: ${{ ... github.event.commits ... .author.name ... }}
- pattern: ${{ ... github.event.commits ... .message ... }}
- pattern: ${{ ... github.event.pull_request.head.ref ... }}
- pattern: ${{ ... github.event.pull_request.head.label ... }}
- pattern: ${{ ... github.event.pull_request.head.repo.default_branch ...
}}
- pattern: ${{ ... github.ref ... }}
- pattern: ${{ ... github.base_ref ... }}
- pattern: ${{ ... github.head_ref ... }}
- pattern: ${{ ... github.ref_name ... }}
- pattern: ${{ ... github.workflow ... }}
- pattern: ${{ ... github.event.inputs ... }}
- pattern: ${{ ... github.event.discussion.title ... }}
- pattern: ${{ ... github.event.discussion.body ... }}
- pattern: ${{ ... github.event.workflow_run.head_branch ... }}
- pattern: ${{ ... github.event.workflow_run.head_commit.message ... }}
- pattern: ${{ ... github.event.milestone.title ... }}
- pattern: ${{ ... github.event.milestone.description ... }}
- pattern: ${{ ... github.event.project_card.note ... }}
- pattern: ${{ ... github.event.project.name ... }}
- pattern: ${{ ... github.event.project_column.name ... }}
- pattern: ${{ ... github.event.release.name ... }}
- pattern: ${{ ... github.event.release.body ... }}
- pattern: ${{ ... github.event.deployment.ref ... }}
- pattern: ${{ ... inputs ... }}
- pattern-not: ${{ ... github.event.issue.title && ... }}
- pattern-not: ${{ ... github.event.issue.body && ... }}
- pattern-not: ${{ ... github.event.pull_request.title && ... }}
- pattern-not: ${{ ... github.event.pull_request.body && ... }}
- pattern-not: ${{ ... github.event.comment.body && ... }}
- pattern-not: ${{ ... github.event.review.body && ... }}
- pattern-not: ${{ ... github.event.review_comment.body && ... }}
- pattern-not: ${{ ... github.event.pages ... .page_name && ... }}
- pattern-not: ${{ ... github.event.head_commit.message && ... }}
- pattern-not: ${{ ... github.event.head_commit.author.email && ... }}
- pattern-not: ${{ ... github.event.head_commit.author.name && ... }}
- pattern-not: ${{ ... github.event.commits ... .author.email && ... }}
- pattern-not: ${{ ... github.event.commits ... .author.name && ... }}
- pattern-not: ${{ ... github.event.commits ... .message && ... }}
- pattern-not: ${{ ... github.event.pull_request.head.ref && ... }}
- pattern-not: ${{ ... github.event.pull_request.head.label && ... }}
- pattern-not: ${{ ... github.event.pull_request.head.repo.default_branch &&
... }}
- pattern-not: ${{ ... github.ref && ... }}
- pattern-not: ${{ ... github.base_ref && ... }}
- pattern-not: ${{ ... github.head_ref && ... }}
- pattern-not: ${{ ... github.ref_name && ... }}
- pattern-not: ${{ ... github.workflow && ... }}
- pattern-not: ${{ ... github.event.inputs && ... }}
- pattern-not: ${{ ... github.event.discussion.title && ... }}
- pattern-not: ${{ ... github.event.discussion.body && ... }}
- pattern-not: ${{ ... github.event.workflow_run.head_branch && ... }}
- pattern-not: ${{ ... github.event.workflow_run.head_commit.message && ...
}}
- pattern-not: ${{ ... github.event.milestone.title && ... }}
- pattern-not: ${{ ... github.event.milestone.description && ... }}
- pattern-not: ${{ ... github.event.project_card.note && ... }}
- pattern-not: ${{ ... github.event.project.name && ... }}
- pattern-not: ${{ ... github.event.project_column.name && ... }}
- pattern-not: ${{ ... github.event.release.name && ... }}
- pattern-not: ${{ ... github.event.release.body && ... }}
- pattern-not: ${{ ... github.event.deployment.ref && ... }}
severity: ERROR
- id: python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish
message: Detected Blowfish cipher algorithm which is considered insecure. This algorithm
is not cryptographically secure and can be reversed easily. Use secure stream
ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES
with a block size of 128 bits. When using a block cipher, use a modern mode of
operation that also provides authentication, such as GCM.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
bandit-code: B304
references:
- https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption
- https://www.pycryptodome.org/src/cipher/cipher
category: security
technology:
- pycryptodome
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
functional-categories:
- crypto::search::symmetric-algorithm::pycryptodome
- crypto::search::symmetric-algorithm::pycryptodomex
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish
shortlink: https://sg.run/dlOE
semgrep.dev:
rule:
r_id: 33634
rv_id: 1263545
rule_id: JDUGnK
version_id: ExTExln
url: https://semgrep.dev/playground/r/ExTExln/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish
origin: community
options:
symbolic_propagation: true
severity: WARNING
languages:
- python
pattern-either:
- pattern: Cryptodome.Cipher.Blowfish.new(...)
- pattern: Crypto.Cipher.Blowfish.new(...)
- id: python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des
message: Detected DES cipher or Triple DES algorithm which is considered insecure.
This algorithm is not cryptographically secure and can be reversed easily. Use
a secure symmetric cipher from the cryptodome package instead. Use secure stream
ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES
with a block size of 128 bits. When using a block cipher, use a modern mode of
operation that also provides authentication, such as GCM.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
bandit-code: B304
references:
- https://cwe.mitre.org/data/definitions/326.html
- https://www.pycryptodome.org/src/cipher/cipher
category: security
technology:
- pycryptodome
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
functional-categories:
- crypto::search::symmetric-algorithm::pycryptodome
- crypto::search::symmetric-algorithm::pycryptodomex
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des
shortlink: https://sg.run/Z5bw
semgrep.dev:
rule:
r_id: 33635
rv_id: 1263546
rule_id: 5rUr73
version_id: 7ZTE3G7
url: https://semgrep.dev/playground/r/7ZTE3G7/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des
origin: community
options:
symbolic_propagation: true
severity: WARNING
languages:
- python
pattern-either:
- pattern: Cryptodome.Cipher.DES.new(...)
- pattern: Crypto.Cipher.DES.new(...)
- pattern: Cryptodome.Cipher.DES3.new(...)
- pattern: Crypto.Cipher.DES3.new(...)
- id: python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2
message: Detected RC2 cipher algorithm which is considered insecure. This algorithm
is not cryptographically secure and can be reversed easily. Use secure stream
ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES
with a block size of 128 bits. When using a block cipher, use a modern mode of
operation that also provides authentication, such as GCM.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
bandit-code: B304
references:
- https://cwe.mitre.org/data/definitions/326.html
- https://www.pycryptodome.org/src/cipher/cipher
category: security
technology:
- pycryptodome
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
functional-categories:
- crypto::search::symmetric-algorithm::pycryptodome
- crypto::search::symmetric-algorithm::pycryptodomex
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2
shortlink: https://sg.run/nAbY
semgrep.dev:
rule:
r_id: 33636
rv_id: 1263547
rule_id: GdUYlW
version_id: LjTkgn6
url: https://semgrep.dev/playground/r/LjTkgn6/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2
origin: community
options:
symbolic_propagation: true
severity: WARNING
languages:
- python
pattern-either:
- pattern: Cryptodome.Cipher.ARC2.new(...)
- pattern: Crypto.Cipher.ARC2.new(...)
- id: python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4
message: Detected ARC4 cipher algorithm which is considered insecure. This algorithm
is not cryptographically secure and can be reversed easily. Use secure stream
ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES
with a block size of 128 bits. When using a block cipher, use a modern mode of
operation that also provides authentication, such as GCM.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
bandit-code: B304
references:
- https://cwe.mitre.org/data/definitions/326.html
- https://www.pycryptodome.org/src/cipher/cipher
category: security
technology:
- pycryptodome
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
functional-categories:
- crypto::search::symmetric-algorithm::pycryptodome
- crypto::search::symmetric-algorithm::pycryptodomex
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4
shortlink: https://sg.run/Eo6N
semgrep.dev:
rule:
r_id: 33637
rv_id: 1263548
rule_id: ReUnEB
version_id: 8KT5rXY
url: https://semgrep.dev/playground/r/8KT5rXY/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4
origin: community
severity: WARNING
languages:
- python
pattern-either:
- pattern: Cryptodome.Cipher.ARC4.new(...)
- pattern: Crypto.Cipher.ARC4.new(...)
- id: python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2
message: Detected MD2 hash algorithm which is considered insecure. MD2 is not collision
resistant and is therefore not suitable as a cryptographic signature. Use a modern
hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms
- https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html
- https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability
- http://2012.sharcs.org/slides/stevens.pdf
- https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
category: security
technology:
- pycryptodome
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
functional-categories:
- crypto::search::hash-algorithm::pycryptodome
- crypto::search::hash-algorithm::pycryptodomex
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2
shortlink: https://sg.run/7JP2
semgrep.dev:
rule:
r_id: 33638
rv_id: 1263550
rule_id: AbU0Ex
version_id: QkTGqD8
url: https://semgrep.dev/playground/r/QkTGqD8/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2
origin: community
options:
symbolic_propagation: true
severity: WARNING
languages:
- python
pattern-either:
- pattern: Crypto.Hash.MD2.new(...)
- pattern: Cryptodome.Hash.MD2.new (...)
- id: python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4
message: Detected MD4 hash algorithm which is considered insecure. MD4 is not collision
resistant and is therefore not suitable as a cryptographic signature. Use a modern
hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms
- https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html
- https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability
- http://2012.sharcs.org/slides/stevens.pdf
- https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
category: security
technology:
- pycryptodome
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
functional-categories:
- crypto::search::hash-algorithm::pycryptodome
- crypto::search::hash-algorithm::pycryptodomex
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4
shortlink: https://sg.run/Lve6
semgrep.dev:
rule:
r_id: 33639
rv_id: 1263551
rule_id: BYUJy4
version_id: 3ZT4Xnp
url: https://semgrep.dev/playground/r/3ZT4Xnp/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4
origin: community
options:
symbolic_propagation: true
severity: WARNING
languages:
- python
pattern-either:
- pattern: Crypto.Hash.MD4.new(...)
- pattern: Cryptodome.Hash.MD4.new (...)
- id: python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5
message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision
resistant and is therefore not suitable as a cryptographic signature. Use a modern
hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms
- https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html
- https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability
- http://2012.sharcs.org/slides/stevens.pdf
- https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
category: security
technology:
- pycryptodome
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
functional-categories:
- crypto::search::hash-algorithm::pycryptodome
- crypto::search::hash-algorithm::pycryptodomex
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5
shortlink: https://sg.run/85JN
semgrep.dev:
rule:
r_id: 33640
rv_id: 1263552
rule_id: DbUXwo
version_id: 44TEjpk
url: https://semgrep.dev/playground/r/44TEjpk/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5
origin: community
options:
symbolic_propagation: true
severity: WARNING
languages:
- python
pattern-either:
- pattern: Crypto.Hash.MD5.new(...)
- pattern: Cryptodome.Hash.MD5.new (...)
- id: csharp.dotnet.security.use_ecb_mode.use_ecb_mode
message: Usage of the insecure ECB mode detected. You should use an authenticated
encryption mode instead, which is implemented by the classes AesGcm or ChaCha20Poly1305.
severity: WARNING
metadata:
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
category: security
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.chacha20poly1305?view=net-6.0
- https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0
- https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.ciphermode?view=net-6.0
- https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes
subcategory:
- vuln
technology:
- .net
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/csharp.dotnet.security.use_ecb_mode.use_ecb_mode
shortlink: https://sg.run/wj9n
semgrep.dev:
rule:
r_id: 36773
rv_id: 1262623
rule_id: 0oUqWP
version_id: yeTxpPw
url: https://semgrep.dev/playground/r/yeTxpPw/csharp.dotnet.security.use_ecb_mode.use_ecb_mode
origin: community
languages:
- csharp
patterns:
- pattern-either:
- pattern: ($KEYTYPE $KEY).EncryptEcb(...);
- pattern: ($KEYTYPE $KEY).DecryptEcb(...);
- pattern: ($KEYTYPE $KEY).Mode = CipherMode.ECB;
- metavariable-pattern:
metavariable: $KEYTYPE
pattern-either:
- pattern: SymmetricAlgorithm
- pattern: Aes
- pattern: Rijndael
- pattern: DES
- pattern: TripleDES
- pattern: RC2
- id: csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration
message: You are using an insecure random number generator (RNG) to create a cryptographic
key. System.Random must never be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator
instead.
severity: ERROR
metadata:
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
category: security
cwe:
- 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)'
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://learn.microsoft.com/en-us/dotnet/api/system.random?view=net-6.0#remarks
- https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator?view=net-6.0
- https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0#constructors
- https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.symmetricalgorithm.key?view=net-6.0#system-security-cryptography-symmetricalgorithm-key
subcategory:
- vuln
technology:
- .net
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration
shortlink: https://sg.run/xjrA
semgrep.dev:
rule:
r_id: 36774
rv_id: 1262624
rule_id: KxU3Nq
version_id: rxTAK2O
url: https://semgrep.dev/playground/r/rxTAK2O/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration
origin: community
languages:
- csharp
mode: taint
pattern-sources:
- patterns:
- pattern-inside: (System.Random $RNG).NextBytes($KEY); ...
- pattern: $KEY
pattern-sinks:
- pattern-either:
- patterns:
- pattern: ($KEYTYPE $CIPHER).Key = $SINK;
- focus-metavariable: $SINK
- metavariable-pattern:
metavariable: $KEYTYPE
pattern-either:
- pattern: SymmetricAlgorithm
- pattern: Aes
- pattern: Rijndael
- pattern: DES
- pattern: TripleDES
- pattern: RC2
- pattern: new AesGcm(...)
