JulieChv/ARC
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
41eb36a489e0417cacb559d0e2e51e2d4fd9833d
ARC/backend/app/sandbox/rules/default.yaml

70780 lines
2.3 MiB
Raw Blame History

rules:
- id: c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn
pattern: gets(...)
message: Avoid 'gets()'. This function does not consider buffer boundaries and can
lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead.
metadata:
cwe:
- 'CWE-676: Use of Potentially Dangerous Function'
references:
- https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s
category: security
technology:
- c
confidence: MEDIUM
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Dangerous Method or Function
source: https://semgrep.dev/r/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn
shortlink: https://sg.run/dKqX
semgrep.dev:
rule:
r_id: 8834
rv_id: 945170
rule_id: GdU7OE
version_id: YDTvRlQ
url: https://semgrep.dev/playground/r/YDTvRlQ/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn
origin: community
languages:
- c
severity: ERROR
- id: c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn
pattern: scanf(...)
message: Avoid using 'scanf()'. This function, when used improperly, does not consider
buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead for
reading input.
metadata:
cwe:
- 'CWE-676: Use of Potentially Dangerous Function'
references:
- http://sekrit.de/webdocs/c/beginners-guide-away-from-scanf.html
category: security
technology:
- c
confidence: LOW
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Dangerous Method or Function
source: https://semgrep.dev/r/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn
shortlink: https://sg.run/nd1g
semgrep.dev:
rule:
r_id: 8836
rv_id: 945173
rule_id: AbUzPd
version_id: zyTlkWW
url: https://semgrep.dev/playground/r/zyTlkWW/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn
origin: community
languages:
- c
severity: WARNING
- id: c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn
pattern: strtok(...)
message: Avoid using 'strtok()'. This function directly modifies the first argument
buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead.
metadata:
cwe:
- 'CWE-676: Use of Potentially Dangerous Function'
references:
- https://wiki.sei.cmu.edu/confluence/display/c/STR06-C.+Do+not+assume+that+strtok%28%29+leaves+the+parse+string+unchanged
- https://man7.org/linux/man-pages/man3/strtok.3.html#BUGS
- https://stackoverflow.com/a/40335556
category: security
technology:
- c
confidence: LOW
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Dangerous Method or Function
source: https://semgrep.dev/r/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn
shortlink: https://sg.run/LwqG
semgrep.dev:
rule:
r_id: 8839
rv_id: 1028278
rule_id: WAUo5v
version_id: qkTx1oq
url: https://semgrep.dev/playground/r/qkTx1oq/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn
origin: community
languages:
- c
severity: WARNING
- id: c.lang.security.random-fd-exhaustion.random-fd-exhaustion
pattern-either:
- patterns:
- pattern: |
$FD = open("/dev/urandom", ...);
...
read($FD, ...);
- pattern-not: |
$FD = open("/dev/urandom", ...);
...
$BYTES_READ = read($FD, ...);
- patterns:
- pattern: |
$FD = open("/dev/random", ...);
...
read($FD, ...);
- pattern-not: |
$FD = open("/dev/random", ...);
...
$BYTES_READ = read($FD, ...);
message: Call to 'read()' without error checking is susceptible to file descriptor
exhaustion. Consider using the 'getrandom()' function.
metadata:
cwe:
- 'CWE-774: Allocation of File Descriptors or Handles Without Limits or Throttling'
references:
- https://lwn.net/Articles/606141/
category: security
technology:
- c
confidence: MEDIUM
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Denial-of-Service (DoS)
source: https://semgrep.dev/r/c.lang.security.random-fd-exhaustion.random-fd-exhaustion
shortlink: https://sg.run/8yNj
semgrep.dev:
rule:
r_id: 8840
rv_id: 945177
rule_id: 0oU5k4
version_id: jQTzvry
url: https://semgrep.dev/playground/r/jQTzvry/c.lang.security.random-fd-exhaustion.random-fd-exhaustion
origin: community
languages:
- c
severity: WARNING
- id: generic.nginx.security.alias-path-traversal.alias-path-traversal
patterns:
- pattern: |
location $...LOCATION {
...
alias .../;
...
}
- metavariable-pattern:
metavariable: $...LOCATION
pattern-regex: ^.*[^/]$
paths:
include:
- '*.conf'
- '*.vhost'
- '**/sites-available/*'
- '**/sites-enabled/*'
fix-regex:
regex: location\s+([A-Za-z0-9/-_\.]+)
replacement: location \1/
languages:
- generic
severity: WARNING
message: The alias in this location block is subject to a path traversal because
the location path does not end in a path separator (e.g., '/'). To fix, add a
path separator to the end of the path.
metadata:
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
source-rule-url: https://github.com/yandex/gixy/blob/master/docs/en/plugins/aliastraversal.md
category: security
technology:
- nginx
confidence: LOW
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
- https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/
- https://www.youtube.com/watch?v=CIhHpkybYsY
- https://github.com/orangetw/My-Presentation-Slides/blob/main/data/2018-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out.pdf
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/generic.nginx.security.alias-path-traversal.alias-path-traversal
shortlink: https://sg.run/ZvNL
semgrep.dev:
rule:
r_id: 9035
rv_id: 1262670
rule_id: 5rUOjq
version_id: NdTzyBg
url: https://semgrep.dev/playground/r/NdTzyBg/generic.nginx.security.alias-path-traversal.alias-path-traversal
origin: community
- id: generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host
paths:
include:
- '*.conf'
- '*.vhost'
- '**/sites-available/*'
- '**/sites-enabled/*'
languages:
- generic
severity: WARNING
message: The host for this proxy URL is dynamically determined. This can be dangerous
if the host can be injected by an attacker because it may forcibly alter destination
of the proxy. Consider hardcoding acceptable destinations and retrieving them
with 'map' or something similar.
metadata:
source-rule-url: https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md
references:
- https://nginx.org/en/docs/http/ngx_http_map_module.html
category: security
technology:
- nginx
confidence: MEDIUM
cwe:
- 'CWE-441: Unintended Proxy or Intermediary (''Confused Deputy'')'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host
shortlink: https://sg.run/ndpb
semgrep.dev:
rule:
r_id: 9036
rv_id: 1262671
rule_id: GdU7yl
version_id: kbTzG2j
url: https://semgrep.dev/playground/r/kbTzG2j/generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host
origin: community
pattern-either:
- pattern: proxy_pass $SCHEME://$$HOST ...;
- pattern: proxy_pass $$SCHEME://$$HOST ...;
- id: generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme
paths:
include:
- '*.conf'
- '*.vhost'
- '**/sites-available/*'
- '**/sites-enabled/*'
languages:
- generic
severity: WARNING
message: The protocol scheme for this proxy is dynamically determined. This can
be dangerous if the scheme can be injected by an attacker because it may forcibly
alter the connection scheme. Consider hardcoding a scheme for this proxy.
metadata:
cwe:
- 'CWE-16: CWE CATEGORY: Configuration'
references:
- https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md
category: security
technology:
- nginx
confidence: MEDIUM
owasp:
- A06:2017 - Security Misconfiguration
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme
shortlink: https://sg.run/EkAo
semgrep.dev:
rule:
r_id: 9037
rv_id: 1262672
rule_id: ReUg7n
version_id: w8TRoAJ
url: https://semgrep.dev/playground/r/w8TRoAJ/generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme
origin: community
pattern: proxy_pass $$SCHEME:// ...;
- id: generic.nginx.security.header-injection.header-injection
pattern: |
location ... <$VARIABLE> ... {
...
add_header ... $$VARIABLE
...
}
paths:
include:
- '*.conf'
- '*.vhost'
- '**/sites-available/*'
- '**/sites-enabled/*'
languages:
- generic
severity: ERROR
message: 'The $$VARIABLE path parameter is added as a header in the response. This
could allow an attacker to inject a newline and add a new header into the response.
This is called HTTP response splitting. To fix, do not allow whitespace in the
path parameter: ''[^\s]+''.'
metadata:
cwe:
- 'CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (''HTTP
Request/Response Splitting'')'
references:
- https://github.com/yandex/gixy/blob/master/docs/en/plugins/httpsplitting.md
- https://owasp.org/www-community/attacks/HTTP_Response_Splitting
category: security
technology:
- nginx
confidence: MEDIUM
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/generic.nginx.security.header-injection.header-injection
shortlink: https://sg.run/7oj4
semgrep.dev:
rule:
r_id: 9038
rv_id: 1262673
rule_id: AbUz8p
version_id: xyTjzNW
url: https://semgrep.dev/playground/r/xyTjzNW/generic.nginx.security.header-injection.header-injection
origin: community
- id: generic.nginx.security.header-redefinition.header-redefinition
patterns:
- pattern-inside: |
server {
...
add_header ...;
...
...
}
- pattern-inside: |
location ... {
...
...
}
- pattern: add_header ...;
paths:
include:
- '*.conf'
- '*.vhost'
- '**/sites-available/*'
- '**/sites-enabled/*'
languages:
- generic
severity: WARNING
message: The 'add_header' directive is called in a 'location' block after headers
have been set at the server block. Calling 'add_header' in the location block
will actually overwrite the headers defined in the server block, no matter which
headers are set. To fix this, explicitly set all headers or set all headers in
the server block.
metadata:
cwe:
- 'CWE-16: CWE CATEGORY: Configuration'
references:
- https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md
category: security
technology:
- nginx
confidence: LOW
owasp:
- A06:2017 - Security Misconfiguration
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/generic.nginx.security.header-redefinition.header-redefinition
shortlink: https://sg.run/Lwl7
semgrep.dev:
rule:
r_id: 9039
rv_id: 1262674
rule_id: BYUN58
version_id: O9TpxJD
url: https://semgrep.dev/playground/r/O9TpxJD/generic.nginx.security.header-redefinition.header-redefinition
origin: community
- id: generic.nginx.security.insecure-redirect.insecure-redirect
patterns:
- pattern-either:
- pattern: rewrite ... redirect
- pattern: rewrite ... permanent
- pattern-not-inside: rewrite ... https ... $host ... redirect
- pattern-not-inside: rewrite ... https ... $host ... permanent
- pattern-not-regex: (?i)https:\/\/
paths:
include:
- '*.conf'
- '*.vhost'
- '**/sites-available/*'
- '**/sites-enabled/*'
message: Detected an insecure redirect in this nginx configuration. If no scheme
is specified, nginx will forward the request with the incoming scheme. This could
result in unencrypted communications. To fix this, include the 'https' scheme.
languages:
- generic
severity: WARNING
metadata:
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
category: security
technology:
- nginx
confidence: LOW
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/generic.nginx.security.insecure-redirect.insecure-redirect
shortlink: https://sg.run/8y14
semgrep.dev:
rule:
r_id: 9040
rv_id: 1262675
rule_id: DbUpJe
version_id: e1TyjDz
url: https://semgrep.dev/playground/r/e1TyjDz/generic.nginx.security.insecure-redirect.insecure-redirect
origin: community
- id: generic.nginx.security.insecure-ssl-version.insecure-ssl-version
patterns:
- pattern-not: ssl_protocols TLSv1.2 TLSv1.3;
- pattern-not: ssl_protocols TLSv1.3 TLSv1.2;
- pattern-not: ssl_protocols TLSv1.2;
- pattern-not: ssl_protocols TLSv1.3;
- pattern: ssl_protocols ...;
paths:
include:
- '*.conf'
- '*.vhost'
- '**/sites-available/*'
- '**/sites-enabled/*'
languages:
- generic
severity: WARNING
message: Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2
and TLS1.3; older versions are known to be broken and are susceptible to attacks.
Prefer use of TLSv1.2 or later.
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
references:
- https://www.acunetix.com/blog/web-security-zone/hardening-nginx/
- https://www.acunetix.com/blog/articles/tls-ssl-cipher-hardening/
category: security
technology:
- nginx
confidence: HIGH
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- audit
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/generic.nginx.security.insecure-ssl-version.insecure-ssl-version
shortlink: https://sg.run/gLKy
semgrep.dev:
rule:
r_id: 9041
rv_id: 1262676
rule_id: WAUo9k
version_id: vdT06O4
url: https://semgrep.dev/playground/r/vdT06O4/generic.nginx.security.insecure-ssl-version.insecure-ssl-version
origin: community
- id: generic.nginx.security.missing-internal.missing-internal
options:
generic_ellipsis_max_span: 0
generic_engine: aliengrep
patterns:
- pattern-inside: |
location ... {
....
....
}
- pattern-not-inside: |
location ... {
....
internal;
....
}
- pattern: proxy_pass $...URL;
- metavariable-regex:
metavariable: $...URL
regex: (.*\$.*)
paths:
include:
- '*.conf'
- '*.vhost'
- '**/sites-available/*'
- '**/sites-enabled/*'
languages:
- generic
severity: WARNING
message: This location block contains a 'proxy_pass' directive but does not contain
the 'internal' directive. The 'internal' directive restricts access to this location
to internal requests. Without 'internal', an attacker could use your server for
server-side request forgeries (SSRF). Include the 'internal' directive in this
block to limit exposure.
metadata:
cwe:
- 'CWE-16: CWE CATEGORY: Configuration'
references:
- https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md
- https://nginx.org/en/docs/http/ngx_http_core_module.html#internal
category: security
technology:
- nginx
confidence: LOW
owasp:
- A06:2017 - Security Misconfiguration
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/generic.nginx.security.missing-internal.missing-internal
shortlink: https://sg.run/Q5px
semgrep.dev:
rule:
r_id: 9042
rv_id: 1262677
rule_id: 0oU5BZ
version_id: d6TyxKK
url: https://semgrep.dev/playground/r/d6TyxKK/generic.nginx.security.missing-internal.missing-internal
origin: community
- id: generic.nginx.security.missing-ssl-version.missing-ssl-version
patterns:
- pattern: server { ... listen $PORT ssl; ... }
- pattern-not-inside: server { ... ssl_protocols ... }
paths:
include:
- '*.conf'
- '*.vhost'
- '**/sites-available/*'
- '**/sites-enabled/*'
languages:
- generic
severity: WARNING
message: This server configuration is missing the 'ssl_protocols' directive. By
default, this server will use 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions
older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2
TLSv1.3' to use secure TLS versions.
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
references:
- https://www.acunetix.com/blog/web-security-zone/hardening-nginx/
- https://nginx.org/en/docs/http/configuring_https_servers.html
category: security
technology:
- nginx
confidence: MEDIUM
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/generic.nginx.security.missing-ssl-version.missing-ssl-version
shortlink: https://sg.run/3xzl
semgrep.dev:
rule:
r_id: 9043
rv_id: 1262678
rule_id: KxUbeA
version_id: ZRTKAle
url: https://semgrep.dev/playground/r/ZRTKAle/generic.nginx.security.missing-ssl-version.missing-ssl-version
origin: community
- id: generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token
pattern-regex: amzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}
languages:
- regex
message: Amazon MWS Auth Token detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
category: security
technology:
- secrets
- aws
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token
shortlink: https://sg.run/PJzE
semgrep.dev:
rule:
r_id: 9045
rv_id: 1262856
rule_id: lBU9bw
version_id: K3TKkGj
url: https://semgrep.dev/playground/r/K3TKkGj/generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token
origin: community
- id: generic.secrets.security.detected-artifactory-password.detected-artifactory-password
patterns:
- pattern-regex: (?<ITEM>\bAP[\dABCDEF][a-zA-Z0-9]{8,})
- pattern-regex: .*(?i)arti[-_]?factory.*
- pattern-not-regex: .*(?i)sha(1|2|3|118|256|512).*
- pattern-not-regex: (?i)-----\s*?BEGIN[ A-Z0-9_-]*? KEY( BLOCK)?-----[\s\S]*?-----\s*?END[
A-Z0-9_-]*?\s*?-----
- metavariable-analysis:
analyzer: entropy
metavariable: $ITEM
- pattern-not-regex: (\w|\.|\*)\1{4}
languages:
- regex
paths:
exclude:
- '*.svg'
- '*go.sum'
- '*package.json'
- '*cargo.lock'
- '*package-lock.json'
- '*bundle.js'
- '*pnpm-lock*'
- '*Podfile.lock'
- '**/*/openssl/*.h'
- '*.xcscmblueprint'
message: Artifactory token detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/artifactory.py
category: security
technology:
- secrets
- artifactory
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-artifactory-password.detected-artifactory-password
shortlink: https://sg.run/J9KZ
semgrep.dev:
rule:
r_id: 9046
rv_id: 1262857
rule_id: YGUR5K
version_id: qkTR7BB
url: https://semgrep.dev/playground/r/qkTR7BB/generic.secrets.security.detected-artifactory-password.detected-artifactory-password
origin: community
- id: generic.secrets.security.detected-artifactory-token.detected-artifactory-token
patterns:
- pattern-regex: |
\bAKC[a-zA-Z0-9]{10,}
- pattern-not-regex: |
sha(128|256|512).*
- pattern-not-regex: (?s)---BEGIN.*---\Z
languages:
- regex
paths:
exclude:
- '*.svg'
- '*go.sum'
- '*package.json'
- '*package-lock.json'
- '*bundle.js'
- '*pnpm-lock*'
- '*Podfile.lock'
- '**/*/openssl/*.h'
- '*.xcscmblueprint'
- '*cargo.lock'
message: Artifactory token detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/artifactory.py
category: security
technology:
- secrets
- artifactory
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-artifactory-token.detected-artifactory-token
shortlink: https://sg.run/5Q2l
semgrep.dev:
rule:
r_id: 9047
rv_id: 1262858
rule_id: 6JUj3l
version_id: l4TJR6J
url: https://semgrep.dev/playground/r/l4TJR6J/generic.secrets.security.detected-artifactory-token.detected-artifactory-token
origin: community
- id: generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value
patterns:
- pattern-regex: \b(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}\b
- pattern-not-regex: (?i)example|sample|test|fake
languages:
- regex
message: AWS Access Key ID Value detected. This is a sensitive credential and should
not be hardcoded here. Instead, read this value from an environment variable or
keep it in a separate, private file.
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
category: security
technology:
- secrets
- aws
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value
shortlink: https://sg.run/GeD1
semgrep.dev:
rule:
r_id: 9048
rv_id: 1262859
rule_id: oqUevO
version_id: YDTZenE
url: https://semgrep.dev/playground/r/YDTZenE/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value
origin: community
- id: generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key
pattern-regex: da2-[a-z0-9]{26}
languages:
- regex
message: AWS AppSync GraphQL Key detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
category: security
technology:
- secrets
- appsync
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key
shortlink: https://sg.run/AvJ6
semgrep.dev:
rule:
r_id: 9050
rv_id: 1262861
rule_id: pKUOoZ
version_id: o5TbD9o
url: https://semgrep.dev/playground/r/o5TbD9o/generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key
origin: community
- id: generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key
patterns:
- pattern-regex: (("|'|`)?((?i)aws)_?\w*((?i)secret)_?\w*("|'|`)?\s{0,50}(:|=>|=)\s{0,50}("|'|`)?[A-Za-z0-9/+=]{40}("|'|`)?)
- pattern-not-regex: (?i)example|sample|test|fake|xxxxxx
languages:
- regex
message: AWS Secret Access Key detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
category: security
technology:
- secrets
- aws
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key
shortlink: https://sg.run/Bk39
semgrep.dev:
rule:
r_id: 9051
rv_id: 1262862
rule_id: 2ZUbe8
version_id: zyTb2Dr
url: https://semgrep.dev/playground/r/zyTb2Dr/generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key
origin: community
- id: generic.secrets.security.detected-aws-session-token.detected-aws-session-token
patterns:
- pattern-regex: ((?i)AWS_SESSION_TOKEN)\s*(:|=>|=)\s*(?P<TOKEN>[A-Za-z0-9/+=]{16,})
- pattern-not-regex: (?i)example|sample|test|fake
- metavariable-analysis:
analyzer: entropy
metavariable: $TOKEN
languages:
- regex
message: AWS Session Token detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
category: security
technology:
- secrets
- aws
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-aws-session-token.detected-aws-session-token
shortlink: https://sg.run/DoRW
semgrep.dev:
rule:
r_id: 9052
rv_id: 1262863
rule_id: X5U8Er
version_id: pZT03Lx
url: https://semgrep.dev/playground/r/pZT03Lx/generic.secrets.security.detected-aws-session-token.detected-aws-session-token
origin: community
- id: generic.secrets.security.detected-codeclimate.detected-codeclimate
pattern-regex: (?i)codeclima.{0,50}["|'|`]?[0-9a-f]{64}["|'|`]?
languages:
- regex
message: CodeClimate detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
category: security
technology:
- secrets
- codeclimate
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-codeclimate.detected-codeclimate
shortlink: https://sg.run/W8yz
semgrep.dev:
rule:
r_id: 9053
rv_id: 1262865
rule_id: j2UvW7
version_id: X0Tzy2o
url: https://semgrep.dev/playground/r/X0Tzy2o/generic.secrets.security.detected-codeclimate.detected-codeclimate
origin: community
- id: generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token
pattern-either:
- pattern-regex: EAACEdEose0cBA[0-9A-Za-z]+
- pattern-regex: EAAAACZAVC6ygB[0-9A-Za-z]+
- pattern-regex: EAAAAZAw4[0-9A-Za-z]+
languages:
- regex
message: Facebook Access Token detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
category: security
technology:
- secrets
- facebook
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token
shortlink: https://sg.run/0QYJ
semgrep.dev:
rule:
r_id: 9054
rv_id: 1262867
rule_id: 10UKBL
version_id: 1QTyp7J
url: https://semgrep.dev/playground/r/1QTyp7J/generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token
origin: community
- id: generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth
pattern-regex: '[fF][aA][cC][eE][bB][oO][oO][kK].*[tT][oO][kK][eE][nN].*[''|"]?[0-9a-f]{32}[''|"]?'
languages:
- regex
message: Facebook OAuth detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
category: security
technology:
- secrets
- facebook
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth
shortlink: https://sg.run/Klq6
semgrep.dev:
rule:
r_id: 9055
rv_id: 1262868
rule_id: 9AU127
version_id: 9lT4b5N
url: https://semgrep.dev/playground/r/9lT4b5N/generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth
origin: community
- id: generic.secrets.security.detected-generic-api-key.detected-generic-api-key
patterns:
- pattern-regex: '[aA][pP][iI]_?[kK][eE][yY][=_:\s-]+[''|"]?(?<SECRET>[0-9a-zA-Z]{32,45})[''|"]?'
- metavariable-analysis:
analyzer: entropy
metavariable: $SECRET
languages:
- regex
message: Generic API Key detected
severity: ERROR
metadata:
source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
category: security
technology:
- secrets
confidence: LOW
references:
- https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-generic-api-key.detected-generic-api-key
shortlink: https://sg.run/qxj8
semgrep.dev:
rule:
r_id: 9056
rv_id: 1262869
rule_id: yyUn8p
version_id: yeTxpZ9
url: https://semgrep.dev/playground/r/yeTxpZ9/generic.secrets.security.detected-generic-api-key.detected-generic-api-key
origin: community
- id: generic.secrets.security.detected-generic-secret.detected-generic-secret
patterns:
- pattern-regex: '[sS][eE][cC][rR][eE][tT][:= \t]*[''|\"]?(?<SECRET>[0-9a-zA-Z]{32,45})[''|\"]?'
- metavariable-analysis:
analyzer: entropy
metavariable: $SECRET
languages:
- regex
message: Generic Secret detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
category: security
technology:
- secrets
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-generic-secret.detected-generic-secret
shortlink: https://sg.run/l2o5
semgrep.dev:
rule:
r_id: 9057
rv_id: 1262870
rule_id: r6Urqe
version_id: rxTAK4J
url: https://semgrep.dev/playground/r/rxTAK4J/generic.secrets.security.detected-generic-secret.detected-generic-secret
origin: community
- id: generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token
pattern-regex: ya29\.[0-9A-Za-z\-_]+
languages:
- regex
message: Google OAuth Access Token detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
category: security
technology:
- secrets
- google
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token
shortlink: https://sg.run/ox2n
semgrep.dev:
rule:
r_id: 9060
rv_id: 1262875
rule_id: kxUkpo
version_id: xyTjzp6
url: https://semgrep.dev/playground/r/xyTjzp6/generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token
origin: community
- id: generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key
pattern-regex: '[hH][eE][rR][oO][kK][uU].*[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}'
languages:
- regex
message: Heroku API Key detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
category: security
technology:
- secrets
- heroku
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key
shortlink: https://sg.run/pxXR
semgrep.dev:
rule:
r_id: 9062
rv_id: 1262877
rule_id: x8UnOB
version_id: e1Tyj3N
url: https://semgrep.dev/playground/r/e1Tyj3N/generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key
origin: community
- id: generic.secrets.security.detected-hockeyapp.detected-hockeyapp
pattern-regex: (?i)hockey.{0,50}(\\\"|'|`)?[0-9a-f]{32}(\\\"|'|`)?
languages:
- regex
message: HockeyApp detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
category: security
technology:
- secrets
- hockeyapp
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-hockeyapp.detected-hockeyapp
shortlink: https://sg.run/2xoY
semgrep.dev:
rule:
r_id: 9063
rv_id: 1262878
rule_id: OrU3zo
version_id: vdT068z
url: https://semgrep.dev/playground/r/vdT068z/generic.secrets.security.detected-hockeyapp.detected-hockeyapp
origin: community
- id: generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key
pattern-regex: '[0-9a-f]{32}-us[0-9]{1,2}'
languages:
- regex
message: MailChimp API Key detected
severity: ERROR
metadata:
source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
category: security
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
technology:
- secrets
- mailchimp
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key
shortlink: https://sg.run/XBde
semgrep.dev:
rule:
r_id: 9064
rv_id: 1262881
rule_id: eqU8QR
version_id: nWT2LoR
url: https://semgrep.dev/playground/r/nWT2LoR/generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key
origin: community
- id: generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key
pattern-regex: key-[0-9a-zA-Z]{32}
languages:
- regex
message: Mailgun API Key detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
category: security
technology:
- secrets
- mailgun
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key
shortlink: https://sg.run/jRL2
semgrep.dev:
rule:
r_id: 9065
rv_id: 1262882
rule_id: v8UneY
version_id: ExTExAG
url: https://semgrep.dev/playground/r/ExTExAG/generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key
origin: community
- id: generic.secrets.security.detected-outlook-team.detected-outlook-team
pattern-regex: https://outlook\.office\.com/webhook/[0-9a-f-]{36}
languages:
- regex
message: Outlook Team detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
category: security
technology:
- secrets
- outlook
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-outlook-team.detected-outlook-team
shortlink: https://sg.run/1ZwQ
semgrep.dev:
rule:
r_id: 9066
rv_id: 1262884
rule_id: d8UjXq
version_id: LjTkgA1
url: https://semgrep.dev/playground/r/LjTkgA1/generic.secrets.security.detected-outlook-team.detected-outlook-team
origin: community
- id: generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token
pattern-regex: access_token\$production\$[0-9a-z]{16}\$[0-9a-z]{32}
languages:
- regex
message: PayPal Braintree Access Token detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
category: security
technology:
- secrets
- paypal
- braintree
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token
shortlink: https://sg.run/9oBR
semgrep.dev:
rule:
r_id: 9067
rv_id: 1262885
rule_id: ZqU507
version_id: 8KT5ryb
url: https://semgrep.dev/playground/r/8KT5ryb/generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token
origin: community
- id: generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block
pattern-regex: '-----BEGIN PGP PRIVATE KEY BLOCK-----'
languages:
- regex
message: Something that looks like a PGP private key block is detected. This is
a potential hardcoded secret that could be leaked if this code is committed. Instead,
remove this code block from the commit.