- pattern: new AesCcm(...)
- pattern: new ChaCha20Poly1305(...)
- id: html.security.plaintext-http-link.plaintext-http-link
metadata:
category: security
technology:
- html
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
confidence: HIGH
subcategory:
- vuln
references:
- https://cwe.mitre.org/data/definitions/319.html
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/html.security.plaintext-http-link.plaintext-http-link
shortlink: https://sg.run/RA5q
semgrep.dev:
rule:
r_id: 39193
rv_id: 1262976
rule_id: AbUnNo
version_id: xyTjzRL
url: https://semgrep.dev/playground/r/xyTjzRL/html.security.plaintext-http-link.plaintext-http-link
origin: community
patterns:
- pattern: <a href="$URL">...</a>
- metavariable-regex:
metavariable: $URL
regex: ^(?i)http://
message: This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL
if possible.
severity: WARNING
languages:
- html
- id: java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils
message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision
resistant and is therefore not suitable as a cryptographic signature. Use HMAC
instead.
languages:
- java
severity: WARNING
metadata:
functional-categories:
- crypto::search::hash-algorithm::org.apache.commons
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-328: Use of Weak Hash'
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_MD5
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils
shortlink: https://sg.run/AWL2
semgrep.dev:
rule:
r_id: 39194
rv_id: 1263012
rule_id: BYUGK0
version_id: WrTqK7K
url: https://semgrep.dev/playground/r/WrTqK7K/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils
origin: community
patterns:
- pattern: |
$DU.$GET_ALGO().digest(...)
- metavariable-pattern:
metavariable: $GET_ALGO
pattern: getMd5Digest
- metavariable-pattern:
metavariable: $DU
pattern: DigestUtils
- focus-metavariable: $GET_ALGO
fix: |
getSha512Digest
- id: terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions
pattern-either:
- pattern: |
resource "aws_config_configuration_aggregator" $ANYTHING {
...
account_aggregation_source {
...
regions = ...
...
}
...
}
- pattern: |
resource "aws_config_configuration_aggregator" $ANYTHING {
...
organization_aggregation_source {
...
regions = ...
...
}
...
}
message: The AWS configuration aggregator does not aggregate all AWS Config region.
This may result in unmonitored configuration in regions that are thought to be
unused. Configure the aggregator with all_regions for the source.
languages:
- hcl
severity: WARNING
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A09:2021 - Security Logging and Monitoring Failures
- A09:2025 - Security Logging & Alerting Failures
cwe:
- 'CWE-778: Insufficient Logging'
references:
- https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insufficient Logging
source: https://semgrep.dev/r/terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions
shortlink: https://sg.run/O6A7
semgrep.dev:
rule:
r_id: 47275
rv_id: 1263703
rule_id: DbUo7v
version_id: A8Tgdwv
url: https://semgrep.dev/playground/r/A8Tgdwv/terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions
origin: community
- id: java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb
pattern: $CIPHER.getInstance("=~/AES/ECB.*/")
metadata:
functional-categories:
- crypto::search::mode::javax.crypto
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
- https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb
shortlink: https://sg.run/dB2Y
semgrep.dev:
rule:
r_id: 48734
rv_id: 1263009
rule_id: WAU2yA
version_id: A8TgdEo
url: https://semgrep.dev/playground/r/A8TgdEo/java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb
origin: community
message: 'Use of AES with ECB mode detected. ECB doesn''t provide message confidentiality
and is not semantically secure so should not be used. Instead, use a strong,
secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions
for more information.'
severity: WARNING
languages:
- java
- id: java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish
pattern: $CIPHER.getInstance("Blowfish")
metadata:
functional-categories:
- crypto::search::symmetric-algorithm::javax.crypto
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
- https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish
shortlink: https://sg.run/ZE4n
semgrep.dev:
rule:
r_id: 48735
rv_id: 1263010
rule_id: 0oUR28
version_id: BjTkZy0
url: https://semgrep.dev/playground/r/BjTkZy0/java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish
origin: community
message: 'Use of Blowfish was detected. Blowfish uses a 64-bit block size that makes
it vulnerable to birthday attacks, and is therefore considered non-compliant. Instead,
use a strong, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions
for more information.'
severity: WARNING
languages:
- java
- id: java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes
pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
import javax;
...
- pattern-either:
- pattern: javax.crypto.Cipher.getInstance("AES")
- pattern: (javax.crypto.Cipher $CIPHER).getInstance("AES")
- patterns:
- pattern-either:
- pattern-inside: |
import javax.*;
...
- pattern-inside: |
import javax.crypto;
...
- pattern-either:
- pattern: crypto.Cipher.getInstance("AES")
- pattern: (crypto.Cipher $CIPHER).getInstance("AES")
- patterns:
- pattern-either:
- pattern-inside: |
import javax.crypto.*;
...
- pattern-inside: |
import javax.crypto.Cipher;
...
- pattern-either:
- pattern: Cipher.getInstance("AES")
- pattern: (Cipher $CIPHER).getInstance("AES")
metadata:
functional-categories:
- crypto::search::mode::javax.crypto
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
- https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes
shortlink: https://sg.run/nzKO
semgrep.dev:
rule:
r_id: 48736
rv_id: 1263011
rule_id: KxUB7Z
version_id: DkTRbwy
url: https://semgrep.dev/playground/r/DkTRbwy/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes
origin: community
message: 'Use of AES with no settings detected. By default, java.crypto.Cipher uses
ECB mode. ECB doesn''t provide message confidentiality and is not semantically
secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance("AES/CBC/PKCS7PADDING").
See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for
more information.'
severity: WARNING
languages:
- java
- id: java.lang.security.audit.crypto.use-of-rc2.use-of-rc2
pattern: $CIPHER.getInstance("RC2")
metadata:
functional-categories:
- crypto::search::symmetric-algorithm::javax.crypto
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
- https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc2.use-of-rc2
shortlink: https://sg.run/EEvA
semgrep.dev:
rule:
r_id: 48737
rv_id: 1263014
rule_id: qNUzXG
version_id: K3TKkg0
url: https://semgrep.dev/playground/r/K3TKkg0/java.lang.security.audit.crypto.use-of-rc2.use-of-rc2
origin: community
message: 'Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and
is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING").
See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for
more information.'
severity: WARNING
languages:
- java
- id: java.lang.security.audit.crypto.use-of-rc4.use-of-rc4
pattern: $CIPHER.getInstance("RC4")
metadata:
functional-categories:
- crypto::search::symmetric-algorithm::javax.crypto
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
- https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc4.use-of-rc4
shortlink: https://sg.run/7OYR
semgrep.dev:
rule:
r_id: 48738
rv_id: 1263015
rule_id: lBUw8k
version_id: qkTR7vk
url: https://semgrep.dev/playground/r/qkTR7vk/java.lang.security.audit.crypto.use-of-rc4.use-of-rc4
origin: community
message: 'Use of RC4 was detected. RC4 is vulnerable to several attacks, including
stream cipher attacks and bit flipping attacks. Instead, use a strong, secure
cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions
for more information.'
severity: WARNING
languages:
- java
- id: clojure.lang.security.use-of-md5.use-of-md5
languages:
- clojure
severity: WARNING
message: MD5 hash algorithm detected. This is not collision resistant and leads
to easily-cracked password hashes. Replace with current recommended hashing algorithms.
metadata:
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html
- https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
technology:
- clojure
source-rule-url: https://github.com/clj-holmes/clj-holmes-rules/blob/main/security/weak-hash-function-md5.yml
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-328: Use of Weak Hash'
author: Gabriel Marquet <gab.marquet@gmail.com>
category: security
subcategory:
- vuln
confidence: HIGH
likelihood: MEDIUM
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/clojure.lang.security.use-of-md5.use-of-md5
shortlink: https://sg.run/BgPx
semgrep.dev:
rule:
r_id: 52195
rv_id: 1262609
rule_id: nJU1ep
version_id: 0bTKz2B
url: https://semgrep.dev/playground/r/0bTKz2B/clojure.lang.security.use-of-md5.use-of-md5
origin: community
pattern-either:
- pattern: (MessageDigest/getInstance "MD5")
- pattern: (MessageDigest/getInstance MessageDigestAlgorithms/MD5)
- pattern: (MessageDigest/getInstance org.apache.commons.codec.digest.MessageDigestAlgorithms/MD5)
- pattern: (java.security.MessageDigest/getInstance "MD5")
- pattern: (java.security.MessageDigest/getInstance MessageDigestAlgorithms/MD5)
- pattern: (java.security.MessageDigest/getInstance org.apache.commons.codec.digest.MessageDigestAlgorithms/MD5)
- id: terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn
patterns:
- pattern: |
resource "aws_lambda_permission" $ANYTHING {
...
principal = "$PRINCIPAL"
...
}
- pattern-not: |
resource "aws_lambda_permission" $ANYTHING {
...
source_arn = ...
...
}
- metavariable-regex:
metavariable: $PRINCIPAL
regex: .*[.]amazonaws[.]com$
message: The AWS Lambda permission has an AWS service principal but does not specify
a source ARN. If you grant permission to a service principal without specifying
the source, other accounts could potentially configure resources in their account
to invoke your Lambda function. Set the source_arn value to the ARN of the AWS
resource that invokes the function, eg. an S3 bucket, CloudWatch Events Rule,
API Gateway, or SNS topic.
languages:
- hcl
severity: ERROR
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe:
- 'CWE-732: Incorrect Permission Assignment for Critical Resource'
references:
- https://cwe.mitre.org/data/definitions/732.html
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission
- https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-permission.html
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn
shortlink: https://sg.run/kOP7
semgrep.dev:
rule:
r_id: 54772
rv_id: 1263732
rule_id: OrU9Ox
version_id: 1QTypq5
url: https://semgrep.dev/playground/r/1QTypq5/terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn
origin: community
- id: java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing
severity: ERROR
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://blog.sonarsource.com/secure-xml-processor
- https://xerces.apache.org/xerces2-j/features.html
category: security
technology:
- java
- xml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing
shortlink: https://sg.run/Gj32
semgrep.dev:
rule:
r_id: 59048
rv_id: 1263061
rule_id: j2Udpk
version_id: YDTZeko
url: https://semgrep.dev/playground/r/YDTZeko/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing
origin: community
message: DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable
to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl`
to true. Alternatively, allow DOCTYPE declarations and only prohibit external
entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities`
and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE -
The previous links are not meant to be clicked. They are the literal config key
values that are supposed to be used to disable these features. For more information,
see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory.
mode: taint
pattern-sources:
- by-side-effect: true
patterns:
- pattern-either:
- pattern: |
$FACTORY = SAXParserFactory.newInstance();
- patterns:
- pattern: $FACTORY
- pattern-inside: |
class $C {
...
$V $FACTORY = SAXParserFactory.newInstance();
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = SAXParserFactory.newInstance();
static {
...
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
...
}
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = SAXParserFactory.newInstance();
static {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
}
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = SAXParserFactory.newInstance();
static {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
}
...
}
pattern-sinks:
- patterns:
- pattern: $FACTORY.newSAXParser();
pattern-sanitizers:
- by-side-effect: true
pattern-either:
- patterns:
- pattern-either:
- pattern: |
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
- pattern: |
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
- pattern: |
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
- focus-metavariable: $FACTORY
- patterns:
- pattern-either:
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl",
true);
...
}
...
}
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
}
...
}
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities",false);
...
}
...
}
- pattern: $M($X)
- focus-metavariable: $X
fix: |
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
$FACTORY.newSAXParser();
languages:
- java
- id: java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled
severity: ERROR
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://blog.sonarsource.com/secure-xml-processor
- https://xerces.apache.org/xerces2-j/features.html
category: security
technology:
- java
- xml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled
shortlink: https://sg.run/1wyQ
semgrep.dev:
rule:
r_id: 59622
rv_id: 1263062
rule_id: v8UeQ1
version_id: 6xT29GK
url: https://semgrep.dev/playground/r/6xT29GK/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled
origin: community
message: DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable
to XML external entity attacks. Disable this by setting the attributes "accessExternalDTD"
and "accessExternalStylesheet" to "".
mode: taint
pattern-sources:
- by-side-effect: true
patterns:
- pattern-either:
- pattern: |
$FACTORY = TransformerFactory.newInstance();
- patterns:
- pattern: $FACTORY
- pattern-inside: |
class $C {
...
$V $FACTORY = TransformerFactory.newInstance();
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = TransformerFactory.newInstance();
static {
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
...
}
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = TransformerFactory.newInstance();
static {
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
...
}
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = TransformerFactory.newInstance();
static {
...
$FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
...
$FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", "");
...
}
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = TransformerFactory.newInstance();
static {
...
$FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", "");
...
$FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
...
}
...
}
pattern-sinks:
- patterns:
- pattern: $FACTORY.newTransformer(...);
pattern-sanitizers:
- by-side-effect: true
pattern-either:
- patterns:
- pattern-either:
- pattern: |
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); ...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
- pattern: |
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
- pattern: |
$FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", ""); ...
$FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
- pattern: |
$FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
...
$FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", "");
- focus-metavariable: $FACTORY
- patterns:
- pattern-either:
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
...
}
...
}
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
...
}
...
}
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", "");
...
$FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
...
}
...
}
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
...
$FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", "");
...
}
...
}
- pattern: $M($X)
- focus-metavariable: $X
fix: |
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
$FACTORY.newTransformer(...);
languages:
- java
- id: dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile
patterns:
- pattern: |
RUN sudo ...
message: Avoid using sudo in Dockerfiles. Running processes as a non-root user can
help reduce the potential impact of configuration errors and security vulnerabilities.
metadata:
category: security
technology:
- dockerfile
cwe:
- 'CWE-250: Execution with Unnecessary Privileges'
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
references:
- https://cwe.mitre.org/data/definitions/250.html
- https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile
shortlink: https://sg.run/80Q7
semgrep.dev:
rule:
r_id: 66384
rv_id: 1262661
rule_id: kxUlx1
version_id: pZT03zY
url: https://semgrep.dev/playground/r/pZT03zY/dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile
origin: community
languages:
- dockerfile
severity: WARNING
- id: swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows
message: Webviews were observed that explictly allow JavaScript in an WKWebview
to open windows automatically. Consider disabling this functionality if not required,
following the principle of least privelege.
severity: WARNING
metadata:
likelihood: LOW
impact: LOW
confidence: HIGH
category: security
cwe:
- 'CWE-272: Least Privilege Violation'
masvs:
- 'MASVS-PLATFORM-2: The app uses WebViews securely'
references:
- https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/
- https://developer.apple.com/documentation/webkit/wkpreferences/1536573-javascriptcanopenwindowsautomati
subcategory:
- audit
technology:
- ios
- macos
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows
shortlink: https://sg.run/YWLd
semgrep.dev:
rule:
r_id: 66514
rv_id: 946637
rule_id: lBUOZk
version_id: 9lTy1KE
url: https://semgrep.dev/playground/r/9lTy1KE/swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows
origin: community
languages:
- swift
patterns:
- pattern: |
$P = WKPreferences()
...
- pattern-either:
- patterns:
- pattern-inside: |
$P.JavaScriptCanOpenWindowsAutomatically = $FALSE
...
$P.JavaScriptCanOpenWindowsAutomatically = $TRUE
- pattern-not-inside: |
...
$P.JavaScriptCanOpenWindowsAutomatically = $TRUE
...
$P.JavaScriptCanOpenWindowsAutomatically = $FALSE
- pattern: |
$P.JavaScriptCanOpenWindowsAutomatically = true
- metavariable-regex:
metavariable: $TRUE
regex: ^(true)$
- metavariable-regex:
metavariable: $TRUE
regex: (.*(?!true))
- patterns:
- pattern: |
$P.JavaScriptCanOpenWindowsAutomatically = true
- pattern-not-inside: |
...
$P.JavaScriptCanOpenWindowsAutomatically = ...
...
$P.JavaScriptCanOpenWindowsAutomatically = ...
- id: solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens
message: $VAULT.getPoolTokens() call on a Balancer pool is not protected from the
read-only reentrancy.
metadata:
category: security
technology:
- solidity
cwe: 'CWE-841: Improper Enforcement of Behavioral Workflow'
confidence: HIGH
likelihood: MEDIUM
impact: HIGH
subcategory:
- vuln
references:
- https://quillaudits.medium.com/decoding-sentiment-protocols-1-million-exploit-quillaudits-f36bee77d376
- https://hackmd.io/@sentimentxyz/SJCySo1z2
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens
shortlink: https://sg.run/803Q
semgrep.dev:
rule:
r_id: 67640
rv_id: 946602
rule_id: kxUl7x
version_id: e1T98xQ
url: https://semgrep.dev/playground/r/e1T98xQ/solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens
origin: community
patterns:
- pattern-either:
- pattern: |
function $F(...) {
...
$RETURN = $VAULT.getPoolTokens(...);
...
}
- metavariable-pattern:
metavariable: $RETURN
pattern-regex: .*uint256\[].*
- pattern-not-inside: |
contract $C {
...
function $CHECKFUNC(...) {
...
VaultReentrancyLib.ensureNotInVaultContext(...);
...
}
...
function $F(...) {
...
$CHECKFUNC(...);
...
$RETURN = $VAULT.getPoolTokens(...);
...
}
...
}
- pattern-not-inside: |
contract $C {
...
function $CHECKFUNC(...) {
...
VaultReentrancyLib.ensureNotInVaultContext(...);
...
}
...
function $F(...) {
...
$RETURN = $VAULT.getPoolTokens(...);
...
$CHECKFUNC(...);
...
}
...
}
- pattern-not-inside: |
contract $C {
...
function $CHECKFUNC(...) {
...
$VAULT.manageUserBalance(...);
...
}
...
function $F(...) {
...
$RETURN = $VAULT.getPoolTokens(...);
...
$CHECKFUNC(...);
...
}
...
}
- pattern-not-inside: |
contract $C {
...
function $CHECKFUNC(...) {
...
$VAULT.manageUserBalance(...);
...
}
...
function $F(...) {
...
$CHECKFUNC(...);
...
$RETURN = $VAULT.getPoolTokens(...);
...
}
...
}
- pattern-not: |
function $F(...) {
...
VaultReentrancyLib.ensureNotInVaultContext(...);
...
}
- pattern-not: |
function $F(...) {
...
$VAULT.manageUserBalance(...);
...
}
- pattern-not-inside: |
contract LinearPool {
...
}
- pattern-not-inside: |
contract ComposableStablePool {
...
}
- pattern-not-inside: "contract BalancerQueries {\n ...\n} \n"
- pattern-not-inside: |
contract ManagedPool {
...
}
- pattern-not-inside: "contract BaseWeightedPool {\n ...\n} \n"
- pattern-not-inside: |
contract ComposableStablePoolStorage {
...
}
- pattern-not-inside: |
contract RecoveryModeHelper {
...
}
- focus-metavariable:
- $VAULT
languages:
- solidity
severity: ERROR
- id: solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate
message: $VAR.getRate() call on a Balancer pool is not protected from the read-only
reentrancy.
metadata:
category: security
technology:
- solidity
cwe: 'CWE-841: Improper Enforcement of Behavioral Workflow'
confidence: HIGH
likelihood: MEDIUM
impact: HIGH
subcategory:
- vuln
references:
- https://forum.balancer.fi/t/reentrancy-vulnerability-scope-expanded/4345
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate
shortlink: https://sg.run/g9e5
semgrep.dev:
rule:
r_id: 67641
rv_id: 946603
rule_id: wdUx3D
version_id: vdTGn2l
url: https://semgrep.dev/playground/r/vdTGn2l/solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate
origin: community
patterns:
- pattern: |
function $F(...) {
...
$VAR.getRate();
...
}
- pattern-not-inside: |
function $F(...) {
...
VaultReentrancyLib.ensureNotInVaultContext(...);
...
}
- pattern-not-inside: |
function $F(...) {
...
$VAULT.manageUserBalance(...);
...
}
- pattern-not-inside: |
function _updateTokenRateCache(...) {
...
}
- pattern-not-inside: |
contract PoolRecoveryHelper {
...
}
- pattern-not-inside: |
contract ComposableStablePoolRates {
...
}
- pattern-not-inside: |
contract WeightedPoolProtocolFees {
...
}
- pattern-not-inside: |
contract $C {
...
function $CHECKFUNC(...) {
...
VaultReentrancyLib.ensureNotInVaultContext(...);
...
}
...
function $F(...) {
...
$CHECKFUNC(...);
...
$VAR.getRate();
...
}
...
}
- pattern-not-inside: |
contract $C {
...
function $CHECKFUNC(...) {
...
VaultReentrancyLib.ensureNotInVaultContext(...);
...
}
...
function $F(...) {
...
$VAR.getRate();
...
$CHECKFUNC(...);
...
}
...
}
- pattern-not-inside: |
contract $C {
...
function $CHECKFUNC(...) {
...
$VAULT.manageUserBalance(...);
...
}
...
function $F(...) {
...
$VAR.getRate();
...
$CHECKFUNC(...);
...
}
...
}
- pattern-not-inside: |
contract $C {
...
function $CHECKFUNC(...) {
...
$VAULT.manageUserBalance(...);
...
}
...
function $F(...) {
...
$CHECKFUNC(...);
...
$VAR.getRate();
...
}
...
}
- focus-metavariable: $VAR
languages:
- solidity
severity: ERROR
- id: solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy
message: Function borrowFresh() in Compound performs state update after doTransferOut()
metadata:
category: security
technology:
- solidity
cwe: 'CWE-841: Improper Enforcement of Behavioral Workflow'
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- vuln
references:
- https://twitter.com/peckshield/status/1509431646818234369
- https://twitter.com/blocksecteam/status/1509466576848064512
- https://slowmist.medium.com/another-day-another-reentrancy-attack-5cde10bbb2b4
- https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy
shortlink: https://sg.run/4A19
semgrep.dev:
rule:
r_id: 67644
rv_id: 946606
rule_id: eqUkx4
version_id: nWTpz74
url: https://semgrep.dev/playground/r/nWTpz74/solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy
origin: community
patterns:
- pattern-inside: |
function borrowFresh(...) {
...
}
- pattern-not-inside: |
accountBorrows[borrower].interestIndex = borrowIndex;
...
- pattern: doTransferOut(...);
languages:
- solidity
severity: WARNING
- id: solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy
message: $POOL.get_virtual_price() call on a Curve pool is not protected from the
read-only reentrancy.
metadata:
category: security
technology:
- solidity
cwe: 'CWE-841: Improper Enforcement of Behavioral Workflow'
confidence: HIGH
likelihood: MEDIUM
impact: HIGH
subcategory:
- vuln
references:
- https://chainsecurity.com/heartbreaks-curve-lp-oracles/
- https://chainsecurity.com/curve-lp-oracle-manipulation-post-mortem/
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy
shortlink: https://sg.run/Jk5P
semgrep.dev:
rule:
r_id: 67646
rv_id: 946608
rule_id: d8UGDL
version_id: 7ZTrQO3
url: https://semgrep.dev/playground/r/7ZTrQO3/solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy
origin: community
patterns:
- pattern: |
$POOL.get_virtual_price()
- pattern-not-inside: |
function $F(...) {
...
$VAR.withdraw_admin_fees(...);
...
}
- pattern-not-inside: |
function $F(...) {
...
$VAR.withdraw_admin_fees(...);
...
}
- pattern-not-inside: |
contract $C {
...
function $CHECKFUNC(...) {
...
$VAR.withdraw_admin_fees(...);
...
}
...
function $F(...) {
...
$CHECKFUNC(...);
...
$POOL.get_virtual_price();
...
}
...
}
- pattern-not-inside: |
contract $C {
...
function $CHECKFUNC(...) {
...
$VAR.withdraw_admin_fees(...);
...
}
...
function $F(...) {
...
$POOL.get_virtual_price();
...
$CHECKFUNC(...);
...
}
...
}
languages:
- solidity
severity: ERROR
- id: solidity.security.encode-packed-collision.encode-packed-collision
message: abi.encodePacked hash collision with variable length arguments in $F()
metadata:
category: security
technology:
- solidity
cwe: 'CWE-20: Improper Input Validation'
confidence: HIGH
likelihood: MEDIUM
impact: MEDIUM
subcategory:
- vuln
references:
- https://swcregistry.io/docs/SWC-133
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/solidity.security.encode-packed-collision.encode-packed-collision
shortlink: https://sg.run/Gr46
semgrep.dev:
rule:
r_id: 67648
rv_id: 946610
rule_id: nJU47w
version_id: 8KTKjb1
url: https://semgrep.dev/playground/r/8KTKjb1/solidity.security.encode-packed-collision.encode-packed-collision
origin: community
patterns:
- pattern-either:
- pattern-inside: |
function $F(..., bytes $A, ..., bytes $B, ...) public {
...
}
- pattern-inside: |
function $F(..., string $A, ..., string $B, ...) public {
...
}
- pattern-inside: |
function $F(..., bytes $A, ..., string $B, ...) public {
...
}
- pattern-inside: |
function $F(..., string $A, ..., bytes $B, ...) public {
...
}
- pattern-inside: |
function $F(..., address[] $A, ..., address[] $B, ...) public {
...
}
- pattern-inside: |
function $F(..., uint256[] $A, ..., uint256[] $B, ...) public {
...
}
- pattern-inside: |
function $F(..., bytes $A, ..., bytes $B, ...) external {
...
}
- pattern-inside: |
function $F(..., string $A, ..., string $B, ...) external {
...
}
- pattern-inside: |
function $F(..., bytes $A, ..., string $B, ...) external {
...
}
- pattern-inside: |
function $F(..., string $A, ..., bytes $B, ...) external {
...
}
- pattern-inside: |
function $F(..., address[] $A, ..., address[] $B, ...) external {
...
}
- pattern-inside: |
function $F(..., uint256[] $A, ..., uint256[] $B, ...) external {
...
}
- pattern-either:
- pattern: |
keccak256(abi.encodePacked(..., $A, $B, ...))
- pattern: |
$X = abi.encodePacked(..., $A, $B, ...);
...
keccak256($X);
languages:
- solidity
severity: ERROR
- id: solidity.security.erc677-reentrancy.erc677-reentrancy
message: ERC677 callAfterTransfer() reentrancy
metadata:
category: security
technology:
- solidity
cwe: 'CWE-841: Improper Enforcement of Behavioral Workflow'
confidence: HIGH
likelihood: MEDIUM
impact: HIGH
subcategory:
- vuln
references:
- https://twitter.com/peckshield/status/1509431646818234369
- https://twitter.com/blocksecteam/status/1509466576848064512
- https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611
- https://explorer.fuse.io/address/0x5De15b5543c178C111915d6B8ae929Af01a8cC58
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.erc677-reentrancy.erc677-reentrancy
shortlink: https://sg.run/BXnR
semgrep.dev:
rule:
r_id: 67651
rv_id: 946613
rule_id: L1Ub0L
version_id: 3ZTOPdd
url: https://semgrep.dev/playground/r/3ZTOPdd/solidity.security.erc677-reentrancy.erc677-reentrancy
origin: community
patterns:
- pattern-inside: |
function transfer(...) {
...