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
category: security
technology:
- secrets
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block
shortlink: https://sg.run/ydKd
semgrep.dev:
rule:
r_id: 9068
rv_id: 1262886
rule_id: nJUzXz
version_id: gETB7O4
url: https://semgrep.dev/playground/r/gETB7O4/generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block
origin: community
- id: generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key
pattern-regex: sk_live_[0-9a-z]{32}
languages:
- regex
message: Picatic API Key detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
category: security
technology:
- secrets
- picatic
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key
shortlink: https://sg.run/rdGA
semgrep.dev:
rule:
r_id: 9069
rv_id: 1262887
rule_id: EwU274
version_id: QkTGqwK
url: https://semgrep.dev/playground/r/QkTGqwK/generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key
origin: community
- id: generic.secrets.security.detected-private-key.detected-private-key
patterns:
- pattern-either:
- patterns:
- pattern: '-----BEGIN $TYPE PRIVATE KEY----- $KEY'
- metavariable-regex:
metavariable: $TYPE
regex: (?i)([dr]sa|ec|openssh|encrypted)?
- patterns:
- pattern: |
-----BEGIN PRIVATE KEY-----
$KEY
- metavariable-analysis:
metavariable: $KEY
analyzer: entropy
languages:
- generic
message: Private Key detected. This is a sensitive credential and should not be
hardcoded here. Instead, store this in a separate, private file.
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
category: security
technology:
- secrets
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-private-key.detected-private-key
shortlink: https://sg.run/b7dr
semgrep.dev:
rule:
r_id: 9070
rv_id: 1262888
rule_id: 7KUQ0p
version_id: 3ZT4X4Y
url: https://semgrep.dev/playground/r/3ZT4X4Y/generic.secrets.security.detected-private-key.detected-private-key
origin: community
- id: generic.secrets.security.detected-sauce-token.detected-sauce-token
pattern-regex: (?i)sauce.{0,50}(\\\"|'|`)?[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[0-9a-f]{4}-[0-9a-f]{12}(\\\"|'|`)?
languages:
- regex
message: Sauce Token detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
category: security
technology:
- secrets
- sauce
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-sauce-token.detected-sauce-token
shortlink: https://sg.run/N4k1
semgrep.dev:
rule:
r_id: 9071
rv_id: 1262889
rule_id: L1UyZ5
version_id: 44TEjER
url: https://semgrep.dev/playground/r/44TEjER/generic.secrets.security.detected-sauce-token.detected-sauce-token
origin: community
- id: generic.secrets.security.detected-slack-token.detected-slack-token
pattern-either:
- pattern-regex: (xox[pboa]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32})
- pattern-regex: xox.-[0-9]{12}-[0-9]{12}-[0-9a-zA-Z]{24}
languages:
- regex
message: Slack Token detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
references:
- https://github.com/davidburkitt/python-secret-scanner/blob/335a1f6dab8de59cf39063e57aea39a58951e939/patterns.txt#L58
category: security
technology:
- secrets
- slack
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-slack-token.detected-slack-token
shortlink: https://sg.run/kXdz
semgrep.dev:
rule:
r_id: 9072
rv_id: 1262891
rule_id: 8GUjRA
version_id: JdTzxz3
url: https://semgrep.dev/playground/r/JdTzxz3/generic.secrets.security.detected-slack-token.detected-slack-token
origin: community
- id: generic.secrets.security.detected-slack-webhook.detected-slack-webhook
patterns:
- pattern-regex: https://hooks\.slack\.com/services/T[a-zA-Z0-9_]{8,10}/B[a-zA-Z0-9_]{8,10}/[a-zA-Z0-9_]{24}
- pattern-not: https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX
languages:
- regex
message: Slack Webhook detected
severity: ERROR
metadata:
references:
- https://api.slack.com/messaging/webhooks
source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
category: security
technology:
- secrets
- slack
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-slack-webhook.detected-slack-webhook
shortlink: https://sg.run/weWX
semgrep.dev:
rule:
r_id: 9073
rv_id: 1262892
rule_id: gxU1dy
version_id: 5PTo1oO
url: https://semgrep.dev/playground/r/5PTo1oO/generic.secrets.security.detected-slack-webhook.detected-slack-webhook
origin: community
- id: generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key
pattern-regex: (?i)sonar.{0,50}(\\\"|'|`)?[0-9a-f]{40}(\\\"|'|`)?
languages:
- regex
message: SonarQube Docs API Key detected
severity: ERROR
paths:
exclude:
- '*.svg'
- '*go.sum'
- '*cargo.lock'
- '*package.json'
- '*yarn.lock'
- '*package-lock.json'
- '*bundle.js'
- '*pnpm-lock*'
- '*Podfile.lock'
- '**/*/openssl/*.h'
- '*.xcscmblueprint'
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
category: security
technology:
- secrets
- sonarqube
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key
shortlink: https://sg.run/x10P
semgrep.dev:
rule:
r_id: 9074
rv_id: 1262895
rule_id: QrUzP1
version_id: A8TgdgQ
url: https://semgrep.dev/playground/r/A8TgdgQ/generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key
origin: community
- id: generic.secrets.security.detected-square-access-token.detected-square-access-token
pattern-regex: sq0atp-[0-9A-Za-z\-_]{22}
languages:
- regex
message: Square Access Token detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
category: security
technology:
- secrets
- square
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-square-access-token.detected-square-access-token
shortlink: https://sg.run/OP3b
semgrep.dev:
rule:
r_id: 9075
rv_id: 1262896
rule_id: 3qUPqO
version_id: BjTkZkz
url: https://semgrep.dev/playground/r/BjTkZkz/generic.secrets.security.detected-square-access-token.detected-square-access-token
origin: community
- id: generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret
pattern-regex: sq0csp-[0-9A-Za-z\\\-_]{43}
languages:
- regex
message: Square OAuth Secret detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
references:
- https://github.com/Yelp/detect-secrets/blob/master/tests/plugins/square_oauth_test.py
category: security
technology:
- secrets
- square
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret
shortlink: https://sg.run/eL7E
semgrep.dev:
rule:
r_id: 9076
rv_id: 1262897
rule_id: 4bUk4l
version_id: DkTRbRG
url: https://semgrep.dev/playground/r/DkTRbRG/generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret
origin: community
- id: generic.secrets.security.detected-ssh-password.detected-ssh-password
pattern-regex: sshpass -p\s*['|\\\"][^%]
languages:
- regex
message: SSH Password detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
category: security
technology:
- secrets
- ssh
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-ssh-password.detected-ssh-password
shortlink: https://sg.run/vzDR
semgrep.dev:
rule:
r_id: 9077
rv_id: 1262898
rule_id: PeUZ4d
version_id: WrTqKqY
url: https://semgrep.dev/playground/r/WrTqKqY/generic.secrets.security.detected-ssh-password.detected-ssh-password
origin: community
- id: generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key
pattern-regex: sk_live_[0-9a-zA-Z]{24}
languages:
- regex
message: Stripe API Key detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
category: security
technology:
- secrets
- stripe
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key
shortlink: https://sg.run/dKd5
semgrep.dev:
rule:
r_id: 9078
rv_id: 1262899
rule_id: JDUy0z
version_id: 0bTKzK1
url: https://semgrep.dev/playground/r/0bTKzK1/generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key
origin: community
- id: generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key
pattern-regex: rk_live_[0-9a-zA-Z]{24}
languages:
- regex
message: Stripe Restricted API Key detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
category: security
technology:
- secrets
- stripe
confidence: MEDIUM
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key
shortlink: https://sg.run/ZvdL
semgrep.dev:
rule:
r_id: 9079
rv_id: 1262900
rule_id: 5rUOWq
version_id: K3TKkKj
url: https://semgrep.dev/playground/r/K3TKkKj/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key
origin: community
- id: generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key
patterns:
- pattern-regex: '[0-9]+:AA[0-9A-Za-z\-_]{33}'
- pattern-not-regex: go\.mod.*
- pattern-not-regex: v[\d]+\.[\d]+\.[\d]+.*
languages:
- regex
message: Telegram Bot API Key detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
category: security
technology:
- secrets
- telegram
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key
shortlink: https://sg.run/nd4b
semgrep.dev:
rule:
r_id: 9080
rv_id: 1262901
rule_id: GdU7Nl
version_id: qkTR7RB
url: https://semgrep.dev/playground/r/qkTR7RB/generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key
origin: community
- id: generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key
pattern-regex: SK[0-9a-fA-F]{32}
languages:
- regex
message: Twilio API Key detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
category: security
technology:
- secrets
- twilio
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key
shortlink: https://sg.run/Ek2o
semgrep.dev:
rule:
r_id: 9081
rv_id: 1262902
rule_id: ReUgJn
version_id: l4TJRJJ
url: https://semgrep.dev/playground/r/l4TJRJJ/generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key
origin: community
- id: go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly
patterns:
- pattern-not-inside: |
&sessions.Options{
...,
HttpOnly: true,
...,
}
- pattern: |
&sessions.Options{
...,
}
message: A session cookie was detected without setting the 'HttpOnly' flag. The
'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts
from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by
setting 'HttpOnly' to 'true' in the Options struct.
metadata:
cwe:
- 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag'
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
references:
- https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69
category: security
technology:
- gorilla
confidence: MEDIUM
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cookie Security
source: https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly
shortlink: https://sg.run/4xJZ
semgrep.dev:
rule:
r_id: 9088
rv_id: 1262911
rule_id: qNUj6g
version_id: WrTqKqe
url: https://semgrep.dev/playground/r/WrTqKqe/go.gorilla.security.audit.session-cookie-missing-httponly.session-cookie-missing-httponly
origin: community
fix-regex:
regex: (HttpOnly\s*:\s+)false
replacement: \1true
severity: WARNING
languages:
- go
- id: go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure
patterns:
- pattern-not-inside: |
&sessions.Options{
...,
Secure: true,
...,
}
- pattern: |
&sessions.Options{
...,
}
message: A session cookie was detected without setting the 'Secure' flag. The 'secure'
flag for cookies prevents the client from transmitting the cookie over insecure
channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in
the Options struct.
metadata:
cwe:
- 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute'
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
references:
- https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69
category: security
technology:
- gorilla
confidence: MEDIUM
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cookie Security
source: https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure
shortlink: https://sg.run/PJdE
semgrep.dev:
rule:
r_id: 9089
rv_id: 1262912
rule_id: lBU9kw
version_id: 0bTKzKk
url: https://semgrep.dev/playground/r/0bTKzKk/go.gorilla.security.audit.session-cookie-missing-secure.session-cookie-missing-secure
origin: community
fix-regex:
regex: (Secure\s*:\s+)false
replacement: \1true
severity: WARNING
languages:
- go
- id: go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection
metadata:
cwe:
- 'CWE-300: Channel Accessible by Non-Endpoint'
references:
- https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption
category: security
technology:
- grpc
confidence: HIGH
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection
shortlink: https://sg.run/J9yZ
semgrep.dev:
rule:
r_id: 9090
rv_id: 1262916
rule_id: PeUZ4X
version_id: YDTZeZB
url: https://semgrep.dev/playground/r/YDTZeZB/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection
origin: community
message: 'Found an insecure gRPC connection using ''grpc.WithInsecure()''. This
creates a connection without encryption to a gRPC server. A malicious attacker
could tamper with the gRPC message, which could compromise the machine. Instead,
establish a secure connection with an SSL certificate using the ''grpc.WithTransportCredentials()''
function. You can create a create credentials using a ''tls.Config{}'' struct
with ''credentials.NewTLS()''. The final fix looks like this: ''grpc.WithTransportCredentials(credentials.NewTLS(<config>))''.'
languages:
- go
severity: ERROR
pattern: $GRPC.Dial($ADDR, ..., $GRPC.WithInsecure(...), ...)
fix-regex:
regex: (.*)WithInsecure\(.*?\)
replacement: \1WithTransportCredentials(credentials.NewTLS(<your_tls_config_here>))
- id: go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection
metadata:
cwe:
- 'CWE-300: Channel Accessible by Non-Endpoint'
references:
- https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption
category: security
technology:
- grpc
confidence: HIGH
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection
shortlink: https://sg.run/5Q5l
semgrep.dev:
rule:
r_id: 9091
rv_id: 1262917
rule_id: JDUy0B
version_id: 6xT2923
url: https://semgrep.dev/playground/r/6xT2923/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection
origin: community
message: Found an insecure gRPC server without 'grpc.Creds()' or options with credentials.
This allows for a connection without encryption to this server. A malicious attacker
could tamper with the gRPC message, which could compromise the machine. Include
credentials derived from an SSL certificate in order to create a secure gRPC connection.
You can create credentials using 'credentials.NewServerTLSFromFile("cert.pem",
"cert.key")'.
languages:
- go
severity: ERROR
mode: taint
pattern-sinks:
- requires: OPTIONS and not CREDS
pattern: grpc.NewServer($OPT, ...)
- requires: EMPTY_CONSTRUCTOR
pattern: grpc.NewServer()
pattern-sources:
- label: OPTIONS
pattern: grpc.ServerOption{ ... }
- label: CREDS
pattern: grpc.Creds(...)
- label: EMPTY_CONSTRUCTOR
pattern: grpc.NewServer()
- id: go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm
message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm
assumes the integrity of the token has already been verified. This would allow
a malicious actor to forge a JWT token that will automatically be verified. Do
not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
category: security
technology:
- jwt
confidence: HIGH
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm
shortlink: https://sg.run/Gej1
semgrep.dev:
rule:
r_id: 9092
rv_id: 1262919
rule_id: 5rUOWQ
version_id: zyTb2bz
url: https://semgrep.dev/playground/r/zyTb2bz/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm
origin: community
languages:
- go
severity: ERROR
patterns:
- pattern-either:
- pattern-inside: |
import "github.com/golang-jwt/jwt"
...
- pattern-inside: |
import "github.com/dgrijalva/jwt-go"
...
- pattern-either:
- pattern: |
jwt.SigningMethodNone
- pattern: jwt.UnsafeAllowNoneSignatureType
- id: go.jwt-go.security.jwt.hardcoded-jwt-key
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
options:
interfile: true
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
category: security
technology:
- jwt
- secrets
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key
shortlink: https://sg.run/Rod2
semgrep.dev:
rule:
r_id: 9093
rv_id: 1262920
rule_id: GdU7Ny
version_id: pZT0305
url: https://semgrep.dev/playground/r/pZT0305/go.jwt-go.security.jwt.hardcoded-jwt-key
origin: community
severity: WARNING
languages:
- go
mode: taint
pattern-sources:
- patterns:
- pattern-inside: |
[]byte("$F")
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
$TOKEN.SignedString($F)
- focus-metavariable: $F
- id: go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified
message: Detected the decoding of a JWT token without a verify step. Don't use `ParseUnverified`
unless you know what you're doing This method parses the token but doesn't validate
the signature. It's only ever useful in cases where you know the signature is
valid (because it has been checked previously in the stack) and you want to extract
values from it.
metadata:
cwe:
- 'CWE-345: Insufficient Verification of Data Authenticity'
owasp:
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
category: security
technology:
- jwt
confidence: MEDIUM
references:
- https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified
shortlink: https://sg.run/Av66
semgrep.dev:
rule:
r_id: 9094
rv_id: 1262918
rule_id: ReUgJJ
version_id: o5TbDbq
url: https://semgrep.dev/playground/r/o5TbDbq/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified
origin: community
languages:
- go
severity: WARNING
patterns:
- pattern-inside: |
import "github.com/dgrijalva/jwt-go"
...
- pattern: |
$JWT.ParseUnverified(...)
- id: go.lang.security.bad_tmp.bad-tmp-file-creation
message: File creation in shared tmp directory without using `io.CreateTemp`.
languages:
- go
severity: WARNING
metadata:
cwe:
- 'CWE-377: Insecure Temporary File'
source-rule-url: https://github.com/securego/gosec
category: security
technology:
- go
confidence: LOW
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
- https://pkg.go.dev/io/ioutil#TempFile
- https://pkg.go.dev/os#CreateTemp
- https://github.com/securego/gosec/blob/5fd2a370447223541cddb35da8d1bc707b7bb153/rules/tempfiles.go#L67
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/go.lang.security.bad_tmp.bad-tmp-file-creation
shortlink: https://sg.run/Gejn
semgrep.dev:
rule:
r_id: 9104
rv_id: 1262965
rule_id: 6JUjnL
version_id: 2KTv2pJ
url: https://semgrep.dev/playground/r/2KTv2pJ/go.lang.security.bad_tmp.bad-tmp-file-creation
origin: community
pattern-either:
- pattern: ioutil.WriteFile("=~//tmp/.*$/", ...)
- pattern: os.Create("=~//tmp/.*$/", ...)
- pattern: os.WriteFile("=~//tmp/.*$/", ...)
- id: go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb
message: 'Detected a possible denial-of-service via a zip bomb attack. By limiting
the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. '
severity: WARNING
languages:
- go
patterns:
- pattern-either:
- pattern: io.Copy(...)
- pattern: io.CopyBuffer(...)
- pattern-either:
- pattern-inside: |
gzip.NewReader(...)
...
- pattern-inside: |
zlib.NewReader(...)
...
- pattern-inside: |
zlib.NewReaderDict(...)
...
- pattern-inside: |
bzip2.NewReader(...)
...
- pattern-inside: |
flate.NewReader(...)
...
- pattern-inside: |
flate.NewReaderDict(...)
...
- pattern-inside: |
lzw.NewReader(...)
...
- pattern-inside: |
tar.NewReader(...)
...
- pattern-inside: |
zip.NewReader(...)
...
- pattern-inside: |
zip.OpenReader(...)
...
fix-regex:
regex: (.*)(Copy|CopyBuffer)\((.*?),(.*?)(\)|,.*\))
replacement: \1CopyN(\3, \4, 1024*1024*256)
metadata:
cwe:
- 'CWE-400: Uncontrolled Resource Consumption'
source-rule-url: https://github.com/securego/gosec
references:
- https://golang.org/pkg/io/#CopyN
- https://github.com/securego/gosec/blob/master/rules/decompression-bomb.go
category: security
technology:
- go
confidence: LOW
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Denial-of-Service (DoS)
source: https://semgrep.dev/r/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb
shortlink: https://sg.run/RodK
semgrep.dev:
rule:
r_id: 9105
rv_id: 945606
rule_id: oqUeqn
version_id: JdTDye5
url: https://semgrep.dev/playground/r/JdTDye5/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb
origin: community
- id: go.lang.security.zip.path-traversal-inside-zip-extraction
message: File traversal when extracting zip archive
metadata:
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
source_rule_url: https://github.com/securego/gosec/issues/205
category: security
technology:
- go
confidence: LOW
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/go.lang.security.zip.path-traversal-inside-zip-extraction
shortlink: https://sg.run/Av64
semgrep.dev:
rule:
r_id: 9106
rv_id: 1262971
rule_id: zdUkoR
version_id: rxTAK1Z
url: https://semgrep.dev/playground/r/rxTAK1Z/go.lang.security.zip.path-traversal-inside-zip-extraction
origin: community
languages:
- go
severity: WARNING
pattern: |
reader, $ERR := zip.OpenReader($ARCHIVE)
...
for _, $FILE := range reader.File {
...
path := filepath.Join($TARGET, $FILE.Name)
...
}
- id: go.lang.security.audit.dangerous-command-write.dangerous-command-write
patterns:
- pattern: |
$CW.Write($BYTE)
- pattern-inside: |
$CW,$ERR := $CMD.StdinPipe()
...
- pattern-not: |
$CW.Write("...")
- pattern-not: |
$CW.Write([]byte("..."))
- pattern-not: |
$CW.Write([]byte("..."+"..."))
- pattern-not-inside: |
$BYTE = []byte("...");
...
- pattern-not-inside: |
$BYTE = []byte("..."+"...");
...
- pattern-inside: |
import "os/exec"
...
message: Detected non-static command inside Write. Audit the input to '$CW.Write'.
If unverified user data can reach this call site, this is a code injection vulnerability.
A malicious actor can inject a malicious script to execute arbitrary code.
severity: ERROR
languages:
- go
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
category: security
technology:
- go
confidence: LOW
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/go.lang.security.audit.dangerous-command-write.dangerous-command-write
shortlink: https://sg.run/Bko5
semgrep.dev:
rule:
r_id: 9107
rv_id: 1262933
rule_id: pKUOZ9
version_id: O9Tpx8N
url: https://semgrep.dev/playground/r/O9Tpx8N/go.lang.security.audit.dangerous-command-write.dangerous-command-write
origin: community
- id: go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd
patterns:
- pattern-either:
- patterns:
- pattern: |
exec.Cmd {...,Path: $CMD,...}
- pattern-not: |
exec.Cmd {...,Path: "...",...}
- pattern-not-inside: |
$CMD,$ERR := exec.LookPath("...");
...
- pattern-not-inside: |
$CMD = "...";
...
- patterns:
- pattern: |
exec.Cmd {...,Args: $ARGS,...}
- pattern-not: |
exec.Cmd {...,Args: []string{...},...}
- pattern-not-inside: |
$ARGS = []string{"...",...};
...
- pattern-not-inside: |
$CMD = "...";
...
$ARGS = []string{$CMD,...};
...
- pattern-not-inside: |
$CMD = exec.LookPath("...");
...
$ARGS = []string{$CMD,...};
...
- patterns:
- pattern: |
exec.Cmd {...,Args: []string{$CMD,...},...}
- pattern-not: |
exec.Cmd {...,Args: []string{"...",...},...}
- pattern-not-inside: |
$CMD,$ERR := exec.LookPath("...");
...
- pattern-not-inside: |
$CMD = "...";
...
- patterns:
- pattern-either:
- pattern: |
exec.Cmd {...,Args: []string{"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$EXE,...},...}
- patterns:
- pattern: |
exec.Cmd {...,Args: []string{$CMD,"-c",$EXE,...},...}
- pattern-inside: |
$CMD,$ERR := exec.LookPath("=~/(sh|bash|ksh|csh|tcsh|zsh)/");
...
- pattern-not: |
exec.Cmd {...,Args: []string{"...","...","...",...},...}
- pattern-not-inside: |
$EXE = "...";
...
- pattern-inside: |
import "os/exec"
...
message: Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'.
If unverified user data can reach this call site, this is a code injection vulnerability.
A malicious actor can inject a malicious script to execute arbitrary code.
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- go
confidence: MEDIUM
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd
shortlink: https://sg.run/Dorj
semgrep.dev:
rule:
r_id: 9108
rv_id: 1262934
rule_id: 2ZUb8l
version_id: e1Tyjeg
url: https://semgrep.dev/playground/r/e1Tyjeg/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd
origin: community
severity: ERROR
languages:
- go
- id: go.lang.security.audit.dangerous-exec-command.dangerous-exec-command
patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: |
exec.Command($CMD,...)
- pattern: |
exec.CommandContext($CTX,$CMD,...)
- pattern-not: |
exec.Command("...",...)
- pattern-not: |
exec.CommandContext($CTX,"...",...)
- patterns:
- pattern-either:
- pattern: |
exec.Command("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$CMD,...)
- pattern: |
exec.CommandContext($CTX,"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$CMD,...)
- pattern-not: |
exec.Command("...","...","...",...)
- pattern-not: |
exec.CommandContext($CTX,"...","...","...",...)
- pattern-either:
- pattern: |
exec.Command("=~/\/bin\/env/","=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$CMD,...)
- pattern: |
exec.CommandContext($CTX,"=~/\/bin\/env/","=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$CMD,...)
- pattern-inside: |
import "os/exec"
...
- pattern-not-inside: |
$CMD,$ERR := exec.LookPath("...");
...
- pattern-not-inside: |
$CMD = "...";
...
message: Detected non-static command inside Command. Audit the input to 'exec.Command'.
If unverified user data can reach this call site, this is a code injection vulnerability.
A malicious actor can inject a malicious script to execute arbitrary code.
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- go
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-command.dangerous-exec-command
shortlink: https://sg.run/W8lA
semgrep.dev:
rule:
r_id: 9109
rv_id: 1262935
rule_id: X5U8RQ
version_id: vdT06Xp
url: https://semgrep.dev/playground/r/vdT06Xp/go.lang.security.audit.dangerous-exec-command.dangerous-exec-command
origin: community
severity: ERROR
languages:
- go
- id: go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec
patterns:
- pattern-either:
- patterns:
- pattern: |
syscall.$METHOD($BIN,...)
- pattern-not: |
syscall.$METHOD("...",...)
- pattern-not-inside: |
$BIN,$ERR := exec.LookPath("...");
...
- pattern-not-inside: |
$BIN = "...";
...
- patterns:
- pattern: |
syscall.$METHOD($BIN,$ARGS,...)
- pattern-not: |
syscall.$METHOD($BIN,[]string{"...",...},...)
- pattern-not-inside: |
$ARGS := []string{"...",...};
...
- pattern-not-inside: |
$CMD = "...";
...
$ARGS = []string{$CMD,...};
...
- pattern-not-inside: |
$CMD,$ERR := exec.LookPath("...");
...