}
- pattern: callAfterTransfer(...);
languages:
- solidity
severity: WARNING
- id: solidity.security.erc721-reentrancy.erc721-reentrancy
message: ERC721 onERC721Received() reentrancy
metadata:
category: security
technology:
- solidity
cwe: 'CWE-841: Improper Enforcement of Behavioral Workflow'
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- vuln
references:
- https://blocksecteam.medium.com/when-safemint-becomes-unsafe-lessons-from-the-hypebears-security-incident-2965209bda2a
- https://etherscan.io/address/0x14e0a1f310e2b7e321c91f58847e98b8c802f6ef
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.erc721-reentrancy.erc721-reentrancy
shortlink: https://sg.run/WBoE
semgrep.dev:
rule:
r_id: 67653
rv_id: 946615
rule_id: gxU2qG
version_id: PkTQZYA
url: https://semgrep.dev/playground/r/PkTQZYA/solidity.security.erc721-reentrancy.erc721-reentrancy
origin: community
patterns:
- pattern: _checkOnERC721Received(...)
languages:
- solidity
severity: WARNING
- id: solidity.security.erc777-reentrancy.erc777-reentrancy
message: ERC777 tokensReceived() reentrancy
metadata:
category: security
technology:
- solidity
cwe: 'CWE-841: Improper Enforcement of Behavioral Workflow'
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- vuln
references:
- https://mirror.xyz/baconcoin.eth/LHaPiX38mnx8eJ2RVKNXHttHfweQMKNGmEnX4KUksk0
- https://etherscan.io/address/0xf53f00f844b381963a47fde3325011566870b31f
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.erc777-reentrancy.erc777-reentrancy
shortlink: https://sg.run/0Jpw
semgrep.dev:
rule:
r_id: 67654
rv_id: 946616
rule_id: QrUrJj
version_id: JdTDyg1
url: https://semgrep.dev/playground/r/JdTDyg1/solidity.security.erc777-reentrancy.erc777-reentrancy
origin: community
patterns:
- pattern: $X.tokensReceived(...);
languages:
- solidity
severity: WARNING
- id: solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash
message: blockhash(block.number) and blockhash(block.number + N) always returns
0.
metadata:
category: security
technology:
- solidity
cwe: 'CWE-341: Predictable from Observable State'
confidence: HIGH
likelihood: LOW
impact: MEDIUM
subcategory:
- vuln
references:
- https://blog.positive.com/predicting-random-numbers-in-ethereum-smart-contracts-e5358c6b8620
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash
shortlink: https://sg.run/qvPO
semgrep.dev:
rule:
r_id: 67656
rv_id: 946618
rule_id: 4bUPoB
version_id: GxTP7wj
url: https://semgrep.dev/playground/r/GxTP7wj/solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash
origin: community
patterns:
- pattern-either:
- pattern: blockhash(block.number)
- pattern: blockhash(block.number + $N)
- pattern: blockhash(block.number * $N)
- pattern: block.blockhash(block.number)
- pattern: block.blockhash(block.number + $N)
- pattern: block.blockhash(block.number * $N)
severity: ERROR
languages:
- solidity
- id: solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation
message: Keep3rV2.current() call has high data freshness, but it has low security, an
exploiter simply needs to manipulate 2 data points to be able to impact the feed.
metadata:
category: security
technology:
- solidity
cwe: 'CWE-682: Incorrect Calculation'
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- vuln
references:
- https://twitter.com/peckshield/status/1510232640338608131
- https://twitter.com/FrankResearcher/status/1510239094777032713
- https://twitter.com/larry0x/status/1510263618180464644
- https://andrecronje.medium.com/keep3r-network-on-chain-oracle-price-feeds-3c67ed002a9
- https://etherscan.io/address/0x210ac53b27f16e20a9aa7d16260f84693390258f
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation
shortlink: https://sg.run/lkEo
semgrep.dev:
rule:
r_id: 67657
rv_id: 946619
rule_id: PeUrYv
version_id: RGTAgvQ
url: https://semgrep.dev/playground/r/RGTAgvQ/solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation
origin: community
patterns:
- pattern: $KEEPER.current($TOKENIN, $AMOUNTIN, $TOKENOUT);
languages:
- solidity
severity: WARNING
- id: solidity.security.no-bidi-characters.no-bidi-characters
message: The code must not contain any of Unicode Direction Control Characters
metadata:
category: security
technology:
- solidity
cwe: 'CWE-837: Improper Enforcement of a Single, Unique Action'
confidence: HIGH
likelihood: LOW
impact: LOW
subcategory:
- audit
references:
- https://entethalliance.org/specs/ethtrust-sl/v1/#req-1-unicode-bdo
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.no-bidi-characters.no-bidi-characters
shortlink: https://sg.run/6DyK
semgrep.dev:
rule:
r_id: 67659
rv_id: 946622
rule_id: 5rUD6Z
version_id: DkTNp8K
url: https://semgrep.dev/playground/r/DkTNp8K/solidity.security.no-bidi-characters.no-bidi-characters
origin: community
patterns:
- pattern-either:
- pattern-regex: "\u202A"
- pattern-regex: "\u202B"
- pattern-regex: "\u202D"
- pattern-regex: "\u202E"
- pattern-regex: "\u2066"
- pattern-regex: "\u2067"
- pattern-regex: "\u2068"
- pattern-regex: "\u202C"
- pattern-regex: "\u2069"
languages:
- solidity
severity: WARNING
- id: solidity.security.proxy-storage-collision.proxy-storage-collision
message: Proxy declares a state var that may override a storage slot of the implementation
metadata:
category: security
technology:
- solidity
cwe: 'CWE-787: Out-of-bounds Write'
confidence: HIGH
likelihood: MEDIUM
impact: HIGH
subcategory:
- vuln
references:
- https://blog.audius.co/article/audius-governance-takeover-post-mortem-7-23-22
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.proxy-storage-collision.proxy-storage-collision
shortlink: https://sg.run/2GXr
semgrep.dev:
rule:
r_id: 67663
rv_id: 946626
rule_id: BYU0EL
version_id: qkT4jqp
url: https://semgrep.dev/playground/r/qkT4jqp/solidity.security.proxy-storage-collision.proxy-storage-collision
origin: community
patterns:
- pattern-either:
- pattern: |
contract $CONTRACT is ..., $PROXY, ... {
...
$TYPE $VAR;
...
constructor(...) {
...
}
...
}
- pattern: |
contract $CONTRACT is ..., $PROXY, ... {
...
$TYPE $VAR = ...;
...
constructor(...) {
...
}
...
}
- pattern-not: |
contract $CONTRACT is ..., $PROXY, ... {
$TYPE immutable $VAR;
...
constructor(...) {
...
}
...
}
- pattern-not: |
contract $CONTRACT is ..., $PROXY, ... {
$TYPE immutable $VAR = ...;
...
constructor(...) {
...
}
...
}
- pattern-not: |
contract $CONTRACT is ..., $PROXY, ... {
$TYPE constant $VAR = ...;
...
constructor(...) {
...
}
...
}
- metavariable-regex:
metavariable: $CONTRACT
regex: ^(?!AdminUpgradeabilityProxy|OwnedUpgrade*abilityProxy).*$
- metavariable-regex:
metavariable: $PROXY
regex: (UpgradeabilityProxy|AdminUpgradeabilityProxy|OwnedUpgrade*abilityProxy|TransparentUpgradeableProxy|ERC1967Proxy)
- focus-metavariable: $PROXY
languages:
- solidity
severity: WARNING
- id: solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug
message: transferFrom() can steal allowance of other accounts
metadata:
category: security
technology:
- solidity
cwe: 'CWE-688: Function Call With Incorrect Variable or Reference as Argument'
confidence: HIGH
likelihood: HIGH
impact: HIGH
subcategory:
- vuln
references:
- https://medium.com/immunefi/redacted-cartel-custom-approval-logic-bugfix-review-9b2d039ca2c5
- https://etherscan.io/address/0x186E55C0BebD2f69348d94C4A27556d93C5Bd36C
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug
shortlink: https://sg.run/XDzj
semgrep.dev:
rule:
r_id: 67664
rv_id: 946627
rule_id: DbU0Qb
version_id: l4Tx9Px
url: https://semgrep.dev/playground/r/l4Tx9Px/solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug
origin: community
patterns:
- pattern-inside: |
function transferFrom(...) {
...
}
- pattern: _approve(..., allowance(sender, recipient).sub(amount, ...), ...);
languages:
- solidity
severity: ERROR
- id: solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control
message: setMultipleAllowances() is missing onlyOwner modifier
metadata:
category: security
technology:
- solidity
cwe: 'CWE-284: Improper Access Control'
confidence: HIGH
likelihood: HIGH
impact: HIGH
subcategory:
- vuln
references:
- https://twitter.com/danielvf/status/1494317265835147272
- https://etherscan.io/address/0x876b9ebd725d1fa0b879fcee12560a6453b51dc8
- https://play.secdim.com/game/dapp/challenge/rigoownsol
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control
shortlink: https://sg.run/jbZP
semgrep.dev:
rule:
r_id: 67665
rv_id: 946628
rule_id: WAUpbw
version_id: YDTvRP2
url: https://semgrep.dev/playground/r/YDTvRP2/solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control
origin: community
patterns:
- pattern: function setMultipleAllowances(...) {...}
- pattern-not: function setMultipleAllowances(...) onlyOwner {...}
languages:
- solidity
severity: ERROR
- id: solidity.security.superfluid-ctx-injection.superfluid-ctx-injection
message: A specially crafted calldata may be used to impersonate other accounts
metadata:
category: security
technology:
- solidity
cwe: 'CWE-20: Improper Input Validation'
confidence: HIGH
likelihood: HIGH
impact: HIGH
subcategory:
- vuln
references:
- https://rekt.news/superfluid-rekt/
- https://medium.com/superfluid-blog/08-02-22-exploit-post-mortem-15ff9c97cdd
- https://polygonscan.com/address/0x07711bb6dfbc99a1df1f2d7f57545a67519941e7
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/solidity.security.superfluid-ctx-injection.superfluid-ctx-injection
shortlink: https://sg.run/9KNy
semgrep.dev:
rule:
r_id: 67667
rv_id: 946630
rule_id: KxUqld
version_id: o5TZexb
url: https://semgrep.dev/playground/r/o5TZexb/solidity.security.superfluid-ctx-injection.superfluid-ctx-injection
origin: community
patterns:
- pattern: $T.decodeCtx(ctx);
- pattern-not-inside: |
require($T.isCtxValid(...), "...");
...
languages:
- solidity
severity: ERROR
- patterns:
- pattern-either:
- pattern: |
provisioner "remote-exec" {
...
}
- pattern: |
provisioner "local-exec" {
...
}
- pattern-inside: |
resource "aws_instance" "..." {
...
}
id: terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec
message: Provisioners are a tool of last resort and should be avoided where possible.
Provisioner behavior cannot be mapped by Terraform as part of a plan, and execute
arbitrary shell commands by design.
languages:
- terraform
severity: WARNING
metadata:
category: security
owasp:
- A03:2021 - Injection
- A01:2017 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-77: Improper Neutralization of Special Elements used in a Command (''Command
Injection'')'
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
subcategory:
- audit
confidence: HIGH
likelihood: HIGH
impact: MEDIUM
technology:
- terraform
references:
- https://developer.hashicorp.com/terraform/language/resources/provisioners/remote-exec
- https://developer.hashicorp.com/terraform/language/resources/provisioners/local-exec
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
- Other
source: https://semgrep.dev/r/terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec
shortlink: https://sg.run/7EjQ
semgrep.dev:
rule:
r_id: 70982
rv_id: 1263736
rule_id: EwUxO1
version_id: bZT53j1
url: https://semgrep.dev/playground/r/bZT53j1/terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec
origin: community
- id: clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe
languages:
- clojure
severity: ERROR
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://xerces.apache.org/xerces2-j/features.html
source-rule-url: https://github.com/clj-holmes/clj-holmes-rules/blob/main/security/xxe-clojure-xml/xxe-clojure-xml.yml
category: security
technology:
- clojure
- xml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe
shortlink: https://sg.run/v7An
semgrep.dev:
rule:
r_id: 71533
rv_id: 1262608
rule_id: bwU3Gj
version_id: WrTqKyD
url: https://semgrep.dev/playground/r/WrTqKyD/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe
origin: community
message: DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory.
Without prohibiting external entity declarations, this is vulnerable to XML external
entity attacks. Disable this by setting the feature "http://apache.org/xml/features/disallow-doctype-decl"
to true. Alternatively, allow DOCTYPE declarations and only prohibit external
entities declarations. This can be done by setting the features "http://xml.org/sax/features/external-general-entities"
and "http://xml.org/sax/features/external-parameter-entities" to false.
patterns:
- pattern-inside: |
(ns ... (:require [clojure.xml :as ...]))
...
- pattern-either:
- pattern-inside: |
(def ... ... ( ... ))
- pattern-inside: |
(defn ... ... ( ... ))
- pattern-either:
- pattern: (clojure.xml/parse $INPUT)
- patterns:
- pattern-inside: |
(doto (javax.xml.parsers.SAXParserFactory/newInstance) ...)
- pattern: (.setFeature "http://apache.org/xml/features/disallow-doctype-decl"
false)
- pattern-not-inside: |
(doto (javax.xml.parsers.SAXParserFactory/newInstance)
...
(.setFeature "http://xml.org/sax/features/external-general-entities" false)
...
(.setFeature "http://xml.org/sax/features/external-parameter-entities" false)
...)
- pattern-not-inside: |
(doto (javax.xml.parsers.SAXParserFactory/newInstance)
...
(.setFeature "http://xml.org/sax/features/external-parameter-entities" false)
...