$ARGS = []string{$CMD,...};
...
- patterns:
- pattern: |
syscall.$METHOD($BIN,[]string{"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$EXE,...},...)
- pattern-not: |
syscall.$METHOD($BIN,[]string{"...","...","...",...},...)
- patterns:
- pattern: |
syscall.$METHOD($BIN,$ARGS,...)
- pattern-either:
- pattern-inside: |
$ARGS := []string{"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$EXE,...};
...
- pattern-inside: |
$CMD = "=~/(sh|bash|ksh|csh|tcsh|zsh)/";
...
$ARGS = []string{$CMD,"-c",$EXE,...};
...
- pattern-inside: |
$CMD,$ERR := exec.LookPath("=~/(sh|bash|ksh|csh|tcsh|zsh)/");
...
$ARGS = []string{$CMD,"-c",$EXE,...};
...
- pattern-not-inside: |
$ARGS := []string{"...","...","...",...};
...
- pattern-not-inside: |
$CMD = "...";
...
$ARGS = []string{$CMD,"...","...",...};
...
- pattern-not-inside: |
$CMD,$ERR := exec.LookPath("...");
...
$ARGS = []string{$CMD,"...","...",...};
...
- pattern-inside: |
import "syscall"
...
- metavariable-regex:
metavariable: $METHOD
regex: (Exec|ForkExec)
message: Detected non-static command inside Exec. Audit the input to 'syscall.Exec'.
If unverified user data can reach this call site, this is a code injection vulnerability.
A malicious actor can inject a malicious script to execute arbitrary code.
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- go
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec
shortlink: https://sg.run/0QRb
semgrep.dev:
rule:
r_id: 9110
rv_id: 1262936
rule_id: j2UvPl
version_id: d6Tyx3j
url: https://semgrep.dev/playground/r/d6Tyx3j/go.lang.security.audit.dangerous-syscall-exec.dangerous-syscall-exec
origin: community
severity: ERROR
languages:
- go
- id: go.lang.security.audit.reflect-makefunc.reflect-makefunc
message: '''reflect.MakeFunc'' detected. This will sidestep protections that are
normally afforded by Go''s type system. Audit this call and be sure that user
input cannot be used to affect the code generated by MakeFunc; otherwise, you
will have a serious security vulnerability.'
metadata:
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-913: Improper Control of Dynamically-Managed Code Resources'
category: security
technology:
- go
confidence: LOW
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/go.lang.security.audit.reflect-makefunc.reflect-makefunc
shortlink: https://sg.run/KlPd
semgrep.dev:
rule:
r_id: 9111
rv_id: 1262950
rule_id: 10UKGb
version_id: GxTkeqB
url: https://semgrep.dev/playground/r/GxTkeqB/go.lang.security.audit.reflect-makefunc.reflect-makefunc
origin: community
severity: ERROR
pattern: reflect.MakeFunc(...)
languages:
- go
- id: go.lang.security.audit.crypto.bad_imports.insecure-module-used
message: The package `net/http/cgi` is on the import blocklist. The package is
vulnerable to httpoxy attacks (CVE-2015-5386). It is recommended to use `net/http`
or a web framework to build a web application instead.
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
source-rule-url: https://github.com/securego/gosec
references:
- https://godoc.org/golang.org/x/crypto/sha3
category: security
technology:
- go
confidence: MEDIUM
subcategory:
- audit
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used
shortlink: https://sg.run/l2gj
semgrep.dev:
rule:
r_id: 9113
rv_id: 1262921
rule_id: yyUnov
version_id: 2KTv2vJ
url: https://semgrep.dev/playground/r/2KTv2vJ/go.lang.security.audit.crypto.bad_imports.insecure-module-used
origin: community
languages:
- go
severity: WARNING
pattern-either:
- patterns:
- pattern-inside: |
import "net/http/cgi"
...
- pattern: |
cgi.$FUNC(...)
- id: go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key
message: Disabled host key verification detected. This allows man-in-the-middle
attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification.
See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to
learn more about the problem and how to fix it.
metadata:
cwe:
- 'CWE-322: Key Exchange without Entity Authentication'
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://github.com/securego/gosec
references:
- https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/
- https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d
category: security
technology:
- go
confidence: MEDIUM
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key
shortlink: https://sg.run/Yv6X
semgrep.dev:
rule:
r_id: 9114
rv_id: 1262922
rule_id: r6UrW9
version_id: X0TzyzN
url: https://semgrep.dev/playground/r/X0TzyzN/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key
origin: community
languages:
- go
severity: WARNING
pattern: ssh.InsecureIgnoreHostKey()
- id: go.lang.security.audit.crypto.math_random.math-random-used
metadata:
cwe:
- 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)'
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation
category: security
technology:
- go
confidence: MEDIUM
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used
shortlink: https://sg.run/6nK6
semgrep.dev:
rule:
r_id: 9115
rv_id: 1262923
rule_id: bwUwy8
version_id: jQTn5nj
url: https://semgrep.dev/playground/r/jQTn5nj/go.lang.security.audit.crypto.math_random.math-random-used
origin: community
message: Do not use `math/rand`. Use `crypto/rand` instead.
languages:
- go
severity: WARNING
patterns:
- pattern-either:
- pattern: |
import $RAND "$MATH"
- pattern: |
import "$MATH"
- metavariable-regex:
metavariable: $MATH
regex: ^(math/rand(\/v[0-9]+)*)$
- pattern-either:
- pattern-inside: |
...
rand.$FUNC(...)
- pattern-inside: |
...
$RAND.$FUNC(...)
- focus-metavariable:
- $MATH
fix: |
crypto/rand
- id: go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion
message: '`MinVersion` is missing from this TLS configuration. By default, as of
Go 1.22, TLS 1.2 is currently used as the minimum. General purpose web applications
should default to TLS 1.3 with all other protocols disabled. Only where it is
known that a web server must support legacy clients with unsupported an insecure
browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0
to provide support. Add `MinVersion: tls.VersionTLS13'' to the TLS configuration
to bump the minimum version to TLS 1.3.'
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go
references:
- https://go.dev/doc/go1.22#minor_library_changes
- https://pkg.go.dev/crypto/tls#:~:text=MinVersion
- https://www.us-cert.gov/ncas/alerts/TA14-290A
category: security
technology:
- go
confidence: HIGH
subcategory:
- audit
likelihood: MEDIUM
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion
shortlink: https://sg.run/oxEN
semgrep.dev:
rule:
r_id: 9116
rv_id: 1262924
rule_id: NbUk4X
version_id: 1QTypyp
url: https://semgrep.dev/playground/r/1QTypyp/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion
origin: community
languages:
- go
severity: WARNING
patterns:
- pattern: |
tls.Config{ $...CONF }
- pattern-not: |
tls.Config{..., MinVersion: ..., ...}
fix: |
tls.Config{ $...CONF, MinVersion: tls.VersionTLS13 }
- id: go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure
message: SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14,
SSLv3 will be removed. Instead, use 'tls.VersionTLS13'.
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go
references:
- https://golang.org/doc/go1.14#crypto/tls
- https://www.us-cert.gov/ncas/alerts/TA14-290A
category: security
technology:
- go
confidence: HIGH
subcategory:
- vuln
likelihood: MEDIUM
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure
shortlink: https://sg.run/zvE1
semgrep.dev:
rule:
r_id: 9117
rv_id: 1262926
rule_id: kxUkJ2
version_id: yeTxpxj
url: https://semgrep.dev/playground/r/yeTxpxj/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure
origin: community
languages:
- go
severity: WARNING
fix-regex:
regex: VersionSSL30
replacement: VersionTLS13
pattern: 'tls.Config{..., MinVersion: $TLS.VersionSSL30, ...}'
- id: go.lang.security.audit.crypto.tls.tls-with-insecure-cipher
message: Detected an insecure CipherSuite via the 'tls' module. This suite is considered
weak. Use the function 'tls.CipherSuites()' to get a list of good cipher suites.
See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other
cipher suites to use.
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls.go
references:
- https://golang.org/pkg/crypto/tls/#InsecureCipherSuites
category: security
technology:
- go
confidence: HIGH
subcategory:
- vuln
likelihood: HIGH
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher
shortlink: https://sg.run/px8N
semgrep.dev:
rule:
r_id: 9118
rv_id: 1262927
rule_id: wdUJYk
version_id: rxTAKAZ
url: https://semgrep.dev/playground/r/rxTAKAZ/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher
origin: community
languages:
- go
severity: WARNING
pattern-either:
- pattern: |
tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_RC4_128_SHA, ...}}
- pattern: |
tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...}}
- pattern: |
tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_AES_128_CBC_SHA256, ...}}
- pattern: |
tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...}}
- pattern: |
tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...}}
- pattern: |
tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...}}
- pattern: |
tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...}}
- pattern: |
tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...}}
- pattern: |
tls.CipherSuite{..., TLS_RSA_WITH_RC4_128_SHA, ...}
- pattern: |
tls.CipherSuite{..., TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...}
- pattern: |
tls.CipherSuite{..., TLS_RSA_WITH_AES_128_CBC_SHA256, ...}
- pattern: |
tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...}
- pattern: |
tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...}
- pattern: |
tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...}
- pattern: |
tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...}
- pattern: |
tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...}
- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5
message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision
resistant and is therefore not suitable as a cryptographic signature. Use SHA256
or SHA3 instead.
languages:
- go
severity: WARNING
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-328: Use of Weak Hash'
source-rule-url: https://github.com/securego/gosec#available-rules
category: security
technology:
- go
confidence: MEDIUM
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5
shortlink: https://sg.run/2xB5
semgrep.dev:
rule:
r_id: 9119
rv_id: 1262928
rule_id: x8Un6q
version_id: bZT535Y
url: https://semgrep.dev/playground/r/bZT535Y/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5
origin: community
patterns:
- pattern-inside: |
import "crypto/md5"
...
- pattern-either:
- pattern: |
md5.New()
- pattern: |
md5.Sum(...)
- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1
message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not
collision resistant and is therefore not suitable as a cryptographic signature.
Use SHA256 or SHA3 instead.
languages:
- go
severity: WARNING
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-328: Use of Weak Hash'
source-rule-url: https://github.com/securego/gosec#available-rules
category: security
technology:
- go
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1
shortlink: https://sg.run/XBYA
semgrep.dev:
rule:
r_id: 9120
rv_id: 1262929
rule_id: OrU31O
version_id: NdTzyz1
url: https://semgrep.dev/playground/r/NdTzyz1/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1
origin: community
patterns:
- pattern-inside: |
import "crypto/sha1"
...
- pattern-either:
- pattern: |
sha1.New()
- pattern: |
sha1.Sum(...)
- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES
message: Detected DES cipher algorithm which is insecure. The algorithm is considered
weak and has been deprecated. Use AES instead.
languages:
- go
severity: WARNING
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
source-rule-url: https://github.com/securego/gosec#available-rules
category: security
technology:
- go
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES
shortlink: https://sg.run/jREA
semgrep.dev:
rule:
r_id: 9121
rv_id: 1262930
rule_id: eqU8B3
version_id: kbTzGzA
url: https://semgrep.dev/playground/r/kbTzGzA/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES
origin: community
patterns:
- pattern-inside: |
import "crypto/des"
...
- pattern-either:
- pattern: |
des.NewTripleDESCipher(...)
- pattern: |
des.NewCipher(...)
- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4
message: Detected RC4 cipher algorithm which is insecure. The algorithm has many
known vulnerabilities. Use AES instead.
languages:
- go
severity: WARNING
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
source-rule-url: https://github.com/securego/gosec#available-rules
category: security
technology:
- go
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4
shortlink: https://sg.run/1ZAD
semgrep.dev:
rule:
r_id: 9122
rv_id: 1262931
rule_id: v8Unl0
version_id: w8TRoRQ
url: https://semgrep.dev/playground/r/w8TRoRQ/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4
origin: community
patterns:
- pattern-inside: |
import "crypto/rc4"
...
- pattern: rc4.NewCipher(...)
- id: go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key
message: RSA keys should be at least 2048 bits
languages:
- go
severity: WARNING
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://github.com/securego/gosec/blob/master/rules/rsa.go
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms
category: security
technology:
- go
confidence: HIGH
subcategory:
- audit
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key
shortlink: https://sg.run/9oY4
semgrep.dev:
rule:
r_id: 9123
rv_id: 1262932
rule_id: d8UjY3
version_id: xyTjz8L
url: https://semgrep.dev/playground/r/xyTjz8L/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key
origin: community
patterns:
- pattern-either:
- pattern: |
rsa.GenerateKey(..., $BITS)
- pattern: |
rsa.GenerateMultiPrimeKey(..., $BITS)
- metavariable-comparison:
metavariable: $BITS
comparison: $BITS < 2048
- focus-metavariable:
- $BITS
fix: |
2048
- id: go.lang.security.audit.database.string-formatted-query.string-formatted-query
languages:
- go
message: String-formatted SQL query detected. This could lead to SQL injection if
the string is not sanitized properly. Audit this call to ensure the SQL is not
manipulable by external data.
severity: WARNING
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
source-rule-url: https://github.com/securego/gosec
category: security
technology:
- go
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/go.lang.security.audit.database.string-formatted-query.string-formatted-query
shortlink: https://sg.run/ydEr
semgrep.dev:
rule:
r_id: 9124
rv_id: 1262937
rule_id: ZqU5bD
version_id: ZRTKA2q
url: https://semgrep.dev/playground/r/ZRTKA2q/go.lang.security.audit.database.string-formatted-query.string-formatted-query
origin: community
patterns:
- metavariable-regex:
metavariable: $OBJ
regex: (?i).*(db|database)
- pattern-not-inside: |
$VAR = "..." + "..."
...
$OBJ.$SINK(..., $VAR, ...)
- pattern-not: $OBJ.Exec("...")
- pattern-not: $OBJ.ExecContext($CTX, "...")
- pattern-not: $OBJ.Query("...")
- pattern-not: $OBJ.QueryContext($CTX, "...")
- pattern-not: $OBJ.QueryRow("...")
- pattern-not: $OBJ.QueryRow($CTX, "...")
- pattern-not: $OBJ.QueryRowContext($CTX, "...")
- pattern-either:
- pattern: $OBJ.Exec($X + ...)
- pattern: $OBJ.ExecContext($CTX, $X + ...)
- pattern: $OBJ.Query($X + ...)
- pattern: $OBJ.QueryContext($CTX, $X + ...)
- pattern: $OBJ.QueryRow($X + ...)
- pattern: $OBJ.QueryRow($CTX, $X + ...)
- pattern: $OBJ.QueryRowContext($CTX, $X + ...)
- pattern: $OBJ.Exec(fmt.$P("...", ...))
- pattern: $OBJ.ExecContext($CTX, fmt.$P("...", ...))
- pattern: $OBJ.Query(fmt.$P("...", ...))
- pattern: $OBJ.QueryContext($CTX, fmt.$P("...", ...))
- pattern: $OBJ.QueryRow(fmt.$P("...", ...))
- pattern: $OBJ.QueryRow($CTX, fmt.$U("...", ...))
- pattern: $OBJ.QueryRowContext($CTX, fmt.$P("...", ...))
- patterns:
- pattern-either:
- pattern: $QUERY = fmt.Fprintf($F, "$SQLSTR", ...)
- pattern: $QUERY = fmt.Sprintf("$SQLSTR", ...)
- pattern: $QUERY = fmt.Printf("$SQLSTR", ...)
- pattern: $QUERY = $X + ...
- pattern-either:
- pattern-inside: |
func $FUNC(...) {
...
$OBJ.Query($QUERY, ...)
...
}
- pattern-inside: |
func $FUNC(...) {
...
$OBJ.ExecContext($CTX, $QUERY, ...)
...
}
- pattern-inside: |
func $FUNC(...) {
...
$OBJ.Exec($QUERY, ...)
...
}
- pattern-inside: |
func $FUNC(...) {
...
$OBJ.QueryRow($CTX, $QUERY)
...
}
- pattern-inside: |
func $FUNC(...) {
...
$OBJ.QueryRow($QUERY)
...
}
- pattern-inside: |
func $FUNC(...) {
...
$OBJ.QueryContext($CTX, $QUERY)
...
}
- pattern-inside: |
func $FUNC(...) {
...
$OBJ.QueryRowContext($CTX, $QUERY, ...)
...
}
- id: go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces
message: Detected a network listener listening on 0.0.0.0 or an empty string. This
could unexpectedly expose the server publicly as it binds to all available interfaces.
Instead, specify another IP address that is not 0.0.0.0 nor the empty string.
languages:
- go
severity: WARNING
metadata:
cwe:
- 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
source-rule-url: https://github.com/securego/gosec
category: security
technology:
- go
confidence: HIGH
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces
shortlink: https://sg.run/rdE0
semgrep.dev:
rule:
r_id: 9125
rv_id: 1262939
rule_id: nJUz3J
version_id: ExTExoK
url: https://semgrep.dev/playground/r/ExTExoK/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces
origin: community
pattern-either:
- pattern: tls.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...)
- pattern: net.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...)
- pattern: tls.Listen($NETWORK, "=~/^:.*$/", ...)
- pattern: net.Listen($NETWORK, "=~/^:.*$/", ...)
- id: go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly
patterns:
- pattern-not-inside: |
http.Cookie{
...,
HttpOnly: true,
...,
}
- pattern: |
http.Cookie{
...,
}
message: A session cookie was detected without setting the 'HttpOnly' flag. The
'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts
from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by
setting 'HttpOnly' to 'true' in the Cookie.
metadata:
cwe:
- 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag'
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
references:
- https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go
- https://golang.org/src/net/http/cookie.go
category: security
technology:
- go
confidence: MEDIUM
subcategory:
- vuln
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cookie Security
source: https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly
shortlink: https://sg.run/b73e
semgrep.dev:
rule:
r_id: 9126
rv_id: 1262940
rule_id: EwU2Z6
version_id: 7ZTE3BW
url: https://semgrep.dev/playground/r/7ZTE3BW/go.lang.security.audit.net.cookie-missing-httponly.cookie-missing-httponly
origin: community
fix-regex:
regex: (HttpOnly\s*:\s+)false
replacement: \1true
severity: WARNING
languages:
- go
- id: go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure
patterns:
- pattern-not-inside: |
http.Cookie{
...,
Secure: true,
...,
}
- pattern: |
http.Cookie{
...,
}
message: A session cookie was detected without setting the 'Secure' flag. The 'secure'
flag for cookies prevents the client from transmitting the cookie over insecure
channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in
the Options struct.
metadata:
cwe:
- 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute'
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
references:
- https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go
- https://golang.org/src/net/http/cookie.go
category: security
technology:
- go
confidence: MEDIUM
subcategory:
- vuln
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cookie Security
source: https://semgrep.dev/r/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure
shortlink: https://sg.run/N4G7
semgrep.dev:
rule:
r_id: 9127
rv_id: 1262941
rule_id: 7KUQ8X
version_id: LjTkgGE
url: https://semgrep.dev/playground/r/LjTkgGE/go.lang.security.audit.net.cookie-missing-secure.cookie-missing-secure
origin: community
fix-regex:
regex: (Secure\s*:\s+)false
replacement: \1true
severity: WARNING
languages:
- go
- id: go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace
message: Detected a potentially dynamic ClientTrace. This occurred because semgrep
could not find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous
because they deserialize function code to run when certain Request events occur,
which could lead to code being run without your knowledge. Ensure that your ClientTrace
is statically defined.
metadata:
cwe:
- 'CWE-913: Improper Control of Dynamically-Managed Code Resources'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://github.com/returntocorp/semgrep-rules/issues/518
category: security
technology:
- go
confidence: MEDIUM
subcategory:
- vuln
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace
shortlink: https://sg.run/kXEK
semgrep.dev:
rule:
r_id: 9128
rv_id: 1262942
rule_id: L1Uyjp
version_id: 8KT5rNv
url: https://semgrep.dev/playground/r/8KT5rNv/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace
origin: community
patterns:
- pattern-not-inside: |
package $PACKAGE
...
&httptrace.ClientTrace { ... }
...
- pattern: httptrace.WithClientTrace($ANY, $TRACE)
severity: WARNING
languages:
- go
- id: go.lang.security.audit.net.formatted-template-string.formatted-template-string
message: Found a formatted template string passed to 'template.HTML()'. 'template.HTML()'
does not escape contents. Be absolutely sure there is no user-controlled data
in this template. If user data can reach this template, you may have a XSS vulnerability.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://golang.org/pkg/html/template/#HTML
category: security
technology:
- go
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string
shortlink: https://sg.run/weE0
semgrep.dev:
rule:
r_id: 9129
rv_id: 1262943
rule_id: 8GUjDW
version_id: gETB7Pe
url: https://semgrep.dev/playground/r/gETB7Pe/go.lang.security.audit.net.formatted-template-string.formatted-template-string
origin: community
languages:
- go
severity: WARNING
patterns:
- pattern-not: template.HTML("..." + "...")
- pattern-either:
- pattern: template.HTML($T + $X, ...)
- pattern: template.HTML(fmt.$P("...", ...), ...)
- pattern: |
$T = "..."
...
$T = $FXN(..., $T, ...)
...
template.HTML($T, ...)
- pattern: |
$T = fmt.$P("...", ...)
...
template.HTML($T, ...)
- pattern: |
$T, $ERR = fmt.$P("...", ...)
...
template.HTML($T, ...)
- pattern: |
$T = $X + $Y
...
template.HTML($T, ...)
- pattern: |-
$T = "..."
...
$OTHER, $ERR = fmt.$P(..., $T, ...)
...
template.HTML($OTHER, ...)
- id: go.lang.security.audit.net.pprof.pprof-debug-exposure
metadata:
cwe:
- 'CWE-489: Active Debug Code'
owasp: A06:2017 - Security Misconfiguration
source-rule-url: https://github.com/securego/gosec#available-rules
references:
- https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/
category: security
technology:
- go
confidence: LOW
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Active Debug Code
source: https://semgrep.dev/r/go.lang.security.audit.net.pprof.pprof-debug-exposure
shortlink: https://sg.run/x1Ep
semgrep.dev:
rule:
r_id: 9130
rv_id: 945583
rule_id: gxU1Kp
version_id: 9lTy168
url: https://semgrep.dev/playground/r/9lTy168/go.lang.security.audit.net.pprof.pprof-debug-exposure
origin: community
message: The profiling 'pprof' endpoint is automatically exposed on /debug/pprof.
This could leak information about the server. Instead, use `import "net/http/pprof"`.
See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/
for more information and mitigation.
languages:
- go
severity: WARNING
patterns:
- pattern-inside: |
import _ "net/http/pprof"
...
- pattern-inside: |
func $ANY(...) {
...
}
- pattern-not-inside: |
$MUX = http.NewServeMux(...)
...
http.ListenAndServe($ADDR, $MUX)
- pattern-not: http.ListenAndServe("=~/^localhost.*/", ...)
- pattern-not: http.ListenAndServe("=~/^127[.]0[.]0[.]1.*/", ...)
- pattern: http.ListenAndServe(...)
- id: go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr
message: Found a formatted template string passed to 'template. HTMLAttr()'. 'template.HTMLAttr()'
does not escape contents. Be absolutely sure there is no user-controlled data
in this template or validate and sanitize the data before passing it into the
template.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://golang.org/pkg/html/template/#HTMLAttr
category: security
technology:
- go
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr
shortlink: https://sg.run/OPRp
semgrep.dev:
rule:
r_id: 9131
rv_id: 1262945
rule_id: QrUz9R
version_id: 3ZT4XRr
url: https://semgrep.dev/playground/r/3ZT4XRr/go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr
origin: community
languages:
- go
severity: WARNING
pattern-either:
- pattern: template.HTMLAttr($T + $X, ...)
- pattern: template.HTMLAttr(fmt.$P("...", ...), ...)
- pattern: |
$T = "..."
...
$T = $FXN(..., $T, ...)
...
template.HTMLAttr($T, ...)
- pattern: |
$T = fmt.$P("...", ...)
...
template.HTMLAttr($T, ...)
- pattern: |
$T, $ERR = fmt.$P("...", ...)
...
template.HTMLAttr($T, ...)
- pattern: |
$T = $X + $Y
...
template.HTMLAttr($T, ...)
- pattern: |-
$T = "..."
...
$OTHER, $ERR = fmt.$P(..., $T, ...)
...
template.HTMLAttr($OTHER, ...)
- id: go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js
message: Found a formatted template string passed to 'template.JS()'. 'template.JS()'
does not escape contents. Be absolutely sure there is no user-controlled data
in this template.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://golang.org/pkg/html/template/#JS
category: security
technology:
- go
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js
shortlink: https://sg.run/eLNl
semgrep.dev:
rule:
r_id: 9132
rv_id: 1262946
rule_id: 3qUP8K
version_id: 44TEj9E
url: https://semgrep.dev/playground/r/44TEj9E/go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js
origin: community
languages:
- go
severity: WARNING
pattern-either:
- pattern: template.JS($T + $X, ...)
- pattern: template.JS(fmt.$P("...", ...), ...)
- pattern: |
$T = "..."
...
$T = $FXN(..., $T, ...)
...
template.JS($T, ...)
- pattern: |
$T = fmt.$P("...", ...)
...
template.JS($T, ...)
- pattern: |
$T, $ERR = fmt.$P("...", ...)
...
template.JS($T, ...)
- pattern: |
$T = $X + $Y
...
template.JS($T, ...)
- pattern: |
$T = "..."
...
$OTHER, $ERR = fmt.$P(..., $T, ...)
...
template.JS($OTHER, ...)
- id: go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url
message: Found a formatted template string passed to 'template.URL()'. 'template.URL()'
does not escape contents, and this could result in XSS (cross-site scripting)
and therefore confidential data being stolen. Sanitize data coming into this function
or make sure that no user-controlled input is coming into the function.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://golang.org/pkg/html/template/#URL
category: security
technology:
- go
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url
shortlink: https://sg.run/vzE4
semgrep.dev:
rule:
r_id: 9133
rv_id: 1262947
rule_id: 4bUkDW
version_id: PkTR3zz
url: https://semgrep.dev/playground/r/PkTR3zz/go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url
origin: community
languages:
- go
severity: WARNING
pattern-either:
- pattern: template.URL($T + $X, ...)
- pattern: template.URL(fmt.$P("...", ...), ...)