(.setFeature "http://xml.org/sax/features/external-general-entities" false)
...)
- id: clojure.lang.security.use-of-sha1.use-of-sha1
languages:
- clojure
severity: WARNING
message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not
collision resistant and is therefore not suitable as a cryptographic signature.
Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function
applications.
metadata:
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html
- https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
technology:
- clojure
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
- 'CWE-328: Use of Weak Hash'
category: security
subcategory:
- vuln
confidence: HIGH
likelihood: MEDIUM
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/clojure.lang.security.use-of-sha1.use-of-sha1
shortlink: https://sg.run/dvwX
semgrep.dev:
rule:
r_id: 71534
rv_id: 1262610
rule_id: NbUy12
version_id: K3TKk7E
url: https://semgrep.dev/playground/r/K3TKk7E/clojure.lang.security.use-of-sha1.use-of-sha1
origin: community
patterns:
- pattern-either:
- pattern: (MessageDigest/getInstance $ALGO)
- pattern: (java.security.MessageDigest/getInstance $ALGO)
- metavariable-regex:
metavariable: $ALGO
regex: (((org\.apache\.commons\.codec\.digest\.)?MessageDigestAlgorithms/)?"?(SHA-1|SHA1)"?)
- id: generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute
languages:
- generic
severity: INFO
message: Visualforce Pages must have the cspHeader attribute set to true. This attribute
is available in API version 55 or higher.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://help.salesforce.com/s/articleView?id=sf.csp_trusted_sites.htm&type=5
category: security
subcategory:
- vuln
technology:
- salesforce
- visualforce
cwe2022-top25: true
cwe2021-top25: true
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute
shortlink: https://sg.run/yoj8
semgrep.dev:
rule:
r_id: 72424
rv_id: 1262907
rule_id: DbUj7d
version_id: RGT0L0r
url: https://semgrep.dev/playground/r/RGT0L0r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute
origin: community
patterns:
- pattern: <apex:page...>...</apex:page>
- pattern-not: <apex:page...cspHeader="true"...>...</apex:page>
- pattern-not: <apex:page...>...<!--deprecated-->...</apex:page>
- pattern-not: <apex:page...>...<!-- deprecated -->...</apex:page>
paths:
include:
- '*.page'
- id: generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version
languages:
- generic
severity: WARNING
message: Visualforce Pages must use API version 55 or higher for required use of
the cspHeader attribute set to true.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_pages.htm
category: security
subcategory:
- vuln
technology:
- salesforce
- visualforce
cwe2022-top25: true
cwe2021-top25: true
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version
shortlink: https://sg.run/rWr6
semgrep.dev:
rule:
r_id: 72425
rv_id: 1262908
rule_id: WAUwJW
version_id: A8Tgdgn
url: https://semgrep.dev/playground/r/A8Tgdgn/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version
origin: community
patterns:
- pattern-inside: <apiVersion.../apiVersion>
- pattern-either:
- pattern-regex: '[>][0-9].[0-9][<]'
- pattern-regex: '[>][1-4][0-9].[0-9][<]'
- pattern-regex: '[>][5][0-4].[0-9][<]'
paths:
include:
- '*.page-meta.xml'
- id: python.django.security.hashids-with-django-secret.hashids-with-django-secret
languages:
- python
message: The Django secret key is used as salt in HashIDs. The HashID mechanism
is not secure. By observing sufficient HashIDs, the salt used to construct them
can be recovered. This means the Django secret key can be obtained by attackers,
through the HashIDs.
metadata:
category: security
subcategory:
- vuln
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- "A02:2021 \u2013 Cryptographic Failures"
references:
- https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SECRET_KEY
- http://carnage.github.io/2015/08/cryptanalysis-of-hashids
technology:
- django
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.django.security.hashids-with-django-secret.hashids-with-django-secret
shortlink: https://sg.run/bxeZ
semgrep.dev:
rule:
r_id: 72426
rv_id: 946163
rule_id: 0oUXqy
version_id: 0bT15nn
url: https://semgrep.dev/playground/r/0bT15nn/python.django.security.hashids-with-django-secret.hashids-with-django-secret
origin: community
pattern-either:
- pattern: hashids.Hashids(..., salt=django.conf.settings.SECRET_KEY, ...)
- pattern: hashids.Hashids(django.conf.settings.SECRET_KEY, ...)
severity: ERROR
- id: python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret
languages:
- python
message: The Flask secret key is used as salt in HashIDs. The HashID mechanism is
not secure. By observing sufficient HashIDs, the salt used to construct them can
be recovered. This means the Flask secret key can be obtained by attackers, through
the HashIDs.
metadata:
category: security
subcategory:
- vuln
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- "A02:2021 \u2013 Cryptographic Failures"
references:
- https://flask.palletsprojects.com/en/2.2.x/config/#SECRET_KEY
- http://carnage.github.io/2015/08/cryptanalysis-of-hashids
technology:
- flask
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret
shortlink: https://sg.run/N0Rx
semgrep.dev:
rule:
r_id: 72427
rv_id: 946220
rule_id: KxUX3z
version_id: 0bT15Px
url: https://semgrep.dev/playground/r/0bT15Px/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret
origin: community
pattern-either:
- pattern: hashids.Hashids(..., salt=flask.current_app.config['SECRET_KEY'], ...)
- pattern: hashids.Hashids(flask.current_app.config['SECRET_KEY'], ...)
- patterns:
- pattern-inside: |
$APP = flask.Flask(...)
...
- pattern-either:
- pattern: hashids.Hashids(..., salt=$APP.config['SECRET_KEY'], ...)
- pattern: hashids.Hashids($APP.config['SECRET_KEY'], ...)
severity: ERROR
- id: yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions
patterns:
- pattern: |
"*"
- pattern-inside: |
resources: $A
...
- pattern-inside: |
verbs: $A
...
- pattern-inside: |
- apiGroups: [""]
...
- pattern-inside: |
apiVersion: rbac.authorization.k8s.io/v1
...
- pattern-inside: |
kind: ClusterRole
...
message: 'Semgrep detected a Kubernetes core API ClusterRole with excessive permissions.
Attaching excessive permissions to a ClusterRole associated with the core namespace
allows the V1 API to perform arbitrary actions on arbitrary resources attached
to the cluster. Prefer explicit allowlists of verbs/resources when configuring
the core API namespace. '
languages:
- yaml
severity: WARNING
metadata:
cwe:
- 'CWE-269: Improper Privilege Management'
owasp:
- A05:2021 - Security Misconfiguration
- A06:2017 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
references:
- https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole
- https://kubernetes.io/docs/concepts/security/rbac-good-practices/#general-good-practice
- https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#api-groups
category: security
technology:
- kubernetes
cwe2021-top25: false
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions
shortlink: https://sg.run/x6Dz
semgrep.dev:
rule:
r_id: 73474
rv_id: 1263935
rule_id: GdUR2A
version_id: 9lT4bw7
url: https://semgrep.dev/playground/r/9lT4bw7/yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions
origin: community
- id: go.lang.security.injection.open-redirect.open-redirect
languages:
- go
severity: WARNING
message: An HTTP redirect was found to be crafted from user-input `$REQUEST`. This
can lead to open redirect vulnerabilities, potentially allowing attackers to redirect
users to malicious web sites. It is recommend where possible to not allow user-input
to craft the redirect URL. When user-input is necessary to craft the request,
it is recommended to follow OWASP best practices to restrict the URL to domains
in an allowlist.
options:
interfile: true
metadata:
cwe:
- 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')'
references:
- https://knowledge-base.secureflag.com/vulnerabilities/unvalidated_redirects___forwards/open_redirect_go_lang.html
category: security
technology:
- go
confidence: HIGH
description: An HTTP redirect was found to be crafted from user-input leading
to an open redirect vulnerability
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Open Redirect
source: https://semgrep.dev/r/go.lang.security.injection.open-redirect.open-redirect
shortlink: https://sg.run/2ZW45
semgrep.dev:
rule:
r_id: 113619
rv_id: 945608
rule_id: DbU6RlN
version_id: GxTP7J7
url: https://semgrep.dev/playground/r/GxTP7J7/go.lang.security.injection.open-redirect.open-redirect
origin: community
mode: taint
pattern-sources:
- label: INPUT
patterns:
- pattern-either:
- pattern: |
($REQUEST : *http.Request).$ANYTHING
- pattern: |
($REQUEST : http.Request).$ANYTHING
- metavariable-regex:
metavariable: $ANYTHING
regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
- label: CLEAN
requires: INPUT
patterns:
- pattern-either:
- pattern: |
"$URLSTR" + $INPUT
- patterns:
- pattern-either:
- pattern: fmt.Fprintf($F, "$URLSTR", $INPUT, ...)
- pattern: fmt.Sprintf("$URLSTR", $INPUT, ...)
- pattern: fmt.Printf("$URLSTR", $INPUT, ...)
- metavariable-regex:
metavariable: $URLSTR
regex: .*//[a-zA-Z0-10]+\..*
pattern-sinks:
- requires: INPUT and not CLEAN
patterns:
- pattern: http.Redirect($W, $REQ, $URL, ...)
- focus-metavariable: $URL
- id: php.lang.security.base-convert-loses-precision.base-convert-loses-precision
message: The function base_convert uses 64-bit numbers internally, and does not
correctly convert large numbers. It is not suitable for random tokens such as
those used for session tokens or CSRF tokens.
metadata:
references:
- https://www.php.net/base_convert
- https://www.sjoerdlangkemper.nl/2017/03/15/dont-use-base-convert-on-random-tokens/
category: security
technology:
- php
cwe:
- 'CWE-190: Integer Overflow or Wraparound'
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/php.lang.security.base-convert-loses-precision.base-convert-loses-precision
shortlink: https://sg.run/kxpGo
semgrep.dev:
rule:
r_id: 115928
rv_id: 945988
rule_id: 7KUgBAk
version_id: yeT0n4K
url: https://semgrep.dev/playground/r/yeT0n4K/php.lang.security.base-convert-loses-precision.base-convert-loses-precision
origin: community
languages:
- php
severity: WARNING
mode: taint
pattern-sources:
- pattern: hash(...)
- pattern: hash_hmac(...)
- pattern: sha1(...)
- pattern: md5(...)
- patterns:
- pattern: random_bytes($N)
- metavariable-comparison:
metavariable: $N
comparison: $N > 7
- patterns:
- pattern: openssl_random_pseudo_bytes($N)
- metavariable-comparison:
metavariable: $N
comparison: $N > 7
- patterns:
- pattern: $OBJ->get_random_bytes($N)
- metavariable-comparison:
metavariable: $N
comparison: $N > 7
pattern-sinks:
- pattern: base_convert(...)
pattern-sanitizers:
- patterns:
- pattern: substr(..., $LENGTH)
- metavariable-comparison:
metavariable: $LENGTH
comparison: $LENGTH <= 7
- id: javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify
message: Detected the decoding of a JWT token without a verify step. JWT tokens
must be verified before use, otherwise the token's integrity is unknown. This
means a malicious actor could forge a JWT token with any claims. Set 'verify'
to `true` before using the token.
severity: ERROR
metadata:
owasp:
- A05:2021 - Security Misconfiguration
- A07:2021 - Identification and Authentication Failures
- A02:2025 - Security Misconfiguration
- A07:2025 - Authentication Failures
cwe:
- 'CWE-287: Improper Authentication'
- 'CWE-345: Insufficient Verification of Data Authenticity'
- 'CWE-347: Improper Verification of Cryptographic Signature'
category: security
subcategory:
- vuln
technology:
- jwt-simple
- jwt
confidence: HIGH
likelihood: MEDIUM
impact: HIGH
references:
- https://www.npmjs.com/package/jwt-simple
- https://cwe.mitre.org/data/definitions/287
- https://cwe.mitre.org/data/definitions/345
- https://cwe.mitre.org/data/definitions/347
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
- Improper Authentication
source: https://semgrep.dev/r/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify
shortlink: https://sg.run/zdjod
semgrep.dev:
rule:
r_id: 120561
rv_id: 1263191
rule_id: r6UyNLy
version_id: 3ZT4Xxv
url: https://semgrep.dev/playground/r/3ZT4Xxv/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify
origin: community
languages:
- javascript
- typescript
patterns:
- pattern-inside: |
$JWT = require('jwt-simple');
...
- pattern: $JWT.decode($TOKEN, $SECRET, $NOVERIFY, ...)
- metavariable-pattern:
metavariable: $NOVERIFY
patterns:
- pattern-either:
- pattern: |
true
- pattern: |
"..."
- id: solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx
languages:
- solidity
message: Missing check for 'from' and 'to' being the same before updating balances
could lead to incorrect balance manipulation on self-transfers. Include a check
to ensure 'from' and 'to' are not the same before updating balances to prevent
balance manipulation during self-transfers.
severity: ERROR
metadata:
category: security
technology:
- blockchain
- solidity
cwe: 'CWE-682: Incorrect Calculation'
subcategory:
- vuln
confidence: HIGH
likelihood: HIGH
impact: HIGH
owasp:
- A7:2021 Identification and Authentication Failures
references:
- https://blog.verichains.io/p/miner-project-attacked-by-vulnerabilities
- https://x.com/shoucccc/status/1757777764646859121
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx
shortlink: https://sg.run/Or6X7
semgrep.dev:
rule:
r_id: 133075
rv_id: 946620
rule_id: 6JUv7Nz
version_id: A8TJzYz
url: https://semgrep.dev/playground/r/A8TJzYz/solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx
origin: community
patterns:
- pattern-either:
- pattern: |
_balances[$FROM] = $FROM_BALANCE - value;
- pattern: |
_balances[$TO] = $TO_BALANCE + value;
- pattern-not-inside: |
if ($FROM != $TO) {
...
_balances[$FROM] = $FROM_BALANCE - value;
...
_balances[$TO] = $TO_BALANCE + value;
...
}
- pattern-inside: |
function _update(address $FROM, address $TO, uint256 value, bool mint) internal virtual {
...
}
- id: yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication
languages:
- yaml
message: Basic authentication is considered weak and should be avoided. Use a different
authentication scheme, such of OAuth2, OpenID Connect, or mTLS.
severity: ERROR
patterns:
- pattern-inside: |
openapi: $VERSION
...
components:
...
securitySchemes:
...
$SCHEME:
...
- metavariable-regex:
metavariable: $VERSION
regex: 3.*
- pattern: |
type: http
...
scheme: basic
metadata:
category: security
subcategory:
- vuln
technology:
- openapi
likelihood: MEDIUM
impact: HIGH
confidence: HIGH
cwe: 'CWE-287: Improper Authentication'
owasp:
- A04:2021 Insecure Design
- A07:2021 Identification and Authentication Failures
references:
- https://cwe.mitre.org/data/definitions/287.html
- https://owasp.org/Top10/A04_2021-Insecure_Design/
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication
shortlink: https://sg.run/v8wNW
semgrep.dev:
rule:
r_id: 133077
rv_id: 947072
rule_id: zdUKgEX
version_id: 0bT1ErG
url: https://semgrep.dev/playground/r/0bT1ErG/yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication
origin: community
- id: generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token
pattern-regex: (?:api_live(?:_[a-zA-Z]{2})?\.[a-zA-Z0-9-_]{11}\.[-_a-zA-Z0-9]{32})
languages:
- regex
message: Onfido live API Token detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
category: security
technology:
- secrets
- onfido
confidence: HIGH
references:
- https://documentation.onfido.com/api/latest/#api-tokens
subcategory:
- audit
likelihood: HIGH
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token
shortlink: https://sg.run/lBoKD
semgrep.dev:
rule:
r_id: 141957
rv_id: 945509
rule_id: WAUW9q3
version_id: A8TJzE2
url: https://semgrep.dev/playground/r/A8TJzE2/generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token
origin: community
- id: dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount
message: The Dockerfile(image) mounts docker.sock to the container which may allow
an attacker already inside of the container to escape container and execute arbitrary
commands on the host machine.
languages:
- dockerfile
- yaml
severity: ERROR
metadata:
cwe:
- 'CWE-862: Missing Authorization'
- 'CWE-269: Improper Privilege Management'
confidence: HIGH
likelihood: MEDIUM
impact: HIGH
subcategory:
- audit
technology:
- dockerfile
category: security
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html
- https://redfoxsec.com/blog/insecure-volume-mounts-in-docker/
- https://blog.quarkslab.com/why-is-exposing-the-docker-socket-a-really-bad-idea.html
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount
shortlink: https://sg.run/10AAQ
semgrep.dev:
rule:
r_id: 146566
rv_id: 945266
rule_id: oqUgAAk
version_id: WrTEoEq
url: https://semgrep.dev/playground/r/WrTEoEq/dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount
origin: community
pattern-either:
- patterns:
- pattern: VOLUME $X
- metavariable-regex:
metavariable: $X
regex: /var/run/docker.sock
- patterns:
- pattern-regex: '- "/var/run/docker.sock:.*"'
- pattern-inside: |
volumes:
...
- id: javascript.node-crypto.security.aead-no-final.aead-no-final
message: The 'final' call of a Decipher object checks the authentication tag in
a mode for authenticated encryption. Failing to call 'final' will invalidate all
integrity guarantees of the released ciphertext.
metadata:
cwe:
- 'CWE-310: CWE CATEGORY: Cryptographic Issues'
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
category: security
subcategory:
- vuln
technology:
- node-crypto
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
references:
- https://nodejs.org/api/crypto.html#deciphersetauthtagbuffer-encoding
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures/
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/javascript.node-crypto.security.aead-no-final.aead-no-final
shortlink: https://sg.run/r6EEA
semgrep.dev:
rule:
r_id: 146569
rv_id: 1263222
rule_id: 2ZUz884
version_id: zyTb2X0
url: https://semgrep.dev/playground/r/zyTb2X0/javascript.node-crypto.security.aead-no-final.aead-no-final
origin: community
languages:
- javascript
- typescript
severity: ERROR
patterns:
- pattern: |
$DECIPHER = $CRYPTO.createDecipheriv('$ALGO', ...)
...
$DECIPHER.update(...)
- pattern-not-inside: |
$DECIPHER = $CRYPTO.createDecipheriv('$ALGO', ...)
...
$DECIPHER.final(...)
- metavariable-regex:
metavariable: $ALGO
regex: .*(-gcm|-ccm|-ocb|chacha20-poly1305)$
- id: javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv
message: The deprecated functions 'createCipher' and 'createDecipher' generate the
same initialization vector every time. For counter modes such as CTR, GCM, or
CCM this leads to break of both confidentiality and integrity, if the key is used
more than once. Other modes are still affected in their strength, though they're
not completely broken. Use 'createCipheriv' or 'createDecipheriv' instead.
metadata:
cwe:
- 'CWE-1204: Generation of Weak Initialization Vector (IV)'
category: security
subcategory:
- vuln
technology:
- node-crypto
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
references:
- https://nodejs.org/api/crypto.html#cryptocreatecipheralgorithm-password-options
- https://nodejs.org/api/crypto.html#cryptocreatedecipheralgorithm-password-options
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv
shortlink: https://sg.run/bw33r
semgrep.dev:
rule:
r_id: 146570
rv_id: 945898
rule_id: X5UQRR7
version_id: ZRT3510
url: https://semgrep.dev/playground/r/ZRT3510/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv
origin: community
languages:
- javascript
- typescript
severity: ERROR
patterns:
- pattern-either:
- pattern: |
$CRYPTO.createCipher(...)
- pattern: |
$CRYPTO.createDecipher(...)
- id: yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false
languages:
- yaml
message: 'Found ''x-openai-isConsequential: false'' in a state-changing HTTP method:
$METHOD $PATH. This Action configuration will enable the ''Always Allow'' option
for state-changing HTTP methods, such as POST, PUT, PATCH, or DELETE. The risk
of a user selecting the ''Always Allow'' button is that the agent could perform
unintended actions on behalf of the user. When working with sensitive functionality,
it is always best to include a Human In The Loop (HITL) type of control. Consider
the trade-off between security and user friction and then make a risk-based decision
about this function.'
severity: WARNING
pattern-either:
- pattern-inside: |
post:
...
x-openai-isConsequential: false
- pattern-inside: |
put:
...
x-openai-isConsequential: false
- pattern-inside: |
patch:
...
x-openai-isConsequential: false
- pattern-inside: |
delete:
...
x-openai-isConsequential: false
metadata:
category: security
subcategory:
- audit
technology:
- openapi
- openai
likelihood: HIGH
impact: HIGH
confidence: HIGH
cwe: 'CWE-441: Unintended Proxy or Intermediary (''Confused Deputy'')'
owasp:
- A04:2021 Insecure Design
- LLM08:2023 - Excessive Agency
references:
- https://platform.openai.com/docs/actions/consequential-flag
- https://owasp.org/Top10/A04_2021-Insecure_Design/
- https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-2023-v1_1.pdf
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false
shortlink: https://sg.run/x8EEP
semgrep.dev:
rule:
r_id: 146574
rv_id: 947071
rule_id: yyURooD
version_id: WrTEZN8
url: https://semgrep.dev/playground/r/WrTEZN8/yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false
origin: community
- id: go.lang.security.audit.crypto.sha224-hash.sha224-hash
pattern-either:
- patterns:
- pattern-inside: |
import "crypto/sha256"
...
- pattern-either:
- pattern: |
sha256.New224()
- pattern: |
sha256.Sum224(...)
- patterns:
- pattern-inside: |
import "golang.org/x/crypto/sha3"
...
- pattern-either:
- pattern: |
sha3.New224()
- pattern: |
sha3.Sum224(...)
message: This code uses a 224-bit hash function, which is deprecated or disallowed
in some security policies. Consider updating to a stronger hash function such
as SHA-384 or higher to ensure compliance and security.
languages:
- go
severity: WARNING
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-328: Use of Weak Hash'
category: security
technology:
- go
references:
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf
- https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography
subcategory:
- vuln
likelihood: LOW
impact: LOW
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/go.lang.security.audit.crypto.sha224-hash.sha224-hash
shortlink: https://sg.run/ReJwY
semgrep.dev:
rule:
r_id: 151749
rv_id: 1262925
rule_id: GdUvElR
version_id: 9lT4b4w
url: https://semgrep.dev/playground/r/9lT4b4w/go.lang.security.audit.crypto.sha224-hash.sha224-hash
origin: community
- id: java.lang.security.audit.crypto.use-of-sha224.use-of-sha224
message: This code uses a 224-bit hash function, which is deprecated or disallowed
in some security policies. Consider updating to a stronger hash function such
as SHA-384 or higher to ensure compliance and security.
languages:
- java
severity: WARNING
metadata:
functional-categories:
- crypto::search::hash-algorithm::javax.crypto
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-328: Use of Weak Hash'
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.5 Insecure Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
category: security
technology:
- java
references:
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf
- https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography
subcategory:
- vuln
likelihood: LOW
impact: LOW
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha224.use-of-sha224
shortlink: https://sg.run/Ab2KQ
semgrep.dev:
rule:
r_id: 151750
rv_id: 1263017
rule_id: ReUDGEz
version_id: YDTZewo
url: https://semgrep.dev/playground/r/YDTZewo/java.lang.security.audit.crypto.use-of-sha224.use-of-sha224
origin: community
pattern-either:
- pattern: org.apache.commons.codec.digest.DigestUtils.getSha3_224Digest()
- pattern: org.apache.commons.codec.digest.DigestUtils.getSha512_224Digest()
- pattern: org.apache.commons.codec.digest.DigestUtils.sha3_224(...)
- pattern: org.apache.commons.codec.digest.DigestUtils.sha3_224Hex(...)
- pattern: org.apache.commons.codec.digest.DigestUtils.sha512_224(...)
- pattern: org.apache.commons.codec.digest.DigestUtils.sha512_224Hex(...)
- pattern: new org.apache.commons.codec.digest.DigestUtils(org.apache.commons.codec.digest.MessageDigestAlgorithms.SHA_224)
- pattern: new org.apache.commons.codec.digest.DigestUtils(org.apache.commons.codec.digest.MessageDigestAlgorithms.SHA_512_224)
- pattern: new org.apache.commons.codec.digest.DigestUtils(org.apache.commons.codec.digest.MessageDigestAlgorithms.SHA3_224)
- patterns:
- pattern: java.security.MessageDigest.getInstance("$ALGO", ...);
- metavariable-regex:
metavariable: $ALGO
regex: .*224
- id: php.lang.security.audit.sha224-hash.sha224-hash
pattern-either:
- pattern: hash('sha224', ...);
- pattern: hash('sha512/224', ...);
- pattern: hash('sha3-224', ...);
- pattern: hash_hmac('sha224', ...);
- pattern: hash_hmac('sha512/224', ...);
- pattern: hash_hmac('sha3-224', ...);
message: This code uses a 224-bit hash function, which is deprecated or disallowed
in some security policies. Consider updating to a stronger hash function such
as SHA-384 or higher to ensure compliance and security.
metadata:
cwe:
- 'CWE-328: Use of Weak Hash'
references:
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf
- https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography
category: security
technology:
- php
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/php.lang.security.audit.sha224-hash.sha224-hash
shortlink: https://sg.run/BYXqv
semgrep.dev:
rule:
r_id: 151751
rv_id: 1263275
rule_id: AbU97EA
version_id: bZT53Jo
url: https://semgrep.dev/playground/r/bZT53Jo/php.lang.security.audit.sha224-hash.sha224-hash
origin: community
languages:
- php
severity: WARNING
- id: python.lang.security.audit.sha224-hash.sha224-hash
message: This code uses a 224-bit hash function, which is deprecated or disallowed
in some security policies. Consider updating to a stronger hash function such
as SHA-384 or higher to ensure compliance and security.
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf
- https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography
category: security
technology:
- python
subcategory:
- vuln
likelihood: LOW
impact: LOW
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.lang.security.audit.sha224-hash.sha224-hash
shortlink: https://sg.run/Db1Yv
semgrep.dev:
rule:
r_id: 151752
rv_id: 1263511
rule_id: BYUX0y9
version_id: 5PTo1QL
url: https://semgrep.dev/playground/r/5PTo1QL/python.lang.security.audit.sha224-hash.sha224-hash
origin: community
severity: WARNING
languages:
- python
pattern-either:
- pattern: hashlib.sha224(...)
- pattern: hashlib.sha3_224(...)
- id: ruby.lang.security.audit.sha224-hash.sha224-hash
message: This code uses a 224-bit hash function, which is deprecated or disallowed
in some security policies. Consider updating to a stronger hash function such
as SHA-384 or higher to ensure compliance and security.
metadata:
cwe:
- 'CWE-328: Use of Weak Hash'
references:
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf
- https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography
category: security
technology:
- ruby
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- vuln
likelihood: LOW
impact: LOW
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/ruby.lang.security.audit.sha224-hash.sha224-hash
shortlink: https://sg.run/WABbo
semgrep.dev:
rule:
r_id: 151753
rv_id: 1263592
rule_id: DbU60wQ
version_id: 8KT5rRY
url: https://semgrep.dev/playground/r/8KT5rRY/ruby.lang.security.audit.sha224-hash.sha224-hash
origin: community
languages:
- ruby
severity: WARNING
pattern-either:
- pattern: Digest::SHA224.$FUNC
- pattern: OpenSSL::Digest::SHA224.$FUNC
- pattern: SHA3::Digest::SHA224(...)