- pattern: |
$T = "..."
...
$T = $FXN(..., $T, ...)
...
template.URL($T, ...)
- pattern: |
$T = fmt.$P("...", ...)
...
template.URL($T, ...)
- pattern: |
$T, $ERR = fmt.$P("...", ...)
...
template.URL($T, ...)
- pattern: |
$T = $X + $Y
...
template.URL($T, ...)
- pattern: |-
$T = "..."
...
$OTHER, $ERR = fmt.$P(..., $T, ...)
...
template.URL($OTHER, ...)
- id: go.lang.security.audit.net.use-tls.use-tls
pattern: http.ListenAndServe($ADDR, $HANDLER)
fix: http.ListenAndServeTLS($ADDR, certFile, keyFile, $HANDLER)
metadata:
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://golang.org/pkg/net/http/#ListenAndServeTLS
category: security
technology:
- go
confidence: MEDIUM
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/go.lang.security.audit.net.use-tls.use-tls
shortlink: https://sg.run/dKbY
semgrep.dev:
rule:
r_id: 9134
rv_id: 1262948
rule_id: PeUZ8X
version_id: JdTzxkn
url: https://semgrep.dev/playground/r/JdTzxkn/go.lang.security.audit.net.use-tls.use-tls
origin: community
message: Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead.
See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information.
languages:
- go
severity: WARNING
- id: go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf
patterns:
- pattern-inside: |
func $FUNC(..., $W http.ResponseWriter, ...) {
...
var $TEMPLATE = "..."
...
$W.Write([]byte(fmt.$PRINTF($TEMPLATE, ...)), ...)
...
}
- pattern-either:
- pattern: |
$PARAMS = r.URL.Query()
...
$DATA, $ERR := $PARAMS[...]
...
$INTERM = $ANYTHING(..., $DATA, ...)
...
$W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...)))
- pattern: |
$PARAMS = r.URL.Query()
...
$DATA, $ERR := $PARAMS[...]
...
$INTERM = $DATA[...]
...
$W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...)))
- pattern: |
$DATA, $ERR := r.URL.Query()[...]
...
$INTERM = $DATA[...]
...
$W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...)))
- pattern: |
$DATA, $ERR := r.URL.Query()[...]
...
$INTERM = $ANYTHING(..., $DATA, ...)
...
$W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...)))
- pattern: |
$PARAMS = r.URL.Query()
...
$DATA, $ERR := $PARAMS[...]
...
$W.Write([]byte(fmt.$PRINTF(..., $DATA, ...)))
message: Found data going from url query parameters into formatted data written
to ResponseWriter. This could be XSS and should not be done. If you must do this,
ensure your data is sanitized or escaped.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- go
confidence: MEDIUM
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf
shortlink: https://sg.run/Zvon
semgrep.dev:
rule:
r_id: 9135
rv_id: 1262949
rule_id: JDUyXB
version_id: 5PTo1qr
url: https://semgrep.dev/playground/r/5PTo1qr/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf
origin: community
severity: WARNING
languages:
- go
- id: go.lang.security.audit.xss.import-text-template.import-text-template
message: When working with web applications that involve rendering user-generated content,
it's important to properly escape any HTML content to prevent Cross-Site Scripting
(XSS) attacks. In Go, the `text/template` package does not automatically escape
HTML content, which can leave your application vulnerable to these types of attacks.
To mitigate this risk, it's recommended to use the `html/template` package instead,
which provides built-in functionality for HTML escaping. By using `html/template`
to render your HTML content, you can help to ensure that your web application
is more secure and less susceptible to XSS vulnerabilities.
metadata:
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://www.veracode.com/blog/secure-development/use-golang-these-mistakes-could-compromise-your-apps-security
category: security
technology:
- go
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/go.lang.security.audit.xss.import-text-template.import-text-template
shortlink: https://sg.run/ndEO
semgrep.dev:
rule:
r_id: 9136
rv_id: 1262956
rule_id: 5rUOZQ
version_id: 0bTKzok
url: https://semgrep.dev/playground/r/0bTKzok/go.lang.security.audit.xss.import-text-template.import-text-template
origin: community
severity: WARNING
patterns:
- pattern: |
import "$IMPORT"
- metavariable-regex:
metavariable: $IMPORT
regex: ^(text/template)$
- focus-metavariable: $IMPORT
fix: |
html/template
languages:
- go
- id: go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter
languages:
- go
message: Detected directly writing or similar in 'http.ResponseWriter.write()'.
This bypasses HTML escaping that prevents cross-site scripting vulnerabilities.
Instead, use the 'html/template' package and render data using 'template.Execute()'.
metadata:
category: security
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/
technology:
- go
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter
shortlink: https://sg.run/EkbA
semgrep.dev:
rule:
r_id: 9137
rv_id: 1262957
rule_id: GdU71y
version_id: K3TKkoB
url: https://semgrep.dev/playground/r/K3TKkoB/go.lang.security.audit.xss.no-direct-write-to-responsewriter.no-direct-write-to-responsewriter
origin: community
patterns:
- pattern-either:
- pattern-inside: |
func $HANDLER(..., $WRITER http.ResponseWriter, ...) {
...
}
- pattern-inside: |
func $HANDLER(..., $WRITER *http.ResponseWriter, ...) {
...
}
- pattern-inside: |
func(..., $WRITER http.ResponseWriter, ...) {
...
}
- pattern-either:
- pattern: $WRITER.Write(...)
- pattern: (*$WRITER).Write(...)
- pattern-not: $WRITER.Write([]byte("..."))
severity: WARNING
- id: go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter
message: Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses
HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use
the 'html/template' package to render data to users.
metadata:
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/
category: security
technology:
- go
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter
shortlink: https://sg.run/7oqR
semgrep.dev:
rule:
r_id: 9138
rv_id: 1262958
rule_id: ReUgyJ
version_id: qkTR7OP
url: https://semgrep.dev/playground/r/qkTR7OP/go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter
origin: community
severity: WARNING
patterns:
- pattern-either:
- pattern-inside: |
func $HANDLER(..., $WRITER http.ResponseWriter, ...) {
...
}
- pattern-inside: |
func(..., $WRITER http.ResponseWriter, ...) {
...
}
- pattern-not: fmt.$PRINTF($WRITER, "...")
- pattern: fmt.$PRINTF($WRITER, ...)
languages:
- go
- id: go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag
message: Detected template variable interpolation in an HTML tag. This is potentially
vulnerable to cross-site scripting (XSS) attacks because a malicious actor has
control over HTML but without the need to use escaped characters. Use explicit
tags instead.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://github.com/golang/go/issues/19669
- https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/
category: security
technology:
- generic
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag
shortlink: https://sg.run/LwJJ
semgrep.dev:
rule:
r_id: 9139
rv_id: 1262959
rule_id: AbUzBB
version_id: l4TJRZK
url: https://semgrep.dev/playground/r/l4TJRZK/go.lang.security.audit.xss.no-interpolation-in-tag.no-interpolation-in-tag
origin: community
languages:
- generic
severity: WARNING
paths:
include:
- '*.html'
- '*.thtml'
- '*.gohtml'
- '*.tmpl'
- '*.tpl'
pattern: <{{ ... }} ... >
- id: go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string
message: Detected template variable interpolation in a JavaScript template string.
This is potentially vulnerable to cross-site scripting (XSS) attacks because a
malicious actor has control over JavaScript but without the need to use escaped
characters. Instead, obtain this variable outside of the template string and ensure
your template is properly escaped.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://github.com/golang/go/issues/9200#issuecomment-66100328
- https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/
category: security
technology:
- generic
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string
shortlink: https://sg.run/8yl7
semgrep.dev:
rule:
r_id: 9140
rv_id: 1262960
rule_id: BYUNR6
version_id: YDTZeEB
url: https://semgrep.dev/playground/r/YDTZeEB/go.lang.security.audit.xss.no-interpolation-js-template-string.no-interpolation-js-template-string
origin: community
languages:
- generic
severity: WARNING
paths:
include:
- '*.html'
- '*.thtml'
- '*.gohtml'
- '*.tmpl'
- '*.tpl'
patterns:
- pattern-inside: <script ...> ... ... ... ... ... </script>
- pattern: '` ... {{ ... }} ...`'
- id: go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter
message: Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'.
This bypasses HTML escaping that prevents cross-site scripting vulnerabilities.
Instead, use the 'html/template' package to render data to users.
metadata:
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/
- https://golang.org/pkg/io/#WriteString
category: security
technology:
- go
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter
shortlink: https://sg.run/gLwn
semgrep.dev:
rule:
r_id: 9141
rv_id: 1262961
rule_id: DbUpEr
version_id: 6xT2983
url: https://semgrep.dev/playground/r/6xT2983/go.lang.security.audit.xss.no-io-writestring-to-responsewriter.no-io-writestring-to-responsewriter
origin: community
severity: WARNING
patterns:
- pattern-either:
- pattern-inside: |
func $HANDLER(..., $WRITER http.ResponseWriter, ...) {
...
}
- pattern-inside: |
func(..., $WRITER http.ResponseWriter, ...) {
...
}
- pattern-not: io.WriteString($WRITER, "...")
- pattern: io.WriteString($WRITER, $STRING)
languages:
- go
- id: go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter
message: Detected 'printf' or similar in 'http.ResponseWriter.write()'. This bypasses
HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use
the 'html/template' package to render data to users.
metadata:
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/
category: security
technology:
- go
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter
shortlink: https://sg.run/Q5BP
semgrep.dev:
rule:
r_id: 9142
rv_id: 1262962
rule_id: WAUoLp
version_id: o5TbDdq
url: https://semgrep.dev/playground/r/o5TbDdq/go.lang.security.audit.xss.no-printf-in-responsewriter.no-printf-in-responsewriter
origin: community
severity: WARNING
patterns:
- pattern-either:
- pattern-inside: |
func $HANDLER(..., $WRITER http.ResponseWriter, ...) {
...
}
- pattern-inside: |
func(..., $WRITER http.ResponseWriter, ...) {
...
}
- pattern: |
$WRITER.Write(<... fmt.$PRINTF(...) ...>, ...)
languages:
- go
- id: go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type
message: Semgrep could not determine that the argument to 'template.HTML()' is a
constant. 'template.HTML()' and similar does not escape contents. Be absolutely
sure there is no user-controlled data in this template. If user data can reach
this template, you may have a XSS vulnerability. Instead, do not use this function
and use 'template.Execute()'.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://golang.org/pkg/html/template/#HTML
- https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/vulnerability/xss/xss.go#L33
category: security
technology:
- go
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type
shortlink: https://sg.run/3xDb
semgrep.dev:
rule:
r_id: 9143
rv_id: 1262963
rule_id: 0oU5n3
version_id: zyTb2Lz
url: https://semgrep.dev/playground/r/zyTb2Lz/go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type
origin: community
languages:
- go
severity: WARNING
patterns:
- pattern-not: template.$ANY("..." + "...")
- pattern-not: template.$ANY("...")
- pattern-either:
- pattern: template.HTML(...)
- pattern: template.CSS(...)
- pattern: template.HTMLAttr(...)
- pattern: template.JS(...)
- pattern: template.JSStr(...)
- pattern: template.Srcset(...)
- pattern: template.URL(...)
- id: go.otto.security.audit.dangerous-execution.dangerous-execution
message: Detected non-static script inside otto VM. Audit the input to 'VM.Run'.
If unverified user data can reach this call site, this is a code injection vulnerability.
A malicious actor can inject a malicious script to execute arbitrary code.
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- otto
- vm
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/go.otto.security.audit.dangerous-execution.dangerous-execution
shortlink: https://sg.run/4xWE
semgrep.dev:
rule:
r_id: 9144
rv_id: 1262972
rule_id: KxUbxk
version_id: bZT53ZY
url: https://semgrep.dev/playground/r/bZT53ZY/go.otto.security.audit.dangerous-execution.dangerous-execution
origin: community
severity: ERROR
patterns:
- pattern-inside: |
$VM = otto.New(...)
...
- pattern-not: $VM.Run("...", ...)
- pattern: $VM.Run(...)
languages:
- go
- id: java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
technology:
- java
- secrets
- jwt
category: security
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret
shortlink: https://sg.run/RoDK
semgrep.dev:
rule:
r_id: 9149
rv_id: 1262980
rule_id: oqUeAn
version_id: d6Tyx8j
url: https://semgrep.dev/playground/r/d6Tyx8j/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret
origin: community
languages:
- java
severity: WARNING
patterns:
- pattern-either:
- pattern: |
(Algorithm $ALG) = $ALGO.$HMAC("$Y");
- pattern: |
$SECRET = "$Y";
...
(Algorithm $ALG) = $ALGO.$HMAC($SECRET);
- pattern: |
class $CLASS {
...
$TYPE $SECRET = "$Y";
...
$RETURNTYPE $FUNC (...) {
...
(Algorithm $ALG) = $ALGO.$HMAC($SECRET);
...
}
...
}
- focus-metavariable: $Y
- metavariable-regex:
metavariable: $HMAC
regex: (HMAC384|HMAC256|HMAC512)
- id: java.java-jwt.security.jwt-none-alg.java-jwt-none-alg
message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm
assumes the integrity of the token has already been verified. This would allow
a malicious actor to forge a JWT token that will automatically be verified. Do
not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
category: security
technology:
- jwt
confidence: HIGH
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg
shortlink: https://sg.run/Av14
semgrep.dev:
rule:
r_id: 9150
rv_id: 1262981
rule_id: zdUkzR
version_id: ZRTKADq
url: https://semgrep.dev/playground/r/ZRTKADq/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg
origin: community
languages:
- java
severity: ERROR
pattern-either:
- pattern: |
$JWT.sign(com.auth0.jwt.algorithms.Algorithm.none());
- pattern: |
$NONE = com.auth0.jwt.algorithms.Algorithm.none();
...
$JWT.sign($NONE);
- pattern: |-
class $CLASS {
...
$TYPE $NONE = com.auth0.jwt.algorithms.Algorithm.none();
...
$RETURNTYPE $FUNC (...) {
...
$JWT.sign($NONE);
...
}
...
}
- id: java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify
message: Detected the decoding of a JWT token without a verify step. JWT tokens
must be verified before use, otherwise the token's integrity is unknown. This
means a malicious actor could forge a JWT token with any claims. Call '.verify()'
before using the token.
metadata:
cwe:
- 'CWE-345: Insufficient Verification of Data Authenticity'
owasp:
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
category: security
technology:
- jwt
confidence: MEDIUM
references:
- https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures
subcategory:
- vuln
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify
shortlink: https://sg.run/Bk95
semgrep.dev:
rule:
r_id: 9151
rv_id: 1262979
rule_id: pKUOE9
version_id: vdT06Lp
url: https://semgrep.dev/playground/r/vdT06Lp/java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify
origin: community
languages:
- java
severity: WARNING
patterns:
- pattern: |
com.auth0.jwt.JWT.decode(...);
- pattern-not-inside: |-
class $CLASS {
...
$RETURNTYPE $FUNC (...) {
...
$VERIFIER.verify(...);
...
}
}
- id: java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal
metadata:
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN
references:
- https://www.owasp.org/index.php/Path_Traversal
category: security
technology:
- jax-rs
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: LOW
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal
shortlink: https://sg.run/DoWj
semgrep.dev:
rule:
r_id: 9152
rv_id: 1262984
rule_id: 2ZUb9l
version_id: 7ZTE3KW
url: https://semgrep.dev/playground/r/7ZTE3KW/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal
origin: community
message: Detected a potential path traversal. A malicious actor could control the
location of this file, to include going backwards in the directory with '../'.
To address this, ensure that user-controlled variables in file paths are sanitized.
You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...)
to only retrieve the file name from the path.
severity: WARNING
languages:
- java
pattern-either:
- pattern: |
$RETURNTYPE $FUNC (..., @PathParam(...) $TYPE $VAR, ...) {
...
new File(..., $VAR, ...);
...
}
- pattern: |-
$RETURNTYPE $FUNC (..., @javax.ws.rs.PathParam(...) $TYPE $VAR, ...) {
...
new File(..., $VAR, ...);
...
}
- id: java.jboss.security.session_sqli.find-sql-string-concatenation
message: In $METHOD, $X is used to construct a SQL query via string concatenation.
languages:
- java
severity: ERROR
pattern-either:
- pattern: |
$RETURN $METHOD(...,String $X,...){
...
Session $SESSION = ...;
...
String $QUERY = ... + $X + ...;
...
PreparedStatement $PS = $SESSION.connection().prepareStatement($QUERY);
...
ResultSet $RESULT = $PS.executeQuery();
...
}
- pattern: |
$RETURN $METHOD(...,String $X,...){
...
String $QUERY = ... + $X + ...;
...
Session $SESSION = ...;
...
PreparedStatement $PS = $SESSION.connection().prepareStatement($QUERY);
...
ResultSet $RESULT = $PS.executeQuery();
...
}
metadata:
category: security
technology:
- jboss
confidence: MEDIUM
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/java.jboss.security.session_sqli.find-sql-string-concatenation
shortlink: https://sg.run/W8kA
semgrep.dev:
rule:
r_id: 9153
rv_id: 1262986
rule_id: X5U8rQ
version_id: 8KT5r3v
url: https://semgrep.dev/playground/r/8KT5r3v/java.jboss.security.session_sqli.find-sql-string-concatenation
origin: community
- id: java.jjwt.security.jwt-none-alg.jjwt-none-alg
message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm
assumes the integrity of the token has already been verified. This would allow
a malicious actor to forge a JWT token that will automatically be verified. Do
not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
asvs:
section: 'V3: Session Management Verification Requirements'
control_id: 3.5.3 Insecue Stateless Session Tokens
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
version: '4'
category: security
technology:
- jwt
confidence: LOW
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.jjwt.security.jwt-none-alg.jjwt-none-alg
shortlink: https://sg.run/0Q7b
semgrep.dev:
rule:
r_id: 9154
rv_id: 1262987
rule_id: j2Uvol
version_id: gETB7re
url: https://semgrep.dev/playground/r/gETB7re/java.jjwt.security.jwt-none-alg.jjwt-none-alg
origin: community
languages:
- java
severity: ERROR
patterns:
- pattern: |
io.jsonwebtoken.Jwts.builder();
- pattern-not-inside: |-
$RETURNTYPE $FUNC(...) {
...
$JWTS.signWith(...);
...
}
- id: java.lang.security.do-privileged-use.do-privileged-use
severity: WARNING
languages:
- java
metadata:
cwe:
- 'CWE-269: Improper Privilege Management'
references:
- https://docs.oracle.com/javase/8/docs/technotes/guides/security/doprivileged.html
- https://wiki.sei.cmu.edu/confluence/display/java/Privilege+Escalation
- http://phrack.org/papers/escaping_the_java_sandbox.html
category: security
technology:
- java
owasp:
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/java.lang.security.do-privileged-use.do-privileged-use
shortlink: https://sg.run/6n76
semgrep.dev:
rule:
r_id: 9159
rv_id: 1263063
rule_id: bwUw28
version_id: o5TbDoY
url: https://semgrep.dev/playground/r/o5TbDoY/java.lang.security.do-privileged-use.do-privileged-use
origin: community
message: Marking code as privileged enables a piece of trusted code to temporarily
enable access to more resources than are available directly to the code that called
it. Be very careful in your use of the privileged construct, and always remember
to make the privileged code section as small as possible.
patterns:
- pattern-inside: |
import java.security.*;
...
- pattern-either:
- pattern: AccessController.doPrivileged(...);
- pattern: class $ACTION implements PrivilegedAction<Void> { ... }
- id: java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal
metadata:
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN
references:
- https://www.owasp.org/index.php/Path_Traversal
category: security
technology:
- java
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal
shortlink: https://sg.run/oxXN
semgrep.dev:
rule:
r_id: 9160
rv_id: 1263064
rule_id: NbUk7X
version_id: zyTb2rq
url: https://semgrep.dev/playground/r/zyTb2rq/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal
origin: community
message: Detected a potential path traversal. A malicious actor could control the
location of this file, to include going backwards in the directory with '../'.
To address this, ensure that user-controlled variables in file paths are sanitized.
You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...)
to only retrieve the file name from the path.
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
(HttpServletRequest $REQ)
- patterns:
- pattern-inside: |
(javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);
...
for (javax.servlet.http.Cookie $COOKIE: $COOKIES) {
...
}
- pattern: |
$COOKIE.getValue(...)
- patterns:
- pattern-inside: |
$TYPE[] $VALS = (HttpServletRequest $REQ).$GETFUNC(...);
...
- pattern: |
$PARAM = $VALS[$INDEX];
pattern-sanitizers:
- pattern: org.apache.commons.io.FilenameUtils.getName(...)
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
(java.io.File $FILE) = ...
- pattern: |
(java.io.FileOutputStream $FOS) = ...
- pattern: |
new java.io.FileInputStream(...)
severity: ERROR
languages:
- java
- id: java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization
severity: WARNING
languages:
- java
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.3 Insecue Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf
category: security
technology:
- java
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization
shortlink: https://sg.run/zvO1
semgrep.dev:
rule:
r_id: 9161
rv_id: 1263065
rule_id: kxUk12
version_id: pZT03A1
url: https://semgrep.dev/playground/r/pZT03A1/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization
origin: community
message: JMS Object messages depend on Java Serialization for marshalling/unmarshalling
of the message payload when ObjectMessage.getObject() is called. Deserialization
of untrusted data can lead to security flaws; a remote attacker could via a crafted
JMS ObjectMessage to execute arbitrary code with the permissions of the application
listening/consuming JMS Messages. In this case, the JMS MessageListener consume
an ObjectMessage type received inside the onMessage method, which may lead to
arbitrary code execution when calling the $Y.getObject method.
patterns:
- pattern-inside: |
public class $JMS_LISTENER implements MessageListener {
...
public void onMessage(Message $JMS_MSG) {
...
}
}
- pattern-either:
- pattern-inside: $X = $Y.getObject(...);
- pattern-inside: $X = ($Z) $Y.getObject(...);
- id: java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss
message: 'Cross-site scripting detected in HttpServletResponse writer with variable
''$VAR''. User input was detected going directly from the HttpServletRequest into
output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml:
''Encode.forHtml($VAR)''.'
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XSS_SERVLET
category: security
technology:
- java
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss
shortlink: https://sg.run/pxjN
semgrep.dev:
rule:
r_id: 9162
rv_id: 1263066
rule_id: wdUJOk
version_id: 2KTv2EG
url: https://semgrep.dev/playground/r/2KTv2EG/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss
origin: community
severity: ERROR
patterns:
- pattern-inside: $TYPE $FUNC(..., HttpServletResponse $RESP, ...) { ... }
- pattern-inside: $VAR = $REQ.getParameter(...); ...
- pattern-either:
- pattern: $RESP.getWriter(...).write(..., $VAR, ...);
- pattern: |
$WRITER = $RESP.getWriter(...);
...
$WRITER.write(..., $VAR, ...);
languages:
- java
- id: java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled
severity: ERROR
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf
category: security
technology:
- java
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled
shortlink: https://sg.run/2x75
semgrep.dev:
rule:
r_id: 9163
rv_id: 1263068
rule_id: x8Unkq
version_id: jQTn5Jv
url: https://semgrep.dev/playground/r/jQTn5Jv/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled
origin: community
message: XML external entities are enabled for this XMLInputFactory. This is vulnerable
to XML external entity attacks. Disable external entities by setting "javax.xml.stream.isSupportingExternalEntities"
to false.
patterns:
- pattern-either:
- pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty("javax.xml.stream.isSupportingExternalEntities",
true);
- pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES,
true);
- pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.SUPPORT_DTD,
true);
- pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty("javax.xml.stream.isSupportingExternalEntities",
Boolean.TRUE);
- pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES,
Boolean.TRUE);
- pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.SUPPORT_DTD,
Boolean.TRUE);
languages:
- java
- id: java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe
severity: WARNING
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf
- https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser
category: security
technology:
- java
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe
shortlink: https://sg.run/XBwA
semgrep.dev:
rule:
r_id: 9164
rv_id: 1263069
rule_id: OrU35O
version_id: 1QTypQZ
url: https://semgrep.dev/playground/r/1QTypQZ/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe
origin: community
message: XML external entities are not explicitly disabled for this XMLInputFactory.
This could be vulnerable to XML external entity vulnerabilities. Explicitly disable
external entities by setting "javax.xml.stream.isSupportingExternalEntities" to
false.
patterns:
- pattern-not-inside: |
$METHOD(...) {
...
$XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", false);
...
}
- pattern-not-inside: |
$METHOD(...) {
...
$XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
...
}
- pattern-not-inside: |
$METHOD(...) {
...
$XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", Boolean.FALSE);
...
}
- pattern-not-inside: |
$METHOD(...) {
...
$XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE);
...
}
- pattern-either:
- pattern: javax.xml.stream.XMLInputFactory.newFactory(...)
- pattern: new XMLInputFactory(...)
languages:
- java
- id: java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind
metadata:
cwe:
- 'CWE-287: Improper Authentication'
owasp:
- A02:2017 - Broken Authentication
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#LDAP_ANONYMOUS
category: security
technology:
- java
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind
shortlink: https://sg.run/jR6A
semgrep.dev:
rule:
r_id: 9165
rv_id: 1262988
rule_id: eqU8J3
version_id: QkTGqE0
url: https://semgrep.dev/playground/r/QkTGqE0/java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind
origin: community
message: Detected anonymous LDAP bind. This permits anonymous users to execute LDAP
statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html
for more information.
severity: WARNING
pattern: |
$ENV.put($CTX.SECURITY_AUTHENTICATION, "none");
...
$DCTX = new InitialDirContext($ENV, ...);
languages:
- java
- id: java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion
metadata:
cwe:
- 'CWE-704: Incorrect Type Conversion or Cast'
owasp: A03:2017 - Sensitive Data Exposure
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#BAD_HEXA_CONVERSION
category: security
technology:
- java
references:
- https://cwe.mitre.org/data/definitions/704.html
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion
shortlink: https://sg.run/1Z7D
semgrep.dev:
rule:
r_id: 9166
rv_id: 945646
rule_id: v8Uny0
version_id: QkTZzgy
url: https://semgrep.dev/playground/r/QkTZzgy/java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion
origin: community
message: '''Integer.toHexString()'' strips leading zeroes from each byte if read
byte-by-byte. This mistake weakens the hash value computed since it introduces
more collisions. Use ''String.format("%02X", ...)'' instead.'
severity: WARNING
languages:
- java
pattern: |-
$X $METHOD(...) {
...