- patterns:
- pattern-either:
- pattern: OpenSSL::HMAC.hexdigest("$ALGO", ...)
- pattern: OpenSSL::HMAC.digest("$ALGO", ...)
- pattern: OpenSSL::HMAC.new($KEY, "$ALGO")
- pattern: OpenSSL::Digest.digest("$ALGO", ...)
- pattern: OpenSSL::Digest.new("$ALGO", ...)
- metavariable-regex:
metavariable: $ALGO
regex: .*224
- id: python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true
message: Function `flask.url_for` with `_external=True` argument will generate URLs
using the `Host` header of the HTTP request, which may lead to security risks
such as Host header injection
metadata:
cwe:
- 'CWE-673: External Influence of Sphere Definition'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- flask
references:
- https://flask.palletsprojects.com/en/latest/api/#flask.url_for
- https://portswigger.net/kb/issues/00500300_host-header-injection
subcategory:
- audit
likelihood: MEDIUM
impact: LOW
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true
shortlink: https://sg.run/gEGeR
semgrep.dev:
rule:
r_id: 191541
rv_id: 1263418
rule_id: JDU5oql
version_id: K3TKk6n
url: https://semgrep.dev/playground/r/K3TKk6n/python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-not: flask.url_for(..., _external=False, ...)
- pattern-not: url_for(..., _external=False, ...)
- pattern-either:
- pattern: flask.url_for(..., _external=$VAR, ...)
- pattern: url_for(..., _external=$VAR, ...)
- id: yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor
languages:
- yaml
message: The Shai-hulud backdoor creates a purposefully vulnerable github action
with the name `discussion.yaml`.
paths:
include:
- '**/.github/workflows/discussion.yaml'
metadata:
category: security
cwe:
- 'CWE-509: Replicating Malicious Code (Virus or Worm)'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
technology:
- github-actions
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source_rule_url: https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
references:
- https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
source: https://semgrep.dev/r/yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor
shortlink: https://sg.run/JdYPZ
semgrep.dev:
rule:
r_id: 238946
rv_id: 1263927
rule_id: 7KUDRPj
version_id: 6xT29ol
url: https://semgrep.dev/playground/r/6xT29ol/yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor
origin: community
patterns:
- pattern-inside: 'steps: [...]'
- pattern-inside: |
- run: ...
...
- pattern: 'run: $SHELL'
- metavariable-pattern:
language: generic
metavariable: $SHELL
patterns:
- pattern-either:
- pattern: ${{ github.event.issue.title }}
- pattern: ${{ github.event.issue.body }}
- pattern: ${{ github.event.pull_request.title }}
- pattern: ${{ github.event.pull_request.body }}
- pattern: ${{ github.event.comment.body }}
- pattern: ${{ github.event.review.body }}
- pattern: ${{ github.event.review_comment.body }}
- pattern: ${{ github.event.pages. ... .page_name}}
- pattern: ${{ github.event.head_commit.message }}
- pattern: ${{ github.event.head_commit.author.email }}
- pattern: ${{ github.event.head_commit.author.name }}
- pattern: ${{ github.event.commits ... .author.email }}
- pattern: ${{ github.event.commits ... .author.name }}
- pattern: ${{ github.event.pull_request.head.ref }}
- pattern: ${{ github.event.pull_request.head.label }}
- pattern: ${{ github.event.pull_request.head.repo.default_branch }}
- pattern: ${{ github.head_ref }}
- pattern: ${{ github.event.inputs ... }}
- pattern: ${{ github.event.discussion.title }}
- pattern: ${{ github.event.discussion.body }}
- pattern: ${{ inputs ... }}
severity: ERROR
- id: go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface
languages:
- go
message: Deserializing into `interface{}` allows arbitrary data structures and types,
which can lead to security vulnerabilities (CWE-502). Use a concrete struct type
instead.
severity: WARNING
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
category: security
technology:
- go
confidence: HIGH
likelihood: MEDIUM
impact: HIGH
subcategory:
- vuln
references:
- https://cwe.mitre.org/data/definitions/502.html
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface
shortlink: https://sg.run/6WbKL
semgrep.dev:
rule:
r_id: 274359
rv_id: 1409387
rule_id: 4bUAQDG
version_id: ZRTDkjk
url: https://semgrep.dev/playground/r/ZRTDkjk/go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface
origin: community
patterns:
- pattern-either:
- pattern: |
var $VAR interface{}
...
json.Unmarshal($DATA, &$VAR)
- pattern: |
var $VAR interface{}
...
yaml.Unmarshal($DATA, &$VAR)
- pattern: |
var $VAR interface{}
...
xml.Unmarshal($DATA, &$VAR)
- id: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
message: "GitHub Actions step uses a mutable tag or branch reference. Tags and branch
names can be silently repointed by the action owner, enabling supply-chain attacks
\u2014 as seen in the trivy-action and kics-github-action compromises. Pin the
reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`."
severity: WARNING
languages:
- yaml
metadata:
category: security
cwe:
- 'CWE-1357: Reliance on Insufficiently Trustworthy Component'
- 'CWE-353: Missing Support for Integrity Check'
owasp:
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software and Data Integrity Failures
references:
- https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
technology:
- github-actions
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
- Other
source: https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
shortlink: https://sg.run/2LgAL
semgrep.dev:
rule:
r_id: 288863
rv_id: 1413422
rule_id: GdUxYDx
version_id: xyTRDAd
url: https://semgrep.dev/playground/r/xyTRDAd/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
origin: community
patterns:
- pattern-inside: '{steps: ...}'
- pattern: |
uses: "$ACTION"
- metavariable-pattern:
metavariable: $ACTION
language: generic
patterns:
- pattern-not-regex: ^\./
- pattern-not-regex: ^docker://
- pattern-not-regex: '@[0-9a-f]{40}(\s|$)'
- id: yaml.github-actions.security.secrets-inherit.secrets-inherit
languages:
- yaml
severity: ERROR
message: 'This workflow uses `secrets: inherit` to pass all of the calling workflow''s
secrets to a reusable workflow. This violates the principle of least privilege
because the called workflow receives access to every secret in the repository,
not just the ones it needs. If the called workflow is compromised or sourced from
a third party, an attacker gains access to all repository secrets. Instead, explicitly
pass only the secrets that the called workflow requires using the `secrets:` map,
e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`.'
metadata:
category: security
cwe:
- 'CWE-250: Execution with Unnecessary Privileges'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://docs.github.com/en/actions/sharing-automations/reusing-workflows#passing-inputs-and-secrets-to-a-reusable-workflow
- https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions
technology:
- github-actions
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/yaml.github-actions.security.secrets-inherit.secrets-inherit
shortlink: https://sg.run/X2PZB
semgrep.dev:
rule:
r_id: 288864
rv_id: 1413424
rule_id: ReUQnKg
version_id: e1T42L1
url: https://semgrep.dev/playground/r/e1T42L1/yaml.github-actions.security.secrets-inherit.secrets-inherit
origin: community
patterns:
- pattern-inside: |
jobs:
...
- pattern: 'secrets: inherit'
- id: package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age
pattern-either:
- patterns:
- pattern-regex: (?ms)\[install\](?P<TARGET>[^\[]*?)(?=\[|\z)
- metavariable-regex:
metavariable: $TARGET
regex: ^(?![\s\S]*minimumReleaseAge)
- focus-metavariable: $TARGET
- patterns:
- pattern-regex: minimumReleaseAge\s*=\s*\d+
- pattern-regex: =\s*(?P<AGE>\d+)
- metavariable-comparison:
metavariable: $AGE
comparison: int($AGE) < 604800
- focus-metavariable: $AGE
- patterns:
- pattern-regex: (?m)minimumReleaseAge[ \t]*=[ \t]*(?P<VAL>[^\s\d][^\n]*)
- focus-metavariable: $VAL
- patterns:
- pattern-regex: (?m)minimumReleaseAge\s*=\s*$
message: 'This bunfig.toml does not set a minimum release age or sets it too low.
Newly published packages can be malicious or unstable. Add `minimumReleaseAge
= 604800` under the `[install]` section to wait 7 days before resolving newly
published package versions. Added in: v1.3 Reference: https://bun.sh/docs/runtime/bunfig'
languages:
- generic
severity: MEDIUM
paths:
include:
- '**/bunfig.toml'
- '**/.bunfig.toml'
metadata:
category: security
technology:
- bun
- javascript
cwe:
- 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere'
owasp:
- A08:2021 - Software and Data Integrity Failures
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- audit
vulnerability_class:
- Insecure Configuration
references:
- https://bun.sh/docs/runtime/bunfig
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age
shortlink: https://sg.run/JqPrR
semgrep.dev:
rule:
r_id: 291646
rv_id: 1423385
rule_id: oqUyJOb
version_id: BjTyRe5
url: https://semgrep.dev/playground/r/BjTyRe5/package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age
origin: community
- id: package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown
pattern-either:
- patterns:
- pattern-inside: |
updates:
...
- pattern: |
- package-ecosystem: $ECOSYSTEM
...
- pattern-not: |
- package-ecosystem: $ECOSYSTEM
...
cooldown:
...
...
- patterns:
- pattern-inside: |
updates:
...
- pattern-regex: default-days\s*:\s*(?P<DAYS>\d+)
- metavariable-comparison:
metavariable: $DAYS
comparison: int($DAYS) < 7
- focus-metavariable: $DAYS
- patterns:
- pattern-inside: |
updates:
...
- pattern: |
cooldown:
default-days: $DAYS
- metavariable-regex:
metavariable: $DAYS
regex: ^\D
- focus-metavariable: $DAYS
message: 'This Dependabot configuration does not set a cooldown period. Newly published
packages can be malicious or unstable. Add a `cooldown` block with `default-days:
7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing
updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown'
languages:
- yaml
severity: MEDIUM
paths:
include:
- '**/.github/dependabot.yml'
- '**/.github/dependabot.yaml'
metadata:
category: security
technology:
- dependabot
cwe:
- 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere'
owasp:
- A08:2021 - Software and Data Integrity Failures
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- audit
vulnerability_class:
- Insecure Configuration
references:
- https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown
shortlink: https://sg.run/5WvGK
semgrep.dev:
rule:
r_id: 291647
rv_id: 1423386
rule_id: zdUArOL
version_id: DkTwEGl
url: https://semgrep.dev/playground/r/DkTwEGl/package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown
origin: community
- id: package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age
pattern-either:
- patterns:
- pattern-regex: (?:(?:^---\n)(?:[^\n]*\n)|^)(?P<TARGET>(?:(?!\n---)[\s\S])*\S(?:(?!\n---)[\s\S])*)
- pattern-not-regex: min-release-age
- focus-metavariable: $TARGET
- patterns:
- pattern-regex: min-release-age\s*=\s*\d+
- pattern-regex: =\s*(?P<AGE>\d+)
- metavariable-comparison:
metavariable: $AGE
comparison: int($AGE) < 7
- focus-metavariable: $AGE
- patterns:
- pattern-regex: (?m)min-release-age[ \t]*=[ \t]*(?P<VAL>[^\s\d][^\n]*)
- focus-metavariable: $VAL
- patterns:
- pattern-regex: (?m)min-release-age\s*=\s*$
message: 'This .npmrc does not set a minimum release age or sets it too low. Newly
published packages can be malicious or unstable. Add `min-release-age = 7` to
wait 7 days before resolving newly published package versions. Added in: v11.10
Reference: https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/'
languages:
- generic
severity: MEDIUM
paths:
include:
- '**/.npmrc'
metadata:
category: security
technology:
- npm
- javascript
cwe:
- 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere'
owasp:
- A08:2021 - Software and Data Integrity Failures
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- audit
vulnerability_class:
- Insecure Configuration
references:
- https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/
- https://github.com/npm/cli/pull/8965
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age
shortlink: https://sg.run/GRo1z
semgrep.dev:
rule:
r_id: 291648
rv_id: 1423387
rule_id: pKU6A82
version_id: WrT7LdL
url: https://semgrep.dev/playground/r/WrT7LdL/package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age
origin: community
- id: package_managers.pnpm.pnpm-block-exotic-sub-dependencies.pnpm-block-exotic-sub-dependencies
message: 'Missing or incorrect blockExoticSubdeps. Set `blockExoticSubdeps: true`
to transitive dependencies from being installed from untrusted sources. Added
in: v10.26.0 Reference: https://pnpm.io/settings#blockexoticsubdeps'
languages:
- yaml
severity: MEDIUM
paths:
include:
- '**/pnpm-workspace.yaml'
pattern-either:
- patterns:
- pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^blockExoticSubdeps\s*:)(?!^---$)[\s\S])*?(?P<TARGET>^(?:packages|catalog)\s*:)(?:(?!^blockExoticSubdeps\s*:)(?!^---$)[\s\S])*?(?=^---$|\z)
- focus-metavariable: $TARGET
- patterns:
- pattern: |
blockExoticSubdeps: $VAL
- metavariable-regex:
metavariable: $VAL
regex: ^(?!true$).+
- focus-metavariable: $VAL
- patterns:
- pattern-regex: (?m)^\s*blockExoticSubdeps\s*:\s*$
metadata:
category: security
technology:
- pnpm
cwe:
- 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere'
owasp:
- A08:2021 - Software and Data Integrity Failures
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- audit
vulnerability_class:
- Insecure Configuration
references:
- https://pnpm.io/settings#blockexoticsubdeps
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/package_managers.pnpm.pnpm-block-exotic-sub-dependencies.pnpm-block-exotic-sub-dependencies
shortlink: https://sg.run/RrWRv
semgrep.dev:
rule:
r_id: 291649
rv_id: 1423388
rule_id: 2ZUQEZ5
version_id: 0bTGnwj
url: https://semgrep.dev/playground/r/0bTGnwj/package_managers.pnpm.pnpm-block-exotic-sub-dependencies.pnpm-block-exotic-sub-dependencies
origin: community
- id: package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age
message: 'This pnpm workspace configuration does not set a minimum release age.