MessageDigest $MD = ...;
...
$MD.digest(...);
...
Integer.toHexString(...);
}
- id: java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#BLOWFISH_KEY_SIZE
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.5 Insecure Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size
shortlink: https://sg.run/9o74
semgrep.dev:
rule:
r_id: 9167
rv_id: 1262989
rule_id: d8UjJ3
version_id: 3ZT4X2r
url: https://semgrep.dev/playground/r/3ZT4X2r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size
origin: community
message: Using less than 128 bits for Blowfish is considered insecure. Use 128 bits
or more, or switch to use AES instead.
severity: WARNING
languages:
- java
patterns:
- pattern: |
$KEYGEN = KeyGenerator.getInstance("Blowfish");
...
$KEYGEN.init($SIZE);
- metavariable-comparison:
metavariable: $SIZE
comparison: $SIZE < 128
- id: java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle
message: Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A
malicious actor could discern the difference between plaintext with valid or invalid
padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding'
instead.
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PADDING_ORACLE
references:
- https://capec.mitre.org/data/definitions/463.html
- https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes
- https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY
category: security
technology:
- java
subcategory:
- audit
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle
shortlink: https://sg.run/ydxr
semgrep.dev:
rule:
r_id: 9168
rv_id: 1262990
rule_id: ZqU5oD
version_id: 44TEjbE
url: https://semgrep.dev/playground/r/44TEjbE/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle
origin: community
severity: WARNING
fix: |
"AES/GCM/NoPadding"
languages:
- java
patterns:
- pattern-inside: Cipher.getInstance("=~/.*\/CBC\/PKCS5Padding/")
- pattern: |
"=~/.*\/CBC\/PKCS5Padding/"
- id: java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call
patterns:
- metavariable-pattern:
metavariable: $RUNTIME
patterns:
- pattern-either:
- pattern: (java.lang.Runtime $R)
- pattern: java.lang.Runtime.getRuntime(...)
- pattern-either:
- pattern: $RUNTIME.exec($X + $Y);
- pattern: $RUNTIME.exec(String.format(...));
- pattern: $RUNTIME.loadLibrary($X + $Y);
- pattern: $RUNTIME.loadLibrary(String.format(...));
- patterns:
- pattern-either:
- pattern: |
$RUNTIME.exec("=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $ARG,...)
- pattern: |
$RUNTIME.exec(Arrays.asList("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$ARG,...),...)
- pattern: |
$RUNTIME.exec(new String[]{"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$ARG,...},...)
- patterns:
- pattern-either:
- pattern: |
$RUNTIME.exec($CMD,"-c",$ARG,...)
- pattern: |
$RUNTIME.exec(Arrays.asList($CMD,"-c",$ARG,...),...)
- pattern: |
$RUNTIME.exec(new String[]{$CMD,"-c",$ARG,...},...)
- pattern-inside: |
$CMD = "=~/(sh|bash|ksh|csh|tcsh|zsh)/";
...
- patterns:
- pattern-either:
- pattern: |
$RUNTIME.exec($CMD, $EXECUTE, $ARG, ...)
- pattern-inside: |
$CMD = new String[]{"=~/(sh|bash|ksh|csh|tcsh|zsh)/", ...};
...
- patterns:
- pattern-either:
- pattern: |
$RUNTIME.exec("=~/(sh|bash|ksh|csh|tcsh|zsh)/", $BASH, $ARG,...)
- pattern: |
$RUNTIME.exec(Arrays.asList("=~/(sh|bash|ksh|csh|tcsh|zsh)/",$BASH,$ARG,...),...)
- pattern: |
$RUNTIME.exec(new String[]{"=~/(sh|bash|ksh|csh|tcsh|zsh)/",$BASH,$ARG,...},...)
- pattern-inside: |
$BASH = new String[]{"=~/(-c)/", ...};
...
- pattern-not-inside: |
$ARG = "...";
...
- pattern-not: |
$RUNTIME.exec("...","...","...",...)
- pattern-not: |
$RUNTIME.exec(new String[]{"...","...","...",...},...)
- pattern-not: |
$RUNTIME.exec(Arrays.asList("...","...","...",...),...)
message: A formatted or concatenated string was detected as input to a java.lang.Runtime
call. This is dangerous if a variable is controlled by user input and could result
in a command injection. Ensure your variables are not controlled by users or sufficiently
sanitized.
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#COMMAND_INJECTION.
category: security
technology:
- java
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call
shortlink: https://sg.run/rd90
semgrep.dev:
rule:
r_id: 9169
rv_id: 1262991
rule_id: nJUzvJ
version_id: PkTR3ez
url: https://semgrep.dev/playground/r/PkTR3ez/java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call
origin: community
severity: ERROR
languages:
- java
- id: java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly
metadata:
cwe:
- 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag'
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#HTTPONLY_COOKIE
asvs:
section: 'V3: Session Management Verification Requirements'
control_id: 3.4.2 Missing Cookie Attribute
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v34-cookie-based-session-management
version: '4'
category: security
technology:
- java
references:
- https://owasp.org/Top10/A05_2021-Security_Misconfiguration
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cookie Security
source: https://semgrep.dev/r/java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly
shortlink: https://sg.run/b7Be
semgrep.dev:
rule:
r_id: 9170
rv_id: 1262993
rule_id: EwU2z6
version_id: 5PTo17r
url: https://semgrep.dev/playground/r/5PTo17r/java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly
origin: community
message: A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly'
flag for cookies instructs the browser to forbid client-side scripts from reading
the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'
severity: WARNING
languages:
- java
patterns:
- pattern-not-inside: $COOKIE.setValue(""); ...
- pattern-either:
- pattern: $COOKIE.setHttpOnly(false);
- patterns:
- pattern-not-inside: $COOKIE.setHttpOnly(...); ...
- pattern-not-inside: $COOKIE = ResponseCookie.from(...). ...; ...
- pattern: $RESPONSE.addCookie($COOKIE);
- id: java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag
metadata:
cwe:
- 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute'
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#INSECURE_COOKIE
asvs:
section: 'V3: Session Management Verification Requirements'
control_id: 3.4.1 Missing Cookie Attribute
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v34-cookie-based-session-management
version: '4'
category: security
technology:
- java
references:
- https://owasp.org/Top10/A05_2021-Security_Misconfiguration
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cookie Security
source: https://semgrep.dev/r/java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag
shortlink: https://sg.run/kXoK
semgrep.dev:
rule:
r_id: 9172
rv_id: 1262994
rule_id: L1Uyvp
version_id: GxTkelB
url: https://semgrep.dev/playground/r/GxTkelB/java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag
origin: community
message: A cookie was detected without setting the 'secure' flag. The 'secure' flag
for cookies prevents the client from transmitting the cookie over insecure channels
such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'
severity: WARNING
languages:
- java
patterns:
- pattern-not-inside: $COOKIE.setValue(""); ...
- pattern-either:
- pattern: $COOKIE.setSecure(false);
- patterns:
- pattern-not-inside: $COOKIE.setSecure(...); ...
- pattern-not-inside: $COOKIE = ResponseCookie.from(...). ...; ...
- pattern: $RESPONSE.addCookie($COOKIE);
- id: java.lang.security.audit.crlf-injection-logs.crlf-injection-logs
message: When data from an untrusted source is put into a logger and not neutralized
correctly, an attacker could forge log entries or include malicious content.
metadata:
cwe:
- 'CWE-93: Improper Neutralization of CRLF Sequences (''CRLF Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#CRLF_INJECTION_LOGS
category: security
technology:
- java
references:
- https://owasp.org/Top10/A03_2021-Injection
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs
shortlink: https://sg.run/wek0
semgrep.dev:
rule:
r_id: 9173
rv_id: 1262995
rule_id: 8GUjwW
version_id: RGT0LEr
url: https://semgrep.dev/playground/r/RGT0LEr/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs
origin: community
severity: WARNING
languages:
- java
patterns:
- pattern-either:
- patterns:
- pattern-inside: |
class $CLASS {
...
Logger $LOG = ...;
...
}
- pattern-either:
- pattern-inside: |
$X $METHOD(...,HttpServletRequest $REQ,...) {
...
}
- pattern-inside: |
$X $METHOD(...,ServletRequest $REQ,...) {
...
}
- pattern-inside: |
$X $METHOD(...) {
...
HttpServletRequest $REQ = ...;
...
}
- pattern-inside: |
$X $METHOD(...) {
...
ServletRequest $REQ = ...;
...
}
- pattern-inside: |
$X $METHOD(...) {
...
Logger $LOG = ...;
...
HttpServletRequest $REQ = ...;
...
}
- pattern-inside: |
$X $METHOD(...) {
...
Logger $LOG = ...;
...
ServletRequest $REQ = ...;
...
}
- pattern-either:
- pattern: |
String $VAL = $REQ.getParameter(...);
...
$LOG.$LEVEL(<... $VAL ...>);
- pattern: |
String $VAL = $REQ.getParameter(...);
...
$LOG.log($LEVEL,<... $VAL ...>);
- pattern: |
$LOG.$LEVEL(<... $REQ.getParameter(...) ...>);
- pattern: |
$LOG.log($LEVEL,<... $REQ.getParameter(...) ...>);
- id: java.lang.security.audit.el-injection.el-injection
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#EL_INJECTION
category: security
technology:
- java
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/java.lang.security.audit.el-injection.el-injection
shortlink: https://sg.run/x1wp
semgrep.dev:
rule:
r_id: 9174
rv_id: 1263021
rule_id: gxU1Np
version_id: pZT03e1
url: https://semgrep.dev/playground/r/pZT03e1/java.lang.security.audit.el-injection.el-injection
origin: community
message: An expression is built with a dynamic value. The source of the value(s)
should be verified to avoid that unfiltered values fall into this risky code evaluation.
severity: WARNING
languages:
- java
patterns:
- pattern-either:
- pattern: |
class $CLASS {
...
ExpressionFactory $EF;
...
$X $METHOD(...) {
...
$EF.createValueExpression($CTX,$INPUT,...);
...
}
...
}
- pattern: |
class $CLASS {
...
ExpressionFactory $EF = ...;
...
$X $METHOD(...) {
...
$EF.createValueExpression($CTX,$INPUT,...);
...
}
...
}
- pattern: |
$X $METHOD(...) {
...
ExpressionFactory $EF = ...;
...
$EF.createValueExpression($CTX,$INPUT,...);
...
}
- pattern: |
$X $METHOD(...,ExpressionFactory $EF,...) {
...
$EF.createValueExpression($CTX,$INPUT,...);
...
}
- pattern: |
class $CLASS {
...
ExpressionFactory $EF;
...
$X $METHOD(...) {
...
$EF.createMethodExpression($CTX,$INPUT,...);
...
}
...
}
- pattern: |
class $CLASS {
...
ExpressionFactory $EF = ...;
...
$X $METHOD(...) {
...
$EF.createMethodExpression($CTX,$INPUT,...);
...
}
...
}
- pattern: |
$X $METHOD(...) {
...
ExpressionFactory $EF = ...;
...
$EF.createMethodExpression($CTX,$INPUT,...);
...
}
- pattern: |
$X $METHOD(...,ExpressionFactory $EF,...) {
...
$EF.createMethodExpression($CTX,$INPUT,...);
...
}
- pattern: |
$X $METHOD(String $INPUT, ...) {
...
$OBJECT.buildConstraintViolationWithTemplate($INPUT, ...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$EF.createValueExpression($CTX,"...",...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$EF.createValueExpression($CTX,$S,...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$EF.createMethodExpression($CTX,"...",...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$EF.createMethodExpression($CTX,$S,...);
...
}
- id: java.lang.security.audit.formatted-sql-string.formatted-sql-string
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SQL_INJECTION
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.5 Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
- https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps
- https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement
category: security
technology:
- java
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string
shortlink: https://sg.run/OPXp
semgrep.dev:
rule:
r_id: 9175
rv_id: 1409389
rule_id: QrUzxR
version_id: ExTeyBP
url: https://semgrep.dev/playground/r/ExTeyBP/java.lang.security.audit.formatted-sql-string.formatted-sql-string
origin: community
options:
taint_assume_safe_numbers: true
taint_assume_safe_booleans: true
message: Detected a formatted string in a SQL statement. This could lead to SQL
injection if variables in the SQL statement are not properly sanitized. Use a
prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement
using 'connection.prepareStatement'.
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
(HttpServletRequest $REQ)
- patterns:
- pattern-inside: |
$ANNOT $FUNC (..., $INPUT, ...) {
...
}
- pattern: (String $INPUT)
- focus-metavariable: $INPUT
label: INPUT
- patterns:
- pattern-either:
- pattern: $X + $INPUT
- pattern: $X += $INPUT
- pattern: String.format(..., $INPUT, ...)
- pattern: String.join(..., $INPUT, ...)
- pattern: (String $STR).concat($INPUT)
- pattern: $INPUT.concat(...)
- patterns:
- pattern-either:
- pattern: $STRB.append($INPUT)
- pattern: new $STRB(..., $INPUT, ...)
- metavariable-type:
metavariable: $STRB
type: StringBuilder
label: CONCAT
requires: INPUT
pattern-propagators:
- pattern: (StringBuffer $S).append($X)
from: $X
to: $S
- pattern: (StringBuilder $S).append($X)
from: $X
to: $S
pattern-sinks:
- patterns:
- pattern-not: $S.$SQLFUNC(<... "=~/.*TABLE *$/" ...>)
- pattern-not: $S.$SQLFUNC(<... "=~/.*TABLE %s$/" ...>)
- pattern-either:
- pattern: (Statement $S).$SQLFUNC(...)
- pattern: (PreparedStatement $P).$SQLFUNC(...)
- pattern: (Connection $C).createStatement(...).$SQLFUNC(...)
- pattern: (Connection $C).prepareStatement(...).$SQLFUNC(...)
- pattern: (EntityManager $EM).$SQLFUNC(...)
- metavariable-regex:
metavariable: $SQLFUNC
regex: execute|executeQuery|createQuery|query|addBatch|nativeSQL|create|prepare
requires: CONCAT
pattern-sanitizers:
- patterns:
- pattern: (CriteriaBuilder $CB).$ANY(...)
severity: ERROR
languages:
- java
- id: java.lang.security.audit.http-response-splitting.http-response-splitting
metadata:
cwe:
- 'CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (''HTTP
Request/Response Splitting'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#HTTP_RESPONSE_SPLITTING
references:
- https://www.owasp.org/index.php/HTTP_Response_Splitting
category: security
technology:
- java
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/java.lang.security.audit.http-response-splitting.http-response-splitting
shortlink: https://sg.run/eL0l
semgrep.dev:
rule:
r_id: 9176
rv_id: 1263023
rule_id: 3qUPyK
version_id: X0Tzykw
url: https://semgrep.dev/playground/r/X0Tzykw/java.lang.security.audit.http-response-splitting.http-response-splitting
origin: community
message: Older Java application servers are vulnerable to HTTP response splitting,
which may occur if an HTTP request can be injected with CRLF characters. This
finding is reported for completeness; it is recommended to ensure your environment
is not affected by testing this yourself.
severity: INFO
languages:
- java
pattern-either:
- pattern: |
$VAR = $REQ.getParameter(...);
...
$COOKIE = new Cookie(..., $VAR, ...);
...
$RESP.addCookie($COOKIE, ...);
- patterns:
- pattern-inside: |
$RETTYPE $FUNC(...,@PathVariable $TYPE $VAR, ...) {
...
}
- pattern: |
$COOKIE = new Cookie(..., $VAR, ...);
...
$RESP.addCookie($COOKIE, ...);
- id: java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection
metadata:
cwe:
- 'CWE-297: Improper Validation of Certificate with Host Mismatch'
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#INSECURE_SMTP_SSL
category: security
technology:
- java
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection
shortlink: https://sg.run/vzN4
semgrep.dev:
rule:
r_id: 9177
rv_id: 1263024
rule_id: 4bUkrW
version_id: jQTn5Dv
url: https://semgrep.dev/playground/r/jQTn5Dv/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection
origin: community
message: Insecure SMTP connection detected. This connection will trust any SSL certificate.
Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'.
severity: WARNING
patterns:
- pattern-not-inside: |
$EMAIL.setSSLCheckServerIdentity(true);
...
- pattern-inside: |
$EMAIL = new SimpleEmail(...);
...
- pattern: $EMAIL.send(...);
languages:
- java
- id: java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SQL_INJECTION_SPRING_JDBC
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.5 Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
category: security
technology:
- jdbc
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string
shortlink: https://sg.run/dKWY
semgrep.dev:
rule:
r_id: 9178
rv_id: 1263026
rule_id: PeUZNX
version_id: 9lT4bqk
url: https://semgrep.dev/playground/r/9lT4bqk/java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string
origin: community
message: 'Possible JDBC injection detected. Use the parameterized query feature
available in queryForObject instead of concatenating or formatting strings: ''jdbc.queryForObject("select
* from table where name = ?", Integer.class, parameterName);'''
patterns:
- pattern-inside: |
$JDBC = new JdbcTemplate(...);
...
- pattern-either:
- pattern: $JDBC.queryForObject($STR + $VAR, ...);
- pattern: $JDBC.queryForObject(String.format(...), ...);
- pattern: |
String $Q = $STR + $VAR;
...
$JDBC.queryForObject($Q, ...);
- pattern: |
String $Q = String.format(...);
...
$JDBC.queryForObject($Q, ...);
- pattern: |
StringBuilder $Q = new StringBuilder(...);
...
$Q.append($STR + $VAR);
...
$JDBC.queryForObject($Q, ...);
- pattern: $JDBC.queryForList($STR + $VAR);
- pattern: $JDBC.queryForList(String.format(...));
- pattern: |
String $Q = $STR + $VAR;
...
$JDBC.queryForList($Q);
- pattern: |
String $Q = String.format(...);
...
$JDBC.queryForList($Q);
- pattern: |
StringBuilder $Q = new StringBuilder(...);
...
$Q.append($STR + $VAR);
...
$JDBC.queryForList($Q, ...);
- pattern: $JDBC.update($STR + $VAR);
- pattern: $JDBC.update(String.format(...));
- pattern: |
String $Q = $STR + $VAR;
...
$JDBC.update($Q);
- pattern: |
String $Q = String.format(...);
...
$JDBC.update($Q);
- pattern: |
StringBuilder $Q = new StringBuilder(...);
...
$Q.append($STR + $VAR);
...
$JDBC.update($Q, ...);
- pattern: $JDBC.execute($STR + $VAR);
- pattern: $JDBC.execute(String.format(...));
- pattern: |
String $Q = $STR + $VAR;
...
$JDBC.execute($Q);
- pattern: |
String $Q = String.format(...);
...
$JDBC.execute($Q);
- pattern: |
StringBuilder $Q = new StringBuilder(...);
...
$Q.append($STR + $VAR);
...
$JDBC.execute($Q, ...);
- pattern: $JDBC.insert($STR + $VAR);
- pattern: $JDBC.insert(String.format(...));
- pattern: |
String $Q = $STR + $VAR;
...
$JDBC.insert($Q);
- pattern: |
String $Q = String.format(...);
...
$JDBC.insert($Q);
- pattern: |
StringBuilder $Q = new StringBuilder(...);
...
$Q.append($STR + $VAR);
...
$JDBC.insert($Q, ...);
severity: WARNING
languages:
- java
- id: java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (''LDAP
Injection'')'
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#LDAP_ENTRY_POISONING
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.7 Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
references:
- https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf
- https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html
category: security
technology:
- java
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- LDAP Injection
source: https://semgrep.dev/r/java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning
shortlink: https://sg.run/ZvOn
semgrep.dev:
rule:
r_id: 9179
rv_id: 1263027
rule_id: JDUy8B
version_id: yeTxpGP
url: https://semgrep.dev/playground/r/yeTxpGP/java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning
origin: community
message: An object-returning LDAP search will allow attackers to control the LDAP
response. This could lead to Remote Code Execution.
severity: WARNING
pattern-either:
- pattern: |
new SearchControls($S, $CL, $TL, $AT, true, $DEREF)
- pattern: |
SearchControls $VAR = new SearchControls();
...
$VAR.setReturningObjFlag(true);
languages:
- java
- id: java.lang.security.audit.ldap-injection.ldap-injection
message: Detected non-constant data passed into an LDAP query. If this data can
be controlled by an external user, this is an LDAP injection. Ensure data passed
to an LDAP query is not controllable; or properly sanitize the data.
metadata:
cwe:
- 'CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (''LDAP
Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#LDAP_INJECTION
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.7 Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
category: security
technology:
- java
references:
- https://owasp.org/Top10/A03_2021-Injection
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- LDAP Injection
source: https://semgrep.dev/r/java.lang.security.audit.ldap-injection.ldap-injection
shortlink: https://sg.run/nd2O
semgrep.dev:
rule:
r_id: 9180
rv_id: 1263028
rule_id: 5rUObQ
version_id: rxTAKl2
url: https://semgrep.dev/playground/r/rxTAKl2/java.lang.security.audit.ldap-injection.ldap-injection
origin: community
severity: WARNING
languages:
- java
patterns:
- pattern-either:
- pattern-inside: |
$X $METHOD(...) {
...
InitialDirContext $CTX = ...;
...
}
- pattern-inside: |
$X $METHOD(...) {
...
DirContext $CTX = ...;
...
}
- pattern-inside: |
$X $METHOD(...) {
...
InitialLdapContext $CTX = ...;
...
}
- pattern-inside: |
$X $METHOD(...) {
...
LdapContext $CTX = ...;
...
}
- pattern-inside: |
$X $METHOD(...) {
...
LdapCtx $CTX = ...;
...
}
- pattern-inside: |
$X $METHOD(...) {
...
EventDirContext $CTX = ...;
...
}
- pattern: |
$X $METHOD(...) {
...
$CTX.search($Y,$INPUT,...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$CTX.search($Y,"...",...);
...
}
- id: java.lang.security.audit.object-deserialization.object-deserialization
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#OBJECT_DESERIALIZATION
references:
- https://www.owasp.org/index.php/Deserialization_of_untrusted_data
- https://www.oracle.com/java/technologies/javase/seccodeguide.html#8
category: security
technology:
- java
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/java.lang.security.audit.object-deserialization.object-deserialization
shortlink: https://sg.run/Ek0A
semgrep.dev:
rule:
r_id: 9181
rv_id: 1263030
rule_id: GdU7py
version_id: NdTzyGe
url: https://semgrep.dev/playground/r/NdTzyGe/java.lang.security.audit.object-deserialization.object-deserialization
origin: community
message: Found object deserialization using ObjectInputStream. Deserializing entire
Java objects is dangerous because malicious actors can create Java object streams
with unintended consequences. Ensure that the objects being deserialized are not
user-controlled. If this must be done, consider using HMACs to sign the data stream
to make sure it is not tampered with, or consider only transmitting object fields
and populating a new object.
severity: WARNING
languages:
- java
pattern: new ObjectInputStream(...);
- id: java.lang.security.audit.ognl-injection.ognl-injection
message: A expression is built with a dynamic value. The source of the value(s)
should be verified to avoid that unfiltered values fall into this risky code evaluation.
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#OGNL_INJECTION
category: security
technology:
- ognl
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/java.lang.security.audit.ognl-injection.ognl-injection
shortlink: https://sg.run/7o7R
semgrep.dev:
rule:
r_id: 9182
rv_id: 1263031
rule_id: ReUgjJ
version_id: kbTzG3Y
url: https://semgrep.dev/playground/r/kbTzG3Y/java.lang.security.audit.ognl-injection.ognl-injection
origin: community
severity: WARNING
languages:
- java
patterns:
- pattern-either:
- pattern: |
$X $METHOD(...,OgnlReflectionProvider $P,...) {
...
$P.getGetMethod($T, $INPUT,...);
...
}
- pattern: |
$X $METHOD(...,OgnlReflectionProvider $P,...) {
...
$P.getSetMethod($T, $INPUT,...);
...
}
- pattern: |
$X $METHOD(...,OgnlReflectionProvider $P,...) {
...
$P.getField($T, $INPUT,...);
...
}
- pattern: |
$X $METHOD(...,OgnlReflectionProvider $P,...) {
...
$P.setProperties($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,OgnlReflectionProvider $P,...) {
...
$P.setProperty($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,OgnlReflectionProvider $P,...) {
...
$P.getValue($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,OgnlReflectionProvider $P,...) {
...
$P.setValue($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,ReflectionProvider $P,...) {
...
$P.getGetMethod($T, $INPUT,...);
...
}
- pattern: |
$X $METHOD(...,ReflectionProvider $P,...) {
...
$P.getSetMethod($T, $INPUT,...);
...
}
- pattern: |
$X $METHOD(...,ReflectionProvider $P,...) {
...
$P.getField($T, $INPUT,...);
...
}
- pattern: |
$X $METHOD(...,ReflectionProvider $P,...) {
...
$P.setProperties($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,ReflectionProvider $P,...) {
...
$P.setProperty($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,ReflectionProvider $P,...) {
...
$P.getValue($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,ReflectionProvider $P,...) {
...
$P.setValue($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,TextParseUtil $P,...) {
...
$P.translateVariables($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,TextParseUtil $P,...) {
...
$P.translateVariablesCollection($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,TextParseUtil $P,...) {
...
$P.shallBeIncluded($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,TextParseUtil $P,...) {
...
$P.commaDelimitedStringToSet($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,TextParser $P,...) {
...
$P.evaluate($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,OgnlTextParser $P,...) {
...
$P.evaluate($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,OgnlUtil $P,...) {
...
$P.setProperties($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,OgnlUtil $P,...) {
...
$P.setProperty($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,OgnlUtil $P,...) {
...
$P.getValue($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,OgnlUtil $P,...) {
...
$P.setValue($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,OgnlUtil $P,...) {
...
$P.callMethod($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,OgnlUtil $P,...) {
...
$P.compile($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,VelocityStrutsUtil $P,...) {
...
$P.evaluate($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,StrutsUtil $P,...) {
...
$P.isTrue($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,StrutsUtil $P,...) {
...
$P.findString($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,StrutsUtil $P,...) {
...
$P.findValue($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,StrutsUtil $P,...) {
...
$P.getText($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,StrutsUtil $P,...) {
...
$P.translateVariables($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,StrutsUtil $P,...) {
...
$P.makeSelectList($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,OgnlTool $P,...) {
...
$P.findValue($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,ValueStack $P,...) {
...
$P.findString($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,ValueStack $P,...) {
...
$P.findValue($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,ValueStack $P,...) {
...
$P.setValue($INPUT,...);
...
}
- pattern: |
$X $METHOD(...,ValueStack $P,...) {
...
$P.setParameter($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
OgnlReflectionProvider $P = ...;
...
$P.getGetMethod($T, $INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
OgnlReflectionProvider $P = ...;
...
$P.getSetMethod($T, $INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
OgnlReflectionProvider $P = ...;
...
$P.getField($T, $INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
OgnlReflectionProvider $P = ...;
...
$P.setProperties($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
OgnlReflectionProvider $P = ...;
...
$P.setProperty($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
OgnlReflectionProvider $P = ...;
...
$P.getValue($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
OgnlReflectionProvider $P = ...;
...
$P.setValue($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
ReflectionProvider $P = ...;
...
$P.getGetMethod($T, $INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
ReflectionProvider $P = ...;
...
$P.getSetMethod($T, $INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
ReflectionProvider $P = ...;
...
$P.getField($T, $INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
ReflectionProvider $P = ...;
...
$P.setProperties($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
ReflectionProvider $P = ...;
...
$P.setProperty($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
ReflectionProvider $P = ...;
...
$P.getValue($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
ReflectionProvider $P = ...;
...
$P.setValue($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
TextParseUtil $P = ...;
...
$P.translateVariables($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
TextParseUtil $P = ...;
...
$P.translateVariablesCollection($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
TextParseUtil $P = ...;
...
$P.shallBeIncluded($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
TextParseUtil $P = ...;
...
$P.commaDelimitedStringToSet($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
TextParser $P = ...;
...
$P.evaluate($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
OgnlTextParser $P = ...;
...
$P.evaluate($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
OgnlUtil $P = ...;
...
$P.setProperties($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
OgnlUtil $P = ...;
...
$P.setProperty($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
OgnlUtil $P = ...;
...
$P.getValue($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
OgnlUtil $P = ...;
...
$P.setValue($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
OgnlUtil $P = ...;
...
$P.callMethod($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
OgnlUtil $P = ...;
...
$P.compile($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
VelocityStrutsUtil $P = ...;
...
$P.evaluate($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
StrutsUtil $P = ...;
...
$P.isTrue($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
StrutsUtil $P = ...;
...
$P.findString($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
StrutsUtil $P = ...;
...
$P.findValue($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
StrutsUtil $P = ...;
...
$P.getText($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
StrutsUtil $P = ...;
...
$P.translateVariables($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
StrutsUtil $P = ...;
...
$P.makeSelectList($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
OgnlTool $P = ...;
...
$P.findValue($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
ValueStack $P = ...;
...
$P.findString($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
ValueStack $P = ...;
...
$P.findValue($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
ValueStack $P = ...;
...
$P.setValue($INPUT,...);
...
}
- pattern: |
$X $METHOD(...) {
...
ValueStack $P = ...;
...
$P.setParameter($INPUT,...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$P.getGetMethod($T,"...",...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$P.getSetMethod($T,"...",...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$P.getField($T,"...",...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$P.setProperties("...",...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$P.setProperty("...",...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$P.getValue("...",...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$P.setValue("...",...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$P.translateVariables("...",...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$P.translateVariablesCollection("...",...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$P.shallBeIncluded("...",...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$P.commaDelimitedStringToSet("...",...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$P.evaluate("...",...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$P.callMethod("...",...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$P.compile("...",...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$P.isTrue("...",...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$P.findString("...",...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$P.findValue("...",...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$P.getText("...",...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$P.makeSelectList("...",...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$P.setParameter("...",...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$P.getGetMethod($T,$S,...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$P.getSetMethod($T,$S,...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$P.getField($T,$S,...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$P.setProperties($S,...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$P.setProperty($S,...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$P.getValue($S,...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$P.setValue($S,...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$P.translateVariables($S,...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$P.translateVariablesCollection($S,...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$P.shallBeIncluded($S,...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$P.commaDelimitedStringToSet($S,...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$P.evaluate($S,...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$P.callMethod($S,...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$P.compile($S,...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$P.isTrue($S,...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$P.findString($S,...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$P.findValue($S,...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$P.getText($S,...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$P.makeSelectList($S,...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$P.setParameter($S,...);
...
}
- id: java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission
message: Detected file permissions that are overly permissive (read, write, and
execute). It is generally a bad practices to set overly permissive file permission
such as read+write+exec for all users. If the file affected is a configuration,
a binary, a script or sensitive data, it can lead to privilege escalation or information
leakage. Instead, follow the principle of least privilege and give users only
the permissions they need.
severity: WARNING
languages:
- java
metadata:
cwe:
- 'CWE-276: Incorrect Default Permissions'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#OVERLY_PERMISSIVE_FILE_PERMISSION
category: security
technology:
- java
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission
shortlink: https://sg.run/LwzJ
semgrep.dev:
rule:
r_id: 9183
rv_id: 1263032
rule_id: AbUzwB
version_id: w8TRoNn
url: https://semgrep.dev/playground/r/w8TRoNn/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission
origin: community
pattern-either:
- pattern: java.nio.file.Files.setPosixFilePermissions($FILE, java.nio.file.attribute.PosixFilePermissions.fromString("=~/(^......r..$)|(^.......w.$)|(^........x$)/"));
- pattern: |
$TYPE $P = java.nio.file.attribute.PosixFilePermissions.fromString("=~/(^......r..$)|(^.......w.$)|(^........x$)/");
...
java.nio.file.Files.setPosixFilePermissions($FILE, $P);
- pattern: |
$P.add(java.nio.file.attribute.PosixFilePermission.OTHERS_READ);
...
java.nio.file.Files.setPosixFilePermissions($FILE, $P);
- pattern: |
$P.add(java.nio.file.attribute.PosixFilePermission.OTHERS_WRITE);
...
java.nio.file.Files.setPosixFilePermissions($FILE, $P);
- pattern: |-
$P.add(java.nio.file.attribute.PosixFilePermission.OTHERS_EXECUTE);
...
java.nio.file.Files.setPosixFilePermissions($FILE, $P);
- id: java.lang.security.audit.permissive-cors.permissive-cors
message: https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS Permissive CORS
policy will allow a malicious application to communicate with the victim application
in an inappropriate way, leading to spoofing, data theft, relay and other attacks.
metadata:
cwe:
- 'CWE-183: Permissive List of Allowed Inputs'
asvs:
section: 'V14: Configuration Verification Requirements'
control_id: 14.4.8 Permissive CORS
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x22-V14-Config.md#v144-http-security-headers-requirements
version: '4'
category: security
technology:
- java
owasp:
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/java.lang.security.audit.permissive-cors.permissive-cors
shortlink: https://sg.run/8y77
semgrep.dev:
rule:
r_id: 9184
rv_id: 1263033
rule_id: BYUN66
version_id: xyTjz0p
url: https://semgrep.dev/playground/r/xyTjz0p/java.lang.security.audit.permissive-cors.permissive-cors
origin: community
severity: WARNING
languages:
- java
pattern-either:
- pattern: |
HttpServletResponse $RES = ...;
...
$RES.addHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
- pattern: |
HttpServletResponse $RES = ...;
...
$RES.setHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
- pattern: |
ServerHttpResponse $RES = ...;
...
$RES.getHeaders().add("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
- pattern: |
HttpHeaders $HEADERS = ...;
...
$HEADERS.set("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
- pattern: |
ServerWebExchange $SWE = ...;
...
$SWE.getResponse().getHeaders().add("Access-Control-Allow-Origin", "*");
- pattern: |
$X $METHOD(...,HttpServletResponse $RES,...) {
...
$RES.addHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
...
}
- pattern: |
$X $METHOD(...,HttpServletResponse $RES,...) {
...
$RES.setHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
...
}
- pattern: |
$X $METHOD(...,ServerHttpResponse $RES,...) {
...
$RES.getHeaders().add("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
...
}
- pattern: |
$X $METHOD(...,ServerWebExchange $SWE,...) {
...
$SWE.getResponse().getHeaders().add("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
...
}
- pattern: ResponseEntity.$RES().header("=~/access-control-allow-origin/i", "=~/^\*|null$/i")
- pattern: ServerResponse.$RES().header("=~/access-control-allow-origin/i", "=~/^\*|null$/i")
- id: java.lang.security.audit.script-engine-injection.script-engine-injection
message: Detected potential code injection using ScriptEngine. Ensure user-controlled
data cannot enter '.eval()', otherwise, this is a code injection vulnerability.
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SCRIPT_ENGINE_INJECTION
category: security
technology:
- java
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/java.lang.security.audit.script-engine-injection.script-engine-injection
shortlink: https://sg.run/gLqn
semgrep.dev:
rule:
r_id: 9185
rv_id: 1263034
rule_id: DbUpAr
version_id: O9TpxEp
url: https://semgrep.dev/playground/r/O9TpxEp/java.lang.security.audit.script-engine-injection.script-engine-injection
origin: community
severity: WARNING
languages:
- java
patterns:
- pattern-either:
- pattern-inside: |
class $CLASS {
...
ScriptEngine $SE;
...
}
- pattern-inside: |
class $CLASS {
...
ScriptEngine $SE = ...;
...
}
- pattern-inside: |
$X $METHOD(...) {
...
ScriptEngine $SE = ...;
...
}
- pattern: |
$X $METHOD(...) {
...
$SE.eval(...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$SE.eval("...");
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$SE.eval($S);
...
}
- id: java.lang.security.audit.unvalidated-redirect.unvalidated-redirect
message: Application redirects to a destination URL specified by a user-supplied
parameter that is not validated. This could direct users to malicious locations.
Consider using an allowlist to validate URLs.
metadata:
cwe:
- 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNVALIDATED_REDIRECT
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.1.5 Open Redirect
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation-requirements
version: '4'
category: security
technology:
- java
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
subcategory:
- vuln
impact: LOW
likelihood: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Open Redirect
source: https://semgrep.dev/r/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect
shortlink: https://sg.run/Q51P
semgrep.dev:
rule:
r_id: 9186
rv_id: 1263048
rule_id: WAUo0p
version_id: PkTR329
url: https://semgrep.dev/playground/r/PkTR329/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect
origin: community
severity: WARNING
languages:
- java
pattern-either:
- pattern: |
$X $METHOD(...,HttpServletResponse $RES,...,String $URL,...) {
...
$RES.sendRedirect($URL);
...
}
- pattern: |
$X $METHOD(...,String $URL,...,HttpServletResponse $RES,...) {
...
$RES.sendRedirect($URL);
...
}
- pattern: |
$X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) {
...
String $URL = $REQ.getParameter(...);
...
$RES.sendRedirect($URL);
...
}
- pattern: |
$X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) {
...
String $URL = $REQ.getParameter(...);
...
$RES.sendRedirect($URL);
...
}
- pattern: |
$X $METHOD(...,String $URL,...) {
...
HttpServletResponse $RES = ...;
...
$RES.sendRedirect($URL);
...
}
- pattern: |
$X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) {
...
$RES.sendRedirect($REQ.getParameter(...));
...
}
- pattern: |
$X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) {
...
$RES.sendRedirect($REQ.getParameter(...));
...
}
- pattern: |
$X $METHOD(...,HttpServletResponse $RES,...,String $URL,...) {
...
$RES.addHeader("Location",$URL);
...
}
- pattern: |
$X $METHOD(...,String $URL,...,HttpServletResponse $RES,...) {
...
$RES.addHeader("Location",$URL);
...
}
- pattern: |
$X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) {
...
String $URL = $REQ.getParameter(...);
...
$RES.addHeader("Location",$URL);
...
}
- pattern: |
$X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) {
...
String $URL = $REQ.getParameter(...);
...
$RES.addHeader("Location",$URL);
...
}
- pattern: |
$X $METHOD(...,String $URL,...) {
...
HttpServletResponse $RES = ...;
...
$RES.addHeader("Location",$URL);
...
}
- pattern: |
$X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) {
...
$RES.addHeader("Location",$REQ.getParameter(...));
...
}
- pattern: |-
$X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) {
...
$RES.addHeader("Location",$REQ.getParameter(...));
...
}
- id: java.lang.security.audit.url-rewriting.url-rewriting
message: URL rewriting has significant security risks. Since session ID appears
in the URL, it may be easily seen by third parties.
metadata:
cwe:
- 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#URL_REWRITING
category: security
technology:
- java
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/java.lang.security.audit.url-rewriting.url-rewriting
shortlink: https://sg.run/3x7b
semgrep.dev:
rule:
r_id: 9187
rv_id: 1263049
rule_id: 0oU5j3
version_id: JdTzxGb
url: https://semgrep.dev/playground/r/JdTzxGb/java.lang.security.audit.url-rewriting.url-rewriting
origin: community
severity: WARNING
languages:
- java
pattern-either:
- pattern: |
$X $METHOD(...,HttpServletResponse $RES,...) {
...
$RES.encodeURL(...);
...
}
- pattern: |
$X $METHOD(...,HttpServletResponse $RES,...) {
...
$RES.encodeUrl(...);
...
}
- pattern: |
$X $METHOD(...,HttpServletResponse $RES,...) {
...
$RES.encodeRedirectURL(...);
...
}
- pattern: |
$X $METHOD(...,HttpServletResponse $RES,...) {
...
$RES.encodeRedirectUrl(...);
...
}
- pattern: |
$X $METHOD(...) {
...
HttpServletResponse $RES = ...;
...
$RES.encodeURL(...);
...
}
- pattern: |
$X $METHOD(...) {
...
HttpServletResponse $RES = ...;
...
$RES.encodeUrl(...);
...
}
- pattern: |
$X $METHOD(...) {
...
HttpServletResponse $RES = ...;
...
$RES.encodeRedirectURL(...);
...
}
- pattern: |-
$X $METHOD(...) {
...
HttpServletResponse $RES = ...;
...
$RES.encodeRedirectUrl(...);
...
}
- id: java.lang.security.audit.weak-ssl-context.weak-ssl-context
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source_rule_url: https://find-sec-bugs.github.io/bugs.htm#SSL_CONTEXT
references:
- https://tools.ietf.org/html/rfc7568
- https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html
category: security
technology:
- java
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.weak-ssl-context.weak-ssl-context
shortlink: https://sg.run/4x7E
semgrep.dev:
rule:
r_id: 9188
rv_id: 1263050
rule_id: KxUb1k
version_id: 5PTo1rW
url: https://semgrep.dev/playground/r/5PTo1rW/java.lang.security.audit.weak-ssl-context.weak-ssl-context
origin: community
message: An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL
versions are considered weak encryption and are deprecated. Use SSLContext.getInstance("TLSv1.2")
for the best security.
severity: WARNING
languages:
- java
patterns:
- pattern-not: SSLContext.getInstance("TLSv1.3")
- pattern-not: SSLContext.getInstance("TLSv1.2")
- pattern: SSLContext.getInstance("...")
fix-regex:
regex: (.*?)\.getInstance\(.*?\)
replacement: \1.getInstance("TLSv1.2")
- id: java.lang.security.audit.xml-decoder.xml-decoder
message: XMLDecoder should not be used to parse untrusted data. Deserializing user
input can lead to arbitrary code execution. Use an alternative and explicitly
disable external entities. See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
for alternatives and vulnerability prevention.
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XML_DECODER
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
category: security
technology:
- java
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/java.lang.security.audit.xml-decoder.xml-decoder
shortlink: https://sg.run/PJjq
semgrep.dev:
rule:
r_id: 9189
rv_id: 1263051
rule_id: qNUj3y
version_id: GxTkeY1
url: https://semgrep.dev/playground/r/GxTkeY1/java.lang.security.audit.xml-decoder.xml-decoder
origin: community
severity: WARNING
languages:
- java
patterns:
- pattern: |
$X $METHOD(...) {
...
new XMLDecoder(...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
new XMLDecoder("...");
...
}
- pattern-not: |-
$X $METHOD(...) {
...
String $STR = "...";
...
new XMLDecoder($STR);
...
}
- id: java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure
metadata:
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XSS_REQUEST_WRAPPER
category: security
technology:
- java
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure
shortlink: https://sg.run/J96Q
semgrep.dev:
rule:
r_id: 9190
rv_id: 1263056
rule_id: lBU9Gj
version_id: WrTqKGK
url: https://semgrep.dev/playground/r/WrTqKGK/java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure
origin: community
message: It looks like you're using an implementation of XSSRequestWrapper from
dzone. (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html)
The XSS filtering in this code is not secure and can be bypassed by malicious
actors. It is recommended to use a stack that automatically escapes in your view
or templates instead of filtering yourself.
severity: WARNING
languages:
- java
pattern-either:
- pattern: |
class XSSRequestWrapper extends HttpServletRequestWrapper {
...
}
- pattern: |-
$P = $X.compile("</script>", $X.CASE_INSENSITIVE);
$V = $P.matcher(...).replaceAll("");
- id: java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated
message: DES is considered deprecated. AES is the recommended cipher. Upgrade to
use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard
for more information.
metadata:
functional-categories:
- crypto::search::symmetric-algorithm::javax.crypto
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#DES_USAGE
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.5 Insecure Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
references:
- https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard
- https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms
category: security
technology:
- java
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated
shortlink: https://sg.run/5Q73
semgrep.dev:
rule:
r_id: 9191
rv_id: 1262996
rule_id: PeUZNg
version_id: A8TgdEn
url: https://semgrep.dev/playground/r/A8TgdEn/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated
origin: community
severity: WARNING
patterns:
- pattern-either:
- pattern-inside: $CIPHER.getInstance("=~/DES/.*/")
- pattern-inside: $CIPHER.getInstance("DES")
- pattern-either:
- pattern: |
"=~/DES/.*/"
- pattern: |
"DES"
fix: |
"AES/GCM/NoPadding"
languages:
- java
- kt
- id: java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated
message: Triple DES (3DES or DESede) is considered deprecated. AES is the recommended
cipher. Upgrade to use AES.
metadata:
functional-categories:
- crypto::search::symmetric-algorithm::javax.crypto
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#TDES_USAGE
references:
- https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA
category: security
technology:
- java
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated
shortlink: https://sg.run/Geqn
semgrep.dev:
rule:
r_id: 9192
rv_id: 1262997
rule_id: JDUy8J
version_id: BjTkZyQ
url: https://semgrep.dev/playground/r/BjTkZyQ/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated
origin: community
severity: WARNING
patterns:
- pattern-either:
- pattern: |
$CIPHER.getInstance("=~/DESede.*/")
- pattern: |
$CRYPTO.KeyGenerator.getInstance("DES")
languages:
- java
- kt
- id: java.lang.security.audit.crypto.ecb-cipher.ecb-cipher
metadata:
functional-categories:
- crypto::search::mode::javax.crypto
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#ECB_MODE
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.ecb-cipher.ecb-cipher
shortlink: https://sg.run/Ro9K
semgrep.dev:
rule:
r_id: 9193
rv_id: 1262998
rule_id: 5rUOb6
version_id: DkTRbwL
url: https://semgrep.dev/playground/r/DkTRbwL/java.lang.security.audit.crypto.ecb-cipher.ecb-cipher
origin: community
message: Cipher in ECB mode is detected. ECB mode produces the same output for the
same input each time which allows an attacker to intercept and replay the data.
Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY.
severity: WARNING
languages:
- java
patterns:
- pattern: |
Cipher $VAR = $CIPHER.getInstance($MODE);
- metavariable-regex:
metavariable: $MODE
regex: .*ECB.*
- id: java.lang.security.audit.crypto.no-null-cipher.no-null-cipher
patterns:
- pattern-either:
- pattern: new NullCipher(...);
- pattern: new javax.crypto.NullCipher(...);
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#NULL_CIPHER
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.5 Insecure Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher
shortlink: https://sg.run/AvA4
semgrep.dev:
rule:
r_id: 9194
rv_id: 1263001
rule_id: GdU7pw
version_id: K3TKkgB
url: https://semgrep.dev/playground/r/K3TKkgB/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher
origin: community
message: 'NullCipher was detected. This will not encrypt anything; the cipher text
will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING").
See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for
more information.'
severity: WARNING
languages:
- java
- id: java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector
message: Initialization Vectors (IVs) for block ciphers should be randomly generated
each time they are used. Using a static IV means the same plaintext encrypts to
the same ciphertext every time, weakening the strength of the encryption.
metadata:
cwe:
- 'CWE-329: Generation of Predictable IV with CBC Mode'
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#STATIC_IV
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.5 Insecure Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
references:
- https://cwe.mitre.org/data/definitions/329.html
category: security
technology:
- java
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector
shortlink: https://sg.run/BkB5
semgrep.dev:
rule:
r_id: 9195
rv_id: 1263002
rule_id: ReUgj1
version_id: qkTR7vP
url: https://semgrep.dev/playground/r/qkTR7vP/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector
origin: community
severity: WARNING
languages:
- java
pattern-either:
- pattern: |
byte[] $IV = {
...
};
...
new IvParameterSpec($IV, ...);
- pattern: |
class $CLASS {
byte[] $IV = {
...
};
...
$METHOD(...) {
...
new IvParameterSpec($IV, ...);
...
}
}
- id: java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding
metadata:
functional-categories:
- crypto::search::mode::javax.crypto
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#RSA_NO_PADDING
references:
- https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.5 Insecure Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
category: security
technology:
- java
- kotlin
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding
shortlink: https://sg.run/DoOj
semgrep.dev:
rule:
r_id: 9196
rv_id: 1263003
rule_id: AbUzoj
version_id: l4TJRpK
url: https://semgrep.dev/playground/r/l4TJRpK/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding
origin: community
message: Using RSA without OAEP mode weakens the encryption.
severity: WARNING
languages:
- java
- kt
pattern: $CIPHER.getInstance("=~/RSA/[Nn][Oo][Nn][Ee]/NoPadding/")
- id: java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket
metadata:
functional-categories:
- net::search::crypto-config::java.net
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNENCRYPTED_SOCKET
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.5 Insecure Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket
shortlink: https://sg.run/W8zA
semgrep.dev:
rule:
r_id: 9197
rv_id: 1263008
rule_id: BYUN3X
version_id: RGT0LEj
url: https://semgrep.dev/playground/r/RGT0LEj/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket
origin: community
message: Detected use of a Java socket that is not encrypted. As a result, the traffic
could be read by an attacker intercepting the network traffic. Use an SSLSocket
created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead.
severity: WARNING
languages:
- java
pattern-either:
- pattern: new ServerSocket(...)
- pattern: new Socket(...)
- id: java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key
message: RSA keys should be at least 2048 bits based on NIST recommendation.
languages:
- java
severity: WARNING
metadata:
functional-categories:
- crypto::search::key-length::java.security
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#RSA_KEY_SIZE
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.5 Insecure Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms
category: security
technology:
- java
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key
shortlink: https://sg.run/4x6x
semgrep.dev:
rule:
r_id: 9200
rv_id: 1263019
rule_id: 0oU5P5
version_id: o5TbDLY
url: https://semgrep.dev/playground/r/o5TbDLY/java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key
origin: community
patterns:
- pattern: |
KeyPairGenerator $KEY = $G.getInstance("RSA");
...
$KEY.initialize($BITS);
- metavariable-comparison:
metavariable: $BITS
comparison: $BITS < 2048
- id: java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#CUSTOM_MESSAGE_DIGEST
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.2 Insecure Custom Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#custom-algorithms
category: security
technology:
- java
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests
shortlink: https://sg.run/PJ0p
semgrep.dev:
rule:
r_id: 9201
rv_id: 1263004
rule_id: KxUbW4
version_id: YDTZewB
url: https://semgrep.dev/playground/r/YDTZewB/java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests
origin: community
message: 'Cryptographic algorithms are notoriously difficult to get right. By implementing
a custom message digest, you risk introducing security issues into your program.
Use one of the many sound message digests already available to you: MessageDigest
sha256Digest = MessageDigest.getInstance("SHA256");'
severity: WARNING
languages:
- java
pattern: |-
class $CLASS extends MessageDigest {
...
}
- id: java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#DEFAULT_HTTP_CLIENT
asvs:
section: V9 Communications Verification Requirements
control_id: 9.1.3 Weak TLS
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v91-client-communications-security-requirements
version: '4'
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated
shortlink: https://sg.run/J9Gj
semgrep.dev:
rule:
r_id: 9202
rv_id: 1263005
rule_id: qNUj8b
version_id: JdTzxnb
url: https://semgrep.dev/playground/r/JdTzxnb/java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated
origin: community
message: DefaultHttpClient is deprecated. Further, it does not support connections
using TLS1.2, which makes using DefaultHttpClient a security hazard. Use HttpClientBuilder
instead.
severity: WARNING
languages:
- java
pattern: new DefaultHttpClient(...);
fix-regex:
regex: DefaultHttpClient
replacement: HttpClientBuilder
- id: java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier
message: Insecure HostnameVerifier implementation detected. This will accept any
SSL certificate with any hostname, which creates the possibility for man-in-the-middle
attacks.
metadata:
cwe:
- 'CWE-295: Improper Certificate Validation'
owasp:
- A03:2017 - Sensitive Data Exposure
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_HOSTNAME_VERIFIER
asvs:
section: V9 Communications Verification Requirements
control_id: 9.2.1 Weak TLS
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements
version: '4'
category: security
technology:
- java
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier
shortlink: https://sg.run/5QoD
semgrep.dev:
rule:
r_id: 9203
rv_id: 1263006
rule_id: lBU9n8
version_id: 5PTo17W
url: https://semgrep.dev/playground/r/5PTo17W/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier
origin: community
severity: WARNING
languages:
- java
pattern-either:
- pattern: |
class $CLASS implements HostnameVerifier {
...
public boolean verify(...) { return true; }
}
- pattern: |-
new HostnameVerifier(...){
public boolean verify(...) {
return true;
}
}
- pattern: import org.apache.http.conn.ssl.NoopHostnameVerifier;
- id: java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager
metadata:
cwe:
- 'CWE-295: Improper Certificate Validation'
owasp:
- A03:2017 - Sensitive Data Exposure
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_TRUST_MANAGER
asvs:
section: V9 Communications Verification Requirements
control_id: 9.2.1 Weak TLS
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements
version: '4'
references:
- https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https
category: security
technology:
- java
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager
shortlink: https://sg.run/GePy
semgrep.dev:
rule:
r_id: 9204
rv_id: 1263007
rule_id: YGUR9A
version_id: GxTkel1
url: https://semgrep.dev/playground/r/GxTkel1/java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager
origin: community
message: Detected empty trust manager implementations. This is dangerous because
it accepts any certificate, enabling man-in-the-middle attacks. Consider using
a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https
for more information.
severity: WARNING
languages:
- java
patterns:
- pattern-either:
- pattern-inside: |
class $CLASS implements X509TrustManager {
...