Newly published packages can be malicious or unstable. Add `minimumReleaseAge:
10080` (minutes) to wait at least seven days before installing newly published
package versions. Added in: v10.16.0 Reference: https://pnpm.io/settings#minimumreleaseage'
languages:
- yaml
severity: MEDIUM
paths:
include:
- '**/pnpm-workspace.yaml'
pattern-either:
- patterns:
- pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^minimumReleaseAge\s*:)(?!^---$)[\s\S])*?(?P<TARGET>^(?:packages|catalog)\s*:)(?:(?!^minimumReleaseAge\s*:)(?!^---$)[\s\S])*?(?=^---$|\z)
- focus-metavariable: $TARGET
- patterns:
- pattern-regex: ^\s*minimumReleaseAge\s*:\s*(?P<AGE>\d+)
- metavariable-comparison:
metavariable: $AGE
comparison: int($AGE) < 10080
- focus-metavariable: $AGE
- patterns:
- pattern: |
minimumReleaseAge: $AGE
- metavariable-regex:
metavariable: $AGE
regex: ^\D
- focus-metavariable: $AGE
- patterns:
- pattern-regex: (?m)^\s*minimumReleaseAge\s*:\s*$
metadata:
category: security
technology:
- pnpm
cwe:
- 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere'
owasp:
- A08:2021 - Software and Data Integrity Failures
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- audit
vulnerability_class:
- Insecure Configuration
references:
- https://pnpm.io/settings#minimumreleaseage
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age
shortlink: https://sg.run/Aj0o0
semgrep.dev:
rule:
r_id: 291650
rv_id: 1423389
rule_id: X5Uwn1n
version_id: K3TgxrW
url: https://semgrep.dev/playground/r/K3TgxrW/package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age
origin: community
- id: package_managers.pnpm.pnpm-trust-policy.pnpm-trust-policy
message: 'Missing or incorrect trustPolicy. Set `trustPolicy: no-downgrade` to prevent
malicious package updates from downgrading security settings. Added in: v10.21.0
Reference: https://pnpm.io/settings#trustpolicy'
languages:
- yaml
severity: MEDIUM
paths:
include:
- '**/pnpm-workspace.yaml'
pattern-either:
- patterns:
- pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^trustPolicy\s*:)(?!^---$)[\s\S])*?(?P<TARGET>^(?:packages|catalog)\s*:)(?:(?!^trustPolicy\s*:)(?!^---$)[\s\S])*?(?=^---$|\z)
- focus-metavariable: $TARGET
- patterns:
- pattern: |
trustPolicy: $VAL
- metavariable-regex:
metavariable: $VAL
regex: ^(?!no-downgrade$).+
- focus-metavariable: $VAL
- patterns:
- pattern-regex: (?m)^\s*trustPolicy\s*:\s*$
metadata:
category: security
technology:
- pnpm
cwe:
- 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere'
owasp:
- A08:2021 - Software and Data Integrity Failures
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- audit
vulnerability_class:
- Insecure Configuration
references:
- https://pnpm.io/settings#minimumreleaseage
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/package_managers.pnpm.pnpm-trust-policy.pnpm-trust-policy
shortlink: https://sg.run/B2Kz7
semgrep.dev:
rule:
r_id: 291651
rv_id: 1423390
rule_id: j2U6J8N
version_id: qkTvDQn
url: https://semgrep.dev/playground/r/qkTvDQn/package_managers.pnpm.pnpm-trust-policy.pnpm-trust-policy
origin: community
- id: package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age
pattern-either:
- patterns:
- pattern-inside: |
"packageRules": [
...
]
- pattern-either:
- pattern: |
{ ..., "matchPackageNames": [...], ... }
- pattern: |
{ ..., "matchPackagePatterns": [...], ... }
- pattern: |
{ ..., "matchDepTypes": [...], ... }
- pattern-not: |
{
...,
"minimumReleaseAge": $AGE,
...
}
- pattern-not: |
{
...,
"minimumReleaseAge": false,
...
}
- patterns:
- pattern-inside: |
"packageRules": [
...
]
- pattern-regex: '"minimumReleaseAge":\s*"(?P<AGE>\d+) days?"'
- metavariable-comparison:
metavariable: $AGE
comparison: int($AGE) < 7
- focus-metavariable: $AGE
- patterns:
- pattern-inside: |
"packageRules": [
...
]
- pattern: |
"minimumReleaseAge": "$AGE"
- metavariable-regex:
metavariable: $AGE
regex: ^(?!\d+ days?$)
- focus-metavariable: $AGE
message: 'This Renovate configuration does not set a minimum release age. Newly
published packages can be malicious or unstable. Add `"minimumReleaseAge": "7
days"` within a `packageRules` entry to wait 7 days before proposing updates to
newly published package versions. Set `"minimumReleaseAge": false` to set an exception
for minimal release age for the package rule. Added in: v42'
languages:
- json
severity: MEDIUM
paths:
include:
- '**/renovate.json'
- '**/renovate.json5'
- '**/.renovaterc'
- '**/.renovaterc.json'
- '**/.renovaterc.json5'
metadata:
category: security
technology:
- renovate
cwe:
- 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere'
owasp:
- A08:2021 - Software and Data Integrity Failures
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- audit
vulnerability_class:
- Insecure Configuration
references:
- https://docs.renovatebot.com/configuration-options/#minimumreleaseage
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age
shortlink: https://sg.run/D8l2q
semgrep.dev:
rule:
r_id: 291652
rv_id: 1443454
rule_id: 10UbQrX
version_id: jQT1KAX
url: https://semgrep.dev/playground/r/jQT1KAX/package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age
origin: community
- id: package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown
pattern-either:
- patterns:
- pattern-regex: (?ms)\[tool\.uv\](?P<TARGET>[^\[]*?)(?=\[|\z)
- metavariable-regex:
metavariable: $TARGET
regex: ^(?![\s\S]*exclude-newer)
- focus-metavariable: $TARGET
- patterns:
- pattern-regex: exclude-newer\s*=\s*"(?P<DAYS>\d+) days?"
- metavariable-comparison:
metavariable: $DAYS
comparison: int($DAYS) < 7
- focus-metavariable: $DAYS
- patterns:
- pattern-regex: exclude-newer\s*=\s*"(?P<VAL>[^"]+)"
- metavariable-regex:
metavariable: $VAL
regex: ^(?!\d+ days?$)(?!\d{4}-\d{2}-\d{2}$)(?!\d{4}-\d{2}-\d{2}T)
- focus-metavariable: $VAL
message: 'This pyproject.toml configures uv but does not set a dependency cooldown.
Newly published packages can be malicious or unstable. Add `exclude-newer = "7
days"` under `[tool.uv]` to wait 7 days before resolving newly published package
versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns'
languages:
- generic
severity: MEDIUM
paths:
include:
- '**/pyproject.toml'
- '**/uv.toml'
metadata:
category: security
technology:
- uv
- python
cwe:
- 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere'
owasp:
- A08:2021 - Software and Data Integrity Failures
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- audit
vulnerability_class:
- Insecure Configuration
references:
- https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown
shortlink: https://sg.run/WeY0Z
semgrep.dev:
rule:
r_id: 291653
rv_id: 1423392
rule_id: 9AUo6vE
version_id: YDTwLle
url: https://semgrep.dev/playground/r/YDTwLle/package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown
origin: community
- id: package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate
pattern-either:
- patterns:
- pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^npmMinimalAgeGate\s*:)(?!^---$)[\s\S])*?(?P<TARGET>^(?:nodeLinker|yarnPath|enableGlobalCache|npmScopes|npmRegistryServer)\s*:)(?:(?!^npmMinimalAgeGate\s*:)(?!^---$)[\s\S])*?(?=^---$|\z)
- focus-metavariable: $TARGET
- patterns:
- pattern-regex: (?m)npmMinimalAgeGate\s*:\s*['"]?(?P<DAYS>\d+)d['"]?
- metavariable-comparison:
metavariable: $DAYS
comparison: int($DAYS) < 7
- focus-metavariable: $DAYS
- patterns:
- pattern-regex: (?m)npmMinimalAgeGate[ \t]*:[ \t]*(?P<VAL>\S+)
- metavariable-regex:
metavariable: $VAL
regex: ^(?!['"]?\d+d['"]?$)
- focus-metavariable: $VAL
- patterns:
- pattern-regex: (?m)^npmMinimalAgeGate\s*:\s*$
message: 'This .yarnrc.yml does not set a minimal age gate or sets it too low. Newly
published packages can be malicious or unstable. Add `npmMinimalAgeGate: "7d"`
to wait 7 days before resolving newly published package versions. Added in: 4.10
Reference: https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate'
languages:
- yaml
severity: MEDIUM
paths:
include:
- '**/.yarnrc.yml'
metadata:
category: security
technology:
- yarn
- javascript
cwe:
- 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere'
owasp:
- A08:2021 - Software and Data Integrity Failures
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- audit
vulnerability_class:
- Insecure Configuration
references:
- https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate
shortlink: https://sg.run/0gvNq
semgrep.dev:
rule:
r_id: 291654
rv_id: 1423393
rule_id: yyUBeEz
version_id: JdTnXlj
url: https://semgrep.dev/playground/r/JdTnXlj/package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate
origin: community
- id: yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell
languages:
- yaml
message: "A `run:` step pipes the output of `curl` or `wget` directly into a shell
interpreter. This is the \"curl | bash\" install pattern \u2014 if the remote
server is compromised or the URL is hijacked, an attacker can execute arbitrary
code in your CI runner. Consider downloading the file first, verifying its checksum
or signature, and then executing it."
metadata:
category: security
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A03:2021 - Injection
- A03:2025 - Injection
references:
- https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
- https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/
technology:
- github-actions
- bash
- curl
cwe2021-top25: true
cwe2022-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell
shortlink: https://sg.run/GR8K1
semgrep.dev:
rule:
r_id: 309392
rv_id: 1443456
rule_id: x8UAgrE
version_id: 9lT3zYb
url: https://semgrep.dev/playground/r/9lT3zYb/yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell
origin: community
patterns:
- pattern-inside: 'steps: [...]'
- pattern-inside: |
- run: ...
...
- pattern: 'run: $SHELL'
- metavariable-pattern:
language: bash
metavariable: $SHELL
patterns:
- pattern-either:
- pattern: curl ... | $CMD ...
- pattern: wget ... | $CMD ...
- metavariable-regex:
metavariable: $CMD
regex: ^(bash|sh|python3?|ruby|perl)$
severity: ERROR
- id: rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid
message: Dangerously accepting invalid TLS information
pattern-either:
- pattern: reqwest::Client::builder(). ... .danger_accept_invalid_hostnames(true)
- pattern: reqwest::Client::builder(). ... .danger_accept_invalid_certs(true)
metadata:
references:
- https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_hostnames
- https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_certs
technology:
- reqwest
category: security
cwe: 'CWE-295: Improper Certificate Validation'
confidence: HIGH
likelihood: LOW
impact: MEDIUM
subcategory: vuln
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid
shortlink: https://sg.run/DqrG
semgrep.dev:
rule:
r_id: 40108
rv_id: 946551
rule_id: qNUKDg
version_id: 7ZTrQLJ
url: https://semgrep.dev/playground/r/7ZTrQLJ/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid
origin: community
languages:
- rust
severity: WARNING
- id: rust.lang.security.rustls-dangerous.rustls-dangerous
message: Dangerous client config used, ensure SSL verification
pattern-either:
- pattern: rustls::client::DangerousClientConfig
- pattern: $CLIENT.dangerous().set_certificate_verifier(...)
- pattern: |
let $CLIENT = rustls::client::ClientConfig::dangerous(...);
...
$CLIENT.set_certificate_verifier(...);
metadata:
references:
- https://docs.rs/rustls/latest/rustls/client/struct.DangerousClientConfig.html
- https://docs.rs/rustls/latest/rustls/client/struct.ClientConfig.html#method.dangerous
technology:
- rustls
category: security
cwe: 'CWE-295: Improper Certificate Validation'
confidence: HIGH
likelihood: LOW
impact: MEDIUM
subcategory: vuln
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/rust.lang.security.rustls-dangerous.rustls-dangerous
shortlink: https://sg.run/01Rw
semgrep.dev:
rule:
r_id: 40110
rv_id: 946553
rule_id: YGU8LK
version_id: 8KTKjdO
url: https://semgrep.dev/playground/r/8KTKjdO/rust.lang.security.rustls-dangerous.rustls-dangerous
origin: community
languages:
- rust
severity: WARNING
- id: rust.lang.security.ssl-verify-none.ssl-verify-none
message: SSL verification disabled, this allows for MitM attacks
pattern: $BUILDER.set_verify(openssl::ssl::SSL_VERIFY_NONE)
metadata:
references:
- https://docs.rs/openssl/latest/openssl/ssl/struct.SslContextBuilder.html#method.set_verify
technology:
- openssl
category: security
cwe: 'CWE-295: Improper Certificate Validation'
confidence: HIGH
likelihood: LOW
impact: MEDIUM
subcategory: vuln
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/rust.lang.security.ssl-verify-none.ssl-verify-none
shortlink: https://sg.run/K2Pn
semgrep.dev:
rule:
r_id: 40111
rv_id: 946554
rule_id: 6JU0Bl
version_id: gETe1bo
url: https://semgrep.dev/playground/r/gETe1bo/rust.lang.security.ssl-verify-none.ssl-verify-none
origin: community
languages:
- rust
severity: WARNING
Reference in New Issue View Git Blame Copy Permalink