}
- pattern-inside: |
new X509TrustManager() {
...
}
- pattern-inside: |
class $CLASS implements X509ExtendedTrustManager {
...
}
- pattern-inside: |
new X509ExtendedTrustManager() {
...
}
- pattern-not: public void checkClientTrusted(...) { $SOMETHING; }
- pattern-not: public void checkServerTrusted(...) { $SOMETHING; }
- pattern-either:
- pattern: public void checkClientTrusted(...) {}
- pattern: public void checkServerTrusted(...) {}
- pattern: public X509Certificate[] getAcceptedIssuers(...) { return null; }
- id: java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli
pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
String $SQL = $X + $Y;
...
- pattern-inside: |
String $SQL = String.format(...);
...
- pattern-inside: |
$VAL $FUNC(...,String $SQL,...) {
...
}
- pattern-not-inside: |
String $SQL = "..." + "...";
...
- pattern: org.hibernate.criterion.Restrictions.sqlRestriction($SQL,...)
- pattern: org.hibernate.criterion.Restrictions.sqlRestriction(String.format(...),...)
- patterns:
- pattern: org.hibernate.criterion.Restrictions.sqlRestriction($X + $Y,...)
- pattern-not: org.hibernate.criterion.Restrictions.sqlRestriction("..." + "...",...)
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
String $SQL = $X + $Y;
...
- pattern-inside: |
String $SQL = String.format(...);
...
- pattern-inside: |
$TYPE $FUNC(...,String $SQL,...) {
...
}
- pattern-not-inside: |
String $SQL = "..." + "...";
...
- pattern: $SESSION.$METHOD($SQL,...)
- pattern: |
$SESSION.$METHOD(String.format(...),...);
- pattern: |
$SESSION.$METHOD($X + $Y,...);
- pattern-either:
- pattern-inside: |
org.hibernate.Session $SESSION = ...;
...
- pattern-inside: |
$TYPE $FUNC(...,org.hibernate.Session $SESSION,...) {
...
}
- pattern-not: |
$SESSION.$METHOD("..." + "...",...);
- metavariable-regex:
metavariable: $METHOD
regex: ^(createQuery|createSQLQuery)$
message: Detected a formatted string in a SQL statement. This could lead to SQL
injection if variables in the SQL statement are not properly sanitized. Use a
prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement
using 'connection.prepareStatement'.
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SQL_INJECTION_HIBERNATE
asvs:
section: V5 Stored Cryptography Verification Requirements
control_id: 5.3.5 Insecure Custom Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
category: security
technology:
- hibernate
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli
shortlink: https://sg.run/Roqg
semgrep.dev:
rule:
r_id: 9205
rv_id: 1263035
rule_id: 6JUjPD
version_id: e1Tyjbe
url: https://semgrep.dev/playground/r/e1Tyjbe/java.lang.security.audit.sqli.hibernate-sqli.hibernate-sqli
origin: community
languages:
- java
severity: WARNING
- id: java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli
message: Detected a formatted string in a SQL statement. This could lead to SQL
injection if variables in the SQL statement are not properly sanitized. Use a
prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement
using 'connection.prepareStatement'.
languages:
- java
severity: WARNING
patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
String $SQL = $X + $Y;
...
- pattern-inside: |
String $SQL = String.format(...);
...
- pattern-inside: |
$VAL $FUNC(...,String $SQL,...) {
...
}
- pattern-not-inside: |
String $SQL = "..." + "...";
...
- pattern: $S.$METHOD($SQL,...)
- pattern: |
$S.$METHOD(String.format(...),...);
- pattern: |
$S.$METHOD($X + $Y,...);
- pattern-either:
- pattern-inside: |
java.sql.Statement $S = ...;
...
- pattern-inside: |
$TYPE $FUNC(...,java.sql.Statement $S,...) {
...
}
- pattern-not: |
$S.$METHOD("..." + "...",...);
- metavariable-regex:
metavariable: $METHOD
regex: ^(executeQuery|execute|executeUpdate|executeLargeUpdate|addBatch|nativeSQL)$
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
category: security
technology:
- jdbc
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli
shortlink: https://sg.run/AvkL
semgrep.dev:
rule:
r_id: 9206
rv_id: 1263036
rule_id: oqUe8K
version_id: vdT06oL
url: https://semgrep.dev/playground/r/vdT06oL/java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli
origin: community
- id: java.lang.security.audit.sqli.jdo-sqli.jdo-sqli
pattern-either:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
String $SQL = $X + $Y;
...
- pattern-inside: |
String $SQL = String.format(...);
...
- pattern-inside: |
$TYPE $FUNC(...,String $SQL,...) {
...
}
- pattern-not-inside: |
String $SQL = "..." + "...";
...
- pattern: $Q.$METHOD($SQL,...)
- pattern: |
$Q.$METHOD(String.format(...),...);
- pattern: |
$Q.$METHOD($X + $Y,...);
- pattern-either:
- pattern-inside: |
javax.jdo.Query $Q = ...;
...
- pattern-inside: |
$TYPE $FUNC(...,javax.jdo.Query $Q,...) {
...
}
- pattern-not: |
$Q.$METHOD("..." + "...",...);
- metavariable-regex:
metavariable: $METHOD
regex: ^(setFilter|setGrouping)$
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
String $SQL = $X + $Y;
...
- pattern-inside: |
String $SQL = String.format(...);
...
- pattern-inside: |
$VAL $FUNC(...,String $SQL,...) {
...
}
- pattern-not-inside: |
String $SQL = "..." + "...";
...
- pattern: $PM.newQuery(...,$SQL,...)
- pattern: |
$PM.newQuery(...,String.format(...),...);
- pattern: |
$PM.newQuery(...,$X + $Y,...);
- pattern-either:
- pattern-inside: |
javax.jdo.PersistenceManager $PM = ...;
...
- pattern-inside: |
$TYPE $FUNC(...,javax.jdo.PersistenceManager $PM,...) {
...
}
- pattern-not: |
$PM.newQuery(...,"..." + "...",...);
message: Detected a formatted string in a SQL statement. This could lead to SQL
injection if variables in the SQL statement are not properly sanitized. Use a
prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement
using 'connection.prepareStatement'.
languages:
- java
severity: WARNING
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
category: security
technology:
- java
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/java.lang.security.audit.sqli.jdo-sqli.jdo-sqli
shortlink: https://sg.run/Bkwx
semgrep.dev:
rule:
r_id: 9207
rv_id: 1263037
rule_id: zdUk7l
version_id: d6Tyx77
url: https://semgrep.dev/playground/r/d6Tyx77/java.lang.security.audit.sqli.jdo-sqli.jdo-sqli
origin: community
- id: java.lang.security.audit.sqli.jpa-sqli.jpa-sqli
message: Detected a formatted string in a SQL statement. This could lead to SQL
injection if variables in the SQL statement are not properly sanitized. Use a
prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement
using 'connection.prepareStatement'.
languages:
- java
severity: WARNING
patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
String $SQL = $X + $Y;
...
- pattern-inside: |
String $SQL = String.format(...);
...
- pattern-inside: |
$TYPE $FUNC(...,String $SQL,...) {
...
}
- pattern-not-inside: |
String $SQL = "..." + "...";
...
- pattern: $EM.$METHOD($SQL,...)
- pattern: |
$EM.$METHOD(String.format(...),...);
- pattern: |
$EM.$METHOD($X + $Y,...);
- pattern-either:
- pattern-inside: |
EntityManager $EM = ...;
...
- pattern-inside: |
$TYPE $FUNC(...,EntityManager $EM,...) {
...
}
- pattern-not: |
$EM.$METHOD("..." + "...",...);
- metavariable-regex:
metavariable: $METHOD
regex: ^(createQuery|createNativeQuery)$
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
category: security
technology:
- jpa
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/java.lang.security.audit.sqli.jpa-sqli.jpa-sqli
shortlink: https://sg.run/DoOd
semgrep.dev:
rule:
r_id: 9208
rv_id: 1263038
rule_id: pKUO7y
version_id: ZRTKAxW
url: https://semgrep.dev/playground/r/ZRTKAxW/java.lang.security.audit.sqli.jpa-sqli.jpa-sqli
origin: community
- id: java.lang.security.audit.sqli.turbine-sqli.turbine-sqli
pattern-either:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
String $SQL = $X + $Y;
...
- pattern-inside: |
String $SQL = String.format(...);
...
- pattern-inside: |
$VAL $FUNC(...,String $SQL,...) {
...
}
- pattern-not-inside: |
String $SQL = "..." + "...";
...
- pattern: $PEER.executeQuery($SQL,...)
- pattern: |
$PEER.executeQuery(String.format(...),...)
- pattern: |
$PEER.executeQuery($X + $Y,...)
- pattern-not: |
$PEER.executeQuery("..." + "...",...)
- metavariable-regex:
metavariable: $PEER
regex: (BasePeer|GroupPeer)
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
String $SQL = $X + $Y;
...
- pattern-inside: |
String $SQL = String.format(...);
...
- pattern-inside: |
$VAL $FUNC(...,String $SQL,...) {
...
}
- pattern-not-inside: |
String $SQL = "..." + "...";
...
- pattern: $P.executeQuery($SQL,...)
- pattern: |
$P.executeQuery(String.format(...),...)
- pattern: |
$P.executeQuery($X + $Y,...)
- pattern-either:
- pattern-inside: |
BasePeer $P = ...;
...
- pattern-inside: |
GroupPeer $P = ...;
...
- pattern-inside: |
$VAL $FUNC(...,GroupPeer $P,...) {
...
}
- pattern-inside: |
$VAL $FUNC(...,BasePeer $P,...) {
...
}
- pattern-not: |
$P.executeQuery("..." + "...",...)
message: Detected a formatted string in a SQL statement. This could lead to SQL
injection if variables in the SQL statement are not properly sanitized. Use a
prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement
using 'connection.prepareStatement'.
languages:
- java
severity: WARNING
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
category: security
technology:
- turbine
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/java.lang.security.audit.sqli.turbine-sqli.turbine-sqli
shortlink: https://sg.run/W8zL
semgrep.dev:
rule:
r_id: 9209
rv_id: 1263040
rule_id: 2ZUbJ3
version_id: ExTExvY
url: https://semgrep.dev/playground/r/ExTExvY/java.lang.security.audit.sqli.turbine-sqli.turbine-sqli
origin: community
- id: java.lang.security.audit.sqli.vertx-sqli.vertx-sqli
message: Detected a formatted string in a SQL statement. This could lead to SQL
injection if variables in the SQL statement are not properly sanitized. Use a
prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement
using 'connection.prepareStatement'.
languages:
- java
severity: WARNING
patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
String $SQL = $X + $Y;
...
- pattern-inside: |
String $SQL = String.format(...);
...
- pattern-inside: |
$TYPE $FUNC(...,String $SQL,...) {
...
}
- pattern-not-inside: |
String $SQL = "..." + "...";
...
- pattern: $SC.$METHOD($SQL,...)
- pattern: |
$SC.$METHOD(String.format(...),...);
- pattern: |
$SC.$METHOD($X + $Y,...);
- pattern-either:
- pattern-inside: |
SqlClient $SC = ...;
...
- pattern-inside: |
SqlConnection $SC = ...;
...
- pattern-inside: |
$TYPE $FUNC(...,SqlClient $SC,...) {
...
}
- pattern-inside: |
$TYPE $FUNC(...,SqlConnection $SC,...) {
...
}
- pattern-not: |
$SC.$METHOD("..." + "...",...);
- metavariable-regex:
metavariable: $METHOD
regex: ^(query|preparedQuery|prepare)$
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
category: security
technology:
- vertx
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/java.lang.security.audit.sqli.vertx-sqli.vertx-sqli
shortlink: https://sg.run/0QKB
semgrep.dev:
rule:
r_id: 9210
rv_id: 1263041
rule_id: X5U86z
version_id: 7ZTE3Z5
url: https://semgrep.dev/playground/r/7ZTE3Z5/java.lang.security.audit.sqli.vertx-sqli.vertx-sqli
origin: community
- id: java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer
message: Detected a request with potential user-input going into a OutputStream
or Writer object. This bypasses any view or template environments, including HTML
escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities.
Consider using a view technology such as JavaServer Faces (JSFs) which automatically
escapes HTML views.
severity: WARNING
options:
interfile: true
metadata:
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
category: security
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
cwe2021-top25: true
cwe2022-top25: true
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html
subcategory:
- vuln
technology:
- java
- servlets
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer
shortlink: https://sg.run/KlRL
semgrep.dev:
rule:
r_id: 9211
rv_id: 1263055
rule_id: j2Uv7B
version_id: DkTRbXy
url: https://semgrep.dev/playground/r/DkTRbXy/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer
origin: community
languages:
- java
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
(HttpServletRequest $REQ).$REQFUNC(...)
- pattern: "(ServletRequest $REQ).$REQFUNC(...) \n"
- metavariable-regex:
metavariable: $REQFUNC
regex: (getInputStream|getParameter|getParameterMap|getParameterValues|getReader|getCookies|getHeader|getHeaderNames|getHeaders|getPart|getParts|getQueryString)
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
(HttpServletResponse $RESPONSE).getWriter(...).$WRITE(...)
- pattern: |
(HttpServletResponse $RESPONSE).getOutputStream(...).$WRITE(...)
- pattern: |
(java.io.PrintWriter $WRITER).$WRITE(...)
- pattern: |
(PrintWriter $WRITER).$WRITE(...)
- pattern: |
(javax.servlet.ServletOutputStream $WRITER).$WRITE(...)
- pattern: |
(ServletOutputStream $WRITER).$WRITE(...)
- pattern: |
(java.io.OutputStream $WRITER).$WRITE(...)
- pattern: |
(OutputStream $WRITER).$WRITE(...)
pattern-sanitizers:
- pattern-either:
- pattern: Encode.forHtml(...)
- pattern: (PolicyFactory $POLICY).sanitize(...)
- pattern: (AntiSamy $AS).scan(...)
- pattern: JSoup.clean(...)
- pattern: org.apache.commons.lang.StringEscapeUtils.escapeHtml(...)
- pattern: org.springframework.web.util.HtmlUtils.htmlEscape(...)
- pattern: org.owasp.esapi.ESAPI.encoder().encodeForHTML(...)
- id: java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled
message: Detected an element with disabled HTML escaping. If external data can reach
this, this is a cross-site scripting (XSS) vulnerability. Ensure no external data
can reach here, or remove 'escape=false' from this element.
metadata:
owasp: A07:2017 - Cross-Site Scripting (XSS)
cwe:
- 'CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences'
references:
- https://stackoverflow.com/a/7442668
category: security
technology:
- jsf
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled
shortlink: https://sg.run/qxne
semgrep.dev:
rule:
r_id: 9212
rv_id: 945709
rule_id: 10UKqE
version_id: GxTP74Y
url: https://semgrep.dev/playground/r/GxTP74Y/java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled
origin: community
pattern-regex: .*escape.*?=.*?false.*
paths:
include:
- '*.html'
- '*.xhtml'
languages:
- regex
severity: WARNING
- id: java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization
severity: WARNING
languages:
- java
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
references:
- https://mogwailabs.de/blog/2019/03/attacking-java-rmi-services-after-jep-290/
category: security
technology:
- rmi
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization
shortlink: https://sg.run/oxg6
semgrep.dev:
rule:
r_id: 9216
rv_id: 1263071
rule_id: bwUwj4
version_id: yeTxpeP
url: https://semgrep.dev/playground/r/yeTxpeP/java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization
origin: community
message: Using a non-primitive class with Java RMI may be an insecure deserialization
vulnerability. Depending on the underlying implementation. This object could be
manipulated by a malicious actor allowing them to execute code on your system.
Instead, use an integer ID to look up your object, or consider alternative serialization
schemes such as JSON.
patterns:
- pattern: |
interface $INTERFACE extends Remote {
$RETURNTYPE $METHOD($CLASS $PARAM) throws RemoteException;
}
- metavariable-regex:
metavariable: $CLASS
regex: (?!int|boolean|short|long|byte|char|float|double)
- id: java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization
severity: ERROR
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
references:
- https://frohoff.github.io/appseccali-marshalling-pickles/
- https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi
- https://youtu.be/t_aw1mDNhzI
- https://github.com/qtc-de/remote-method-guesser
- https://github.com/openjdk/jdk/blob/master/src/java.rmi/share/classes/sun/rmi/server/UnicastRef.java#L303C4-L331
category: security
technology:
- rmi
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization
shortlink: https://sg.run/zvnl
semgrep.dev:
rule:
r_id: 9217
rv_id: 1263072
rule_id: NbUkw5
version_id: rxTAKN2
url: https://semgrep.dev/playground/r/rxTAKN2/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization
origin: community
message: Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure
deserialization vulnerability. This object can be manipulated by a malicious actor
allowing them to execute code on your system. Instead, use an integer ID to look
up your object, or consider alternative serialization schemes such as JSON.
languages:
- java
patterns:
- pattern: |
interface $INTERFACE extends Remote {
$RETURNTYPE $METHOD($PARAMTYPE $PARAM) throws RemoteException;
}
- metavariable-pattern:
metavariable: $PARAMTYPE
language: generic
patterns:
- pattern-not: String
- pattern-not: java.lang.String
- pattern-not: boolean
- pattern-not: Boolean
- pattern-not: java.lang.Boolean
- pattern-not: byte
- pattern-not: Byte
- pattern-not: java.lang.Byte
- pattern-not: char
- pattern-not: Character
- pattern-not: java.lang.Character
- pattern-not: double
- pattern-not: Double
- pattern-not: java.lang.Double
- pattern-not: float
- pattern-not: Float
- pattern-not: java.lang.Float
- pattern-not: int
- pattern-not: Integer
- pattern-not: java.lang.Integer
- pattern-not: long
- pattern-not: Long
- pattern-not: java.lang.Long
- pattern-not: short
- pattern-not: Short
- pattern-not: java.lang.Short
- id: java.servlets.security.cookie-issecure-false.cookie-issecure-false
patterns:
- pattern: $COOKIE = new Cookie($...ARGS);
- pattern-not-inside: |
$COOKIE = new Cookie(...);
...
$COOKIE.setSecure(...);
message: 'Default session middleware settings: `setSecure` not set to true. This
ensures that the cookie is sent only over HTTPS to prevent cross-site scripting
attacks.'
fix: |
$COOKIE = new Cookie($...ARGS);
$COOKIE.setSecure(true);
metadata:
vulnerability: Insecure Transport
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
references:
- https://docs.oracle.com/javaee/6/api/javax/servlet/http/Cookie.html#setSecure(boolean)
- https://owasp.org/www-community/controls/SecureCookieAttribute
category: security
technology:
- java
- cookie
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/java.servlets.security.cookie-issecure-false.cookie-issecure-false
shortlink: https://sg.run/pxn0
semgrep.dev:
rule:
r_id: 9218
rv_id: 1263073
rule_id: kxUkn9
version_id: bZT53lB
url: https://semgrep.dev/playground/r/bZT53lB/java.servlets.security.cookie-issecure-false.cookie-issecure-false
origin: community
languages:
- java
severity: WARNING
- id: java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping
patterns:
- pattern-inside: |
@RequestMapping(...)
$RETURNTYPE $METHOD(...) { ... }
- pattern-not-inside: |
@RequestMapping(..., method = $X, ...)
$RETURNTYPE $METHOD(...) { ... }
- pattern: |
RequestMapping
message: Detected a method annotated with 'RequestMapping' that does not specify
the HTTP method. CSRF protections are not enabled for GET, HEAD, TRACE, or OPTIONS,
and by default all HTTP methods are allowed when the HTTP method is not explicitly
specified. This means that a method that performs state changes could be vulnerable
to CSRF attacks. To mitigate, add the 'method' field and specify the HTTP method
(such as 'RequestMethod.POST').
severity: WARNING
metadata:
cwe:
- 'CWE-352: Cross-Site Request Forgery (CSRF)'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING
references:
- https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING
category: security
technology:
- spring
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site Request Forgery (CSRF)
source: https://semgrep.dev/r/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping
shortlink: https://sg.run/2xlq
semgrep.dev:
rule:
r_id: 9219
rv_id: 1263089
rule_id: wdUJ7q
version_id: QkTGq2l
url: https://semgrep.dev/playground/r/QkTGq2l/java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping
origin: community
languages:
- java
- id: java.spring.security.audit.spel-injection.spel-injection
message: A Spring expression is built with a dynamic value. The source of the value(s)
should be verified to avoid that unfiltered values fall into this risky code evaluation.
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SPEL_INJECTION
category: security
technology:
- spring
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/java.spring.security.audit.spel-injection.spel-injection
shortlink: https://sg.run/XBp4
semgrep.dev:
rule:
r_id: 9220
rv_id: 1263075
rule_id: x8Un7b
version_id: kbTzG5Y
url: https://semgrep.dev/playground/r/kbTzG5Y/java.spring.security.audit.spel-injection.spel-injection
origin: community
severity: WARNING
languages:
- java
patterns:
- pattern-either:
- pattern-inside: |
class $CLASS {
...
ExpressionParser $PARSER;
...
}
- pattern-inside: |
class $CLASS {
...
ExpressionParser $PARSER = ...;
...
}
- pattern-inside: |
$X $METHOD(...) {
...
ExpressionParser $PARSER = ...;
...
}
- pattern-inside: |
class $CLASS {
...
SpelExpressionParser $PARSER;
...
}
- pattern-inside: |
class $CLASS {
...
SpelExpressionParser $PARSER = ...;
...
}
- pattern-inside: |
$X $METHOD(...) {
...
SpelExpressionParser $PARSER = ...;
...
}
- pattern-inside: |
class $CLASS {
...
TemplateAwareExpressionParser $PARSER;
...
}
- pattern-inside: |
class $CLASS {
...
TemplateAwareExpressionParser $PARSER = ...;
...
}
- pattern-inside: |
$X $METHOD(...) {
...
TemplateAwareExpressionParser $PARSER = ...;
...
}
- pattern: |
$X $METHOD(...) {
...
$PARSER.parseExpression(...);
...
}
- pattern-not: |
$X $METHOD(...) {
...
$PARSER.parseExpression("...");
...
}
- pattern-not: |
$X $METHOD(...) {
...
String $S = "...";
...
$PARSER.parseExpression($S);
...
}
- id: java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled
message: CSRF protection is disabled for this configuration. This is a security
risk.
metadata:
cwe:
- 'CWE-352: Cross-Site Request Forgery (CSRF)'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_PROTECTION_DISABLED
asvs:
section: V4 Access Control
control_id: 4.2.2 CSRF
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V4-Access-Control.md#v42-operation-level-access-control
version: '4'
category: security
technology:
- spring
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site Request Forgery (CSRF)
source: https://semgrep.dev/r/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled
shortlink: https://sg.run/jRnl
semgrep.dev:
rule:
r_id: 9221
rv_id: 1263080
rule_id: OrU3gK
version_id: vdT06dL
url: https://semgrep.dev/playground/r/vdT06dL/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled
origin: community
severity: WARNING
languages:
- java
pattern: $OBJ.csrf(...).disable(...)
- id: java.spring.security.audit.spring-sqli.spring-sqli
mode: taint
pattern-sources:
- patterns:
- pattern: $ARG
- pattern-inside: |
public $T $M (..., String $ARG,...){...}
pattern-sanitizers:
- not_conflicting: true
pattern-either:
- patterns:
- focus-metavariable: $A
- pattern-inside: |
new $TYPE(...,$A,...);
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- focus-metavariable: $A
- pattern: |
new PreparedStatementCreatorFactory($A,...);
- patterns:
- focus-metavariable: $A
- pattern: |
(JdbcTemplate $T).$M($A,...)
- patterns:
- pattern: (String $A)
- pattern-inside: |
(JdbcTemplate $T).batchUpdate(...)
- patterns:
- focus-metavariable: $A
- pattern: |
NamedParameterBatchUpdateUtils.$M($A,...)
- patterns:
- focus-metavariable: $A
- pattern: |
BatchUpdateUtils.$M($A,...)
message: Detected a string argument from a public method contract in a raw SQL statement.
This could lead to SQL injection if variables in the SQL statement are not properly
sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You
can obtain a PreparedStatement using 'connection.prepareStatement'.
languages:
- java
severity: WARNING
options:
taint_assume_safe_numbers: true
taint_assume_safe_booleans: true
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
category: security
technology:
- spring
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/java.spring.security.audit.spring-sqli.spring-sqli
shortlink: https://sg.run/1Z3x
semgrep.dev:
rule:
r_id: 9222
rv_id: 1263082
rule_id: eqU8N2
version_id: ZRTKAWW
url: https://semgrep.dev/playground/r/ZRTKAWW/java.spring.security.audit.spring-sqli.spring-sqli
origin: community
- id: java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect
message: Application redirects a user to a destination URL specified by a user supplied
parameter that is not validated.
metadata:
cwe:
- 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNVALIDATED_REDIRECT
category: security
technology:
- spring
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Open Redirect
source: https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect
shortlink: https://sg.run/9oXz
semgrep.dev:
rule:
r_id: 9223
rv_id: 1263083
rule_id: v8Un7w
version_id: nWT2Lk0
url: https://semgrep.dev/playground/r/nWT2Lk0/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect
origin: community
severity: WARNING
languages:
- java
pattern-either:
- pattern: |
$X $METHOD(...,String $URL,...) {
return "redirect:" + $URL;
}
- pattern: |
$X $METHOD(...,String $URL,...) {
...
String $REDIR = "redirect:" + $URL;
...
return $REDIR;
...
}
- pattern: |
$X $METHOD(...,String $URL,...) {
...
new ModelAndView("redirect:" + $URL);
...
}
- pattern: |-
$X $METHOD(...,String $URL,...) {
...
String $REDIR = "redirect:" + $URL;
...
new ModelAndView($REDIR);
...
}
- id: javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods
message: Use of angular.element can lead to XSS if user-input is treated as part
of the HTML element within `$SINK`. It is recommended to contextually output encode
user-input, before inserting into `$SINK`. If the HTML needs to be preserved it
is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize.
metadata:
confidence: LOW
references:
- https://docs.angularjs.org/api/ng/function/angular.element
- https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
category: security
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
technology:
- angularjs
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods
shortlink: https://sg.run/ydnO
semgrep.dev:
rule:
r_id: 9224
rv_id: 1263090
rule_id: d8Ujdo
version_id: 3ZT4Xbz
url: https://semgrep.dev/playground/r/3ZT4Xbz/javascript.angular.security.detect-angular-element-methods.detect-angular-element-methods
origin: community
languages:
- javascript
- typescript
severity: INFO
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern-inside: |
function(..., $SCOPE, ...) { ... }
- focus-metavariable: $SCOPE
- metavariable-regex:
metavariable: $SCOPE
regex: ^\$scope$
- pattern: $rootScope
- pattern: $injector.get('$rootScope')
- pattern: $injector.get('$scope')
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
angular.element(...). ... .$SINK($QUERY)
- pattern-inside: |
$ANGULAR = angular.element(...)
...
$ANGULAR. ... .$SINK($QUERY)
- metavariable-regex:
metavariable: $SINK
regex: ^(after|append|html|prepend|replaceWith|wrap)$
- focus-metavariable: $QUERY
pattern-sanitizers:
- patterns:
- pattern-either:
- pattern: $sce.getTrustedHtml(...)
- pattern: $sanitize(...)
- pattern: DOMPurify.sanitize(...)
- id: javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading
message: $sceDelegateProvider allowlisting can introduce security issues if wildcards
are used.
metadata:
references:
- https://docs.angularjs.org/api/ng/service/$sce#trustAsJs
- https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
category: security
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
technology:
- angular
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading
shortlink: https://sg.run/b7kd
semgrep.dev:
rule:
r_id: 9226
rv_id: 1263093
rule_id: nJUzgX
version_id: JdTzxKb
url: https://semgrep.dev/playground/r/JdTzxKb/javascript.angular.security.detect-angular-resource-loading.detect-angular-resource-loading
origin: community
languages:
- javascript
- typescript
severity: WARNING
pattern-either:
- pattern: |
$sceDelegateProvider.resourceUrlWhitelist([...,'**',...]);
- patterns:
- pattern: |
$sceDelegateProvider.resourceUrlWhitelist([...,$DOM,...]);
- metavariable-regex:
metavariable: $DOM
regex: ^'.*\*\*.+'$
- id: javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled
message: $sceProvider is set to false. Disabling Strict Contextual escaping (SCE)
in an AngularJS application could provide additional attack surface for XSS vulnerabilities.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://docs.angularjs.org/api/ng/service/$sce
- https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
category: security
technology:
- angular
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled
shortlink: https://sg.run/N4DG
semgrep.dev:
rule:
r_id: 9227
rv_id: 1263094
rule_id: EwU20Z
version_id: 5PTo1EW
url: https://semgrep.dev/playground/r/5PTo1EW/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled
origin: community
languages:
- javascript
- typescript
severity: ERROR
pattern: |
$sceProvider.enabled(false);
- id: javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method
message: The use of $sce.trustAsCss can be dangerous if unsanitized user input flows
through this API.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.angularjs.org/api/ng/service/$sce#trustAsCss
- https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
category: security
technology:
- angular
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method
shortlink: https://sg.run/kXgo
semgrep.dev:
rule:
r_id: 9228
rv_id: 1263095
rule_id: 7KUQ4k
version_id: GxTkeB1
url: https://semgrep.dev/playground/r/GxTkeB1/javascript.angular.security.detect-angular-trust-as-css.detect-angular-trust-as-css-method
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-either:
- pattern: |
$SOURCE = $scope.$INPUT;
$sce.trustAsCss($SOURCE);
- pattern: |
$sce.trustAsCss($scope.$INPUT);
- pattern-inside: |
app.controller(..., function($scope,$sce){
...
});
- id: javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method
message: The use of $sce.trustAsHtml can be dangerous if unsanitized user input
flows through this API.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.angularjs.org/api/ng/service/$sce#trustAsHtml
- https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
category: security
technology:
- angular
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method
shortlink: https://sg.run/wenn
semgrep.dev:
rule:
r_id: 9229
rv_id: 1263096
rule_id: L1Uy88
version_id: RGT0L9j
url: https://semgrep.dev/playground/r/RGT0L9j/javascript.angular.security.detect-angular-trust-as-html-method.detect-angular-trust-as-html-method
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-either:
- pattern: |
$SOURCE = $scope.$INPUT;
$sce.trustAsHtml($SOURCE);
- pattern: |
$sce.trustAsHtml($scope.$INPUT);
- pattern-inside: |
app.controller(..., function($scope,$sce){
...
});
- id: javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method
message: The use of $sce.trustAsJs can be dangerous if unsanitized user input flows
through this API.
metadata:
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.angularjs.org/api/ng/service/$sce#trustAsJs
- https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
category: security
technology:
- angular
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method
shortlink: https://sg.run/x1nA
semgrep.dev:
rule:
r_id: 9230
rv_id: 1263097
rule_id: 8GUj8k
version_id: A8Tgdpo
url: https://semgrep.dev/playground/r/A8Tgdpo/javascript.angular.security.detect-angular-trust-as-js-method.detect-angular-trust-as-js-method
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-either:
- pattern: |
$SOURCE = $scope.$INPUT;
$sce.trustAsJs($SOURCE);
- pattern: |
$sce.trustAsJs($scope.$INPUT);
- pattern-inside: |
app.controller(..., function($scope,$sce){
...
});
- id: javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method
message: The use of $sce.trustAs can be dangerous if unsanitized user input flows
through this API.
metadata:
references:
- https://docs.angularjs.org/api/ng/service/$sce
- https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
category: security
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
technology:
- angular
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method
shortlink: https://sg.run/OPW2
semgrep.dev:
rule:
r_id: 9231
rv_id: 1263098
rule_id: gxU1QX
version_id: BjTkZv0
url: https://semgrep.dev/playground/r/BjTkZv0/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-inside: |
app.controller(..., function($scope,$sce) {
...
});
- pattern: $scope.$X
pattern-sinks:
- pattern: $sce.trustAs(...)
- pattern: $sce.trustAsHtml(...)
- id: javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method
message: The use of $sce.trustAsResourceUrl can be dangerous if unsanitized user
input flows through this API.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.angularjs.org/api/ng/service/$sce#trustAsResourceUrl
- https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
category: security
technology:
- angular
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method
shortlink: https://sg.run/eLOd
semgrep.dev:
rule:
r_id: 9232
rv_id: 1263099
rule_id: QrUzeq
version_id: DkTRb7y
url: https://semgrep.dev/playground/r/DkTRb7y/javascript.angular.security.detect-angular-trust-as-resourceurl-method.detect-angular-trust-as-resourceurl-method
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-either:
- pattern: |
$SOURCE = $scope.$INPUT;
$sce.trustAsResourceUrl($SOURCE);
- pattern: |
$sce.trustAsResourceUrl($scope.$INPUT);
- pattern-inside: |
app.controller(..., function($scope,$sce){
...
});
- id: javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method
message: The use of $sce.trustAsUrl can be dangerous if unsanitized user input flows
through this API.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.angularjs.org/api/ng/service/$sce#trustAsUrl
- https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
category: security
technology:
- angular
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method
shortlink: https://sg.run/vznl
semgrep.dev:
rule:
r_id: 9233
rv_id: 1263100
rule_id: 3qUP01
version_id: WrTqKJK
url: https://semgrep.dev/playground/r/WrTqKJK/javascript.angular.security.detect-angular-trust-as-url-method.detect-angular-trust-as-url-method
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-either:
- pattern: |
$SOURCE = $scope.$INPUT;
$sce.trustAsUrl($SOURCE);
- pattern: |
$sce.trustAsUrl($scope.$INPUT);
- pattern-inside: |
app.controller(..., function($scope,$sce){
...
});
- id: javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method
message: The use of $translateProvider.translations method can be dangerous if user
input is provided to this API.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://docs.angularjs.org/api/ng/service/$sce#trustAsUrl
- https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
category: security
technology:
- angular
- typescript
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method
shortlink: https://sg.run/ZvXp
semgrep.dev:
rule:
r_id: 9235
rv_id: 1263101
rule_id: PeUZPg
version_id: 0bTKzqX
url: https://semgrep.dev/playground/r/0bTKzqX/javascript.angular.security.detect-third-party-angular-translate.detect-angular-translateprovider-translations-method
origin: community
languages:
- javascript
severity: WARNING
patterns:
- pattern: |
$translateProvider.translations(...,$SOURCE);
- pattern-inside: |
app.controller(..., function($scope,$sce){
...
});
- id: javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution
message: Potential arbitrary code execution, whatever is provided to `toFastProperties`
is sent straight to eval()
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- bluebird
references:
- http://bluebirdjs.com/docs/getting-started.html
cwe2022-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution
shortlink: https://sg.run/ndnZ
semgrep.dev:
rule:
r_id: 9236
rv_id: 1263115
rule_id: JDUy9J
version_id: K3TKkQ7
url: https://semgrep.dev/playground/r/K3TKkQ7/javascript.bluebird.security.audit.tofastproperties-code-execution.tofastproperties-code-execution
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-inside: function ... (..., $ARG,...) {...}
- focus-metavariable: $ARG
pattern-sinks:
- patterns:
- pattern-either:
- pattern: $UTIL.toFastProperties($SINK,...)
- pattern: toFastProperties($SINK,...)
- pattern-either:
- pattern-inside: |
$BB = require('bluebird');
...
- pattern-inside: |
import 'bluebird';
...
- focus-metavariable: $SINK
- id: javascript.browser.security.eval-detected.eval-detected
message: Detected the use of eval(). eval() can be dangerous if used to evaluate
dynamic content. If this content can be input from outside the program, this may
be a code injection vulnerability. Ensure evaluated content is not definable by
external sources.
metadata:
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.2.4 Dynamic Code Execution Features
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing
version: '4'
category: security
technology:
- browser
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/javascript.browser.security.eval-detected.eval-detected
shortlink: https://sg.run/7ope
semgrep.dev:
rule:
r_id: 9238
rv_id: 1263117
rule_id: GdU7dw
version_id: l4TJR2y
url: https://semgrep.dev/playground/r/l4TJR2y/javascript.browser.security.eval-detected.eval-detected
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-not: eval("...")
- pattern: eval(...)
- id: javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation
message: No validation of origin is done by the addEventListener API. It may be
possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site
Scripting(XSS).
metadata:
owasp:
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-345: Insufficient Verification of Data Authenticity'
category: security
technology:
- browser
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
references:
- https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation
shortlink: https://sg.run/gL9x
semgrep.dev:
rule:
r_id: 9241
rv_id: 1263120
rule_id: BYUN0X
version_id: o5TbDRl
url: https://semgrep.dev/playground/r/o5TbDRl/javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation
origin: community
languages:
- javascript
- typescript
severity: WARNING
pattern-either:
- patterns:
- pattern: |
window.addEventListener('message', $FUNC, ...)
- metavariable-pattern:
patterns:
- pattern: |
function($OBJ) { ... }
- pattern-not: |
function($OBJ) { ... if (<... $OBJ.origin ...>) { ... } ... }
metavariable: $FUNC
- patterns:
- pattern-either:
- pattern-inside: |
function $FNAME($OBJ) { $CONTEXT }
...
- pattern-inside: |
$FNAME = (...) => { $CONTEXT }
...
- pattern: |
window.addEventListener('message', $FNAME,...)
- metavariable-pattern:
patterns:
- pattern-not: |
... if (<... $OBJ.origin ...>) { ... } ...
metavariable: $CONTEXT
- id: javascript.browser.security.open-redirect.js-open-redirect
message: The application accepts potentially user-controlled input `$PROP` which
can control the location of the current window context. This can lead two types
of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript
URIs. It is recommended to validate user-controllable input before allowing it
to control the redirection.
options:
interfile: true
metadata:
interfile: true
cwe:
- 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.1 Insecue Redirect
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation
version: '4'
category: security
confidence: HIGH
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html
technology:
- browser
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Open Redirect
source: https://semgrep.dev/r/javascript.browser.security.open-redirect.js-open-redirect
shortlink: https://sg.run/3xRe
semgrep.dev:
rule:
r_id: 9243
rv_id: 1263122
rule_id: WAUopl
version_id: pZT03x0
url: https://semgrep.dev/playground/r/pZT03x0/javascript.browser.security.open-redirect.js-open-redirect
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
new URLSearchParams($WINDOW. ... .location.search).get('...')
- pattern: |
new URLSearchParams(location.search).get('...')
- pattern: |
new URLSearchParams($WINDOW. ... .location.hash.substring(1)).get('...')
- pattern: |
new URLSearchParams(location.hash.substring(1)).get('...')
- patterns:
- pattern-either:
- pattern-inside: |
$PROPS = new URLSearchParams($WINDOW. ... .location.search)
...
- pattern-inside: |
$PROPS = new URLSearchParams(location.search)
...
- pattern-inside: |
$PROPS = new URLSearchParams($WINDOW. ... .location.hash.substring(1))
...
- pattern-inside: |
$PROPS = new URLSearchParams(location.hash.substring(1))
...
- pattern: $PROPS.get('...')
- patterns:
- pattern-either:
- pattern-inside: |
$PROPS = new URL($WINDOW. ... .location.href)
...
- pattern-inside: |
$PROPS = new URL(location.href)
...
- pattern: $PROPS.searchParams.get('...')
- patterns:
- pattern-either:
- pattern: |
new URL($WINDOW. ... .location.href).searchParams.get('...')
- pattern: |
new URL(location.href).searchParams.get('...')
pattern-sinks:
- patterns:
- pattern-either:
- pattern: location.href = $SINK
- pattern: $THIS. ... .location.href = $SINK
- pattern: location.replace($SINK)
- pattern: $THIS. ... .location.replace($SINK)
- pattern: location = $SINK
- pattern: $WINDOW. ... .location = $SINK
- focus-metavariable: $SINK
- metavariable-pattern:
patterns:
- pattern-not: |
"..." + $VALUE
- pattern-not: |
`...${$VALUE}`
metavariable: $SINK
- id: javascript.browser.security.raw-html-concat.raw-html-concat
message: User controlled data in a HTML string may result in XSS
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/www-community/attacks/xss/
category: security
technology:
- browser
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.browser.security.raw-html-concat.raw-html-concat
shortlink: https://sg.run/4xAx
semgrep.dev:
rule:
r_id: 9244
rv_id: 1263123
rule_id: 0oU5b5
version_id: 2KTv2wp
url: https://semgrep.dev/playground/r/2KTv2wp/javascript.browser.security.raw-html-concat.raw-html-concat
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: location.href
- pattern: location.hash
- pattern: location.search
- pattern: $WINDOW. ... .location.href
- pattern: $WINDOW. ... .location.hash
- pattern: $WINDOW. ... .location.search
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: $STRING + $EXPR
- pattern-not: $STRING + "..."
- metavariable-pattern:
patterns:
- pattern: <$TAG ...
- pattern-not: <$TAG ...>...</$TAG>...
metavariable: $STRING
language: generic
- patterns:
- pattern: $EXPR + $STRING
- pattern-not: '"..." + $STRING'
- metavariable-pattern:
patterns:
- pattern: '... </$TAG'
metavariable: $STRING
language: generic
- patterns:
- pattern: '[..., $STRING, ...].join(...)'
- metavariable-pattern:
patterns:
- pattern: <$TAG ...
metavariable: $STRING
language: generic
- patterns:
- pattern: '[..., $STRING, ...].join(...)'
- metavariable-pattern:
patterns:
- pattern: '... </$TAG'
metavariable: $STRING
language: generic
- patterns:
- pattern: $VAR += $STRING
- metavariable-pattern:
patterns:
- pattern: <$TAG ...
metavariable: $STRING
language: generic
- patterns:
- pattern: $VAR += $STRING
- metavariable-pattern:
patterns:
- pattern: '... </$TAG'
metavariable: $STRING
language: generic
pattern-sanitizers:
- patterns:
- pattern-either:
- pattern-inside: |
import $S from "underscore.string"
...
- pattern-inside: |
import * as $S from "underscore.string"
...
- pattern-inside: |
import $S from "underscore.string"
...
- pattern-inside: |
$S = require("underscore.string")
...
- pattern-either:
- pattern: $S.escapeHTML(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from "dompurify"
...
- pattern-inside: |
import { ..., $S,... } from "dompurify"
...
- pattern-inside: |
import * as $S from "dompurify"
...
- pattern-inside: |
$S = require("dompurify")
...
- pattern-inside: |
import $S from "isomorphic-dompurify"
...
- pattern-inside: |
import * as $S from "isomorphic-dompurify"
...
- pattern-inside: |
$S = require("isomorphic-dompurify")
...
- pattern-either:
- patterns:
- pattern-inside: |
$VALUE = $S(...)
...
- pattern: $VALUE.sanitize(...)
- patterns:
- pattern-inside: |
$VALUE = $S.sanitize
...
- pattern: $S(...)
- pattern: $S.sanitize(...)
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'xss';
...
- pattern-inside: |
import * as $S from 'xss';
...
- pattern-inside: |
$S = require("xss")
...
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'sanitize-html';
...
- pattern-inside: |
import * as $S from "sanitize-html";
...
- pattern-inside: |
$S = require("sanitize-html")
...
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
$S = new Remarkable()
...
- pattern: $S.render(...)
- id: javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration
message: The target origin of the window.postMessage() API is set to "*". This could
allow for information disclosure due to the possibility of any origin allowed
to receive the message.
metadata:
owasp:
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-345: Insufficient Verification of Data Authenticity'
category: security
technology:
- browser
subcategory:
- audit
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
references:
- https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration
shortlink: https://sg.run/PJ4p
semgrep.dev:
rule:
r_id: 9245
rv_id: 1263125
rule_id: KxUbq4
version_id: jQTn5ND
url: https://semgrep.dev/playground/r/jQTn5ND/javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration
origin: community
languages:
- javascript
- typescript
severity: WARNING
pattern: $OBJECT.postMessage(...,'*',...)
- id: javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection
message: If unverified user data can reach the `compileScript` method it can result
in Server-Side Request Forgery vulnerabilities
metadata:
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
category: security
technology:
- chrome-remote-interface
references:
- https://github.com/cyrus-and/chrome-remote-interface
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection
shortlink: https://sg.run/J9kj
semgrep.dev:
rule:
r_id: 9246
rv_id: 1263126
rule_id: qNUjnb
version_id: 1QTypkQ
url: https://semgrep.dev/playground/r/1QTypkQ/javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-inside: function ... (..., $ARG,...) {...}
- focus-metavariable: $ARG
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
require('chrome-remote-interface');
...
- pattern-inside: |
import 'chrome-remote-interface';
...
- pattern-either:
- pattern: |
$RUNTIME.compileScript({expression: $SINK},...)
- pattern: |
$RUNTIME.evaluate({expression: $SINK},...)
- pattern: |
$PAGE.navigate({url: $SINK},...)
- pattern: |
$RUNTIME.printToPDF({headerTemplate: $SINK},...)
- pattern: |
$RUNTIME.printToPDF({footerTemplate: $SINK},...)
- pattern: |
$PAGE.setDocumentContent({html: $SINK},...)
- focus-metavariable: $SINK
- id: javascript.express.security.express-expat-xxe.express-expat-xxe
message: Make sure that unverified user data can not reach the XML Parser, as it
can result in XML External or Internal Entity (XXE) Processing vulnerabilities.
options:
interfile: true
metadata:
interfile: true
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://github.com/astro/node-expat
category: security
technology:
- express
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/javascript.express.security.express-expat-xxe.express-expat-xxe
shortlink: https://sg.run/BkXx
semgrep.dev:
rule:
r_id: 9251
rv_id: 1263164
rule_id: zdUkJl
version_id: o5TbD5l
url: https://semgrep.dev/playground/r/o5TbD5l/javascript.express.security.express-expat-xxe.express-expat-xxe
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
$XML = require('node-expat')
...
- pattern-inside: |
import $XML from 'node-expat'
...
- pattern-inside: |
import * as $XML from 'node-expat'
...
- pattern-either:
- pattern-inside: |
$PARSER = new $XML.Parser(...);
...
- pattern-either:
- pattern: $PARSER.parse($QUERY)
- pattern: $PARSER.write($QUERY)
- focus-metavariable: $QUERY
- id: javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
options:
interfile: true
metadata:
interfile: true
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
category: security
technology:
- express
- secrets
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret
shortlink: https://sg.run/Do1d
semgrep.dev:
rule:
r_id: 9252
rv_id: 1263166
rule_id: pKUOjy
version_id: pZT03Q0
url: https://semgrep.dev/playground/r/pZT03Q0/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-either:
- pattern-inside: |
$JWT = require('express-jwt');
...
- pattern-inside: |
import $JWT from 'express-jwt';
...
- pattern-inside: |
import * as $JWT from 'express-jwt';
...
- pattern-inside: |
import { ..., $JWT, ... } from 'express-jwt';
...
- pattern-either:
- pattern: |
$JWT({...,secret: "$Y",...},...)
- pattern: |
$OPTS = "$Y";
...
$JWT({...,secret: $OPTS},...);
- focus-metavariable: $Y
- id: javascript.express.security.express-phantom-injection.express-phantom-injection
message: If unverified user data can reach the `phantom` methods it can result in
Server-Side Request Forgery vulnerabilities
metadata:
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
category: security
technology:
- express
references:
- https://phantomjs.org/page-automation.html
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/javascript.express.security.express-phantom-injection.express-phantom-injection
shortlink: https://sg.run/W8BL
semgrep.dev:
rule:
r_id: 9253
rv_id: 1263167
rule_id: 2ZUbx3
version_id: 2KTv26p
url: https://semgrep.dev/playground/r/2KTv26p/javascript.express.security.express-phantom-injection.express-phantom-injection
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
require('phantom');
...
- pattern-inside: |
import 'phantom';
...
- pattern-either:
- pattern: $PAGE.open($SINK,...)
- pattern: $PAGE.setContent($SINK,...)
- pattern: $PAGE.openUrl($SINK,...)
- pattern: $PAGE.evaluateJavaScript($SINK,...)
- pattern: $PAGE.property("content",$SINK,...)
- focus-metavariable: $SINK
- id: javascript.express.security.express-puppeteer-injection.express-puppeteer-injection
message: If unverified user data can reach the `puppeteer` methods it can result
in Server-Side Request Forgery vulnerabilities
metadata:
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
category: security
technology:
- express
references:
- https://pptr.dev/api/puppeteer.page
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection
shortlink: https://sg.run/0QJB
semgrep.dev:
rule:
r_id: 9254
rv_id: 1263168
rule_id: X5U8Nz
version_id: X0TzyJY
url: https://semgrep.dev/playground/r/X0TzyJY/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
require('puppeteer');
...
- pattern-inside: |
import 'puppeteer';
...
- pattern-either:
- pattern: $PAGE.goto($SINK,...)
- pattern: $PAGE.setContent($SINK,...)
- pattern: $PAGE.evaluate($SINK,...)
- pattern: $PAGE.evaluate($CODE,$SINK,...)
- pattern: $PAGE.evaluateHandle($SINK,...)
- pattern: $PAGE.evaluateHandle($CODE,$SINK,...)
- pattern: $PAGE.evaluateOnNewDocument($SINK,...)
- pattern: $PAGE.evaluateOnNewDocument($CODE,$SINK,...)
- focus-metavariable: $SINK
- id: javascript.express.security.express-sandbox-injection.express-sandbox-code-injection
message: Make sure that unverified user data can not reach `sandbox`.
metadata:
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
category: security
technology:
- express
cwe2022-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection
shortlink: https://sg.run/KlwL
semgrep.dev:
rule:
r_id: 9255
rv_id: 1263169
rule_id: j2UvXB
version_id: jQTn59D
url: https://semgrep.dev/playground/r/jQTn59D/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern-inside: |
$SANDBOX = require('sandbox');
...
- pattern-either:
- patterns:
- pattern-inside: |
$S = new $SANDBOX(...);
...
- pattern: |
$S.run(...)
- pattern: |
new $SANDBOX($OPTS).run(...)
- pattern: new $SANDBOX().run(...)
- id: javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection
message: If unverified user data can reach the `phantom` methods it can result in
Server-Side Request Forgery vulnerabilities
metadata:
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
category: security
technology:
- express
references:
- https://www.npmjs.com/package/wkhtmltopdf
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection
shortlink: https://sg.run/pxe0
semgrep.dev:
rule:
r_id: 9262
rv_id: 1263172
rule_id: kxUkl9
version_id: yeTxpdd
url: https://semgrep.dev/playground/r/yeTxpdd/javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection
origin: community
severity: ERROR
languages:
- javascript
- typescript
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern: $WK.generate($SINK,...)
- focus-metavariable: $SINK
- id: javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection
message: If unverified user data can reach the `wkhtmltopdf` methods it can result
in Server-Side Request Forgery vulnerabilities
metadata:
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
category: security
technology:
- express
references:
- https://www.npmjs.com/package/wkhtmltopdf
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection
shortlink: https://sg.run/2xGq
semgrep.dev:
rule:
r_id: 9263
rv_id: 1263173
rule_id: wdUJxq
version_id: rxTAK8b
url: https://semgrep.dev/playground/r/rxTAK8b/javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern-inside: |
$WK = require('wkhtmltopdf');
...
- pattern: $WK($SINK,...)
- focus-metavariable: $SINK
- id: javascript.express.security.express-xml2json-xxe.express-xml2json-xxe
message: Make sure that unverified user data can not reach the XML Parser, as it
can result in XML External or Internal Entity (XXE) Processing vulnerabilities
metadata:
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
category: security
technology:
- express
references:
- https://www.npmjs.com/package/xml2json
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe
shortlink: https://sg.run/XBD4
semgrep.dev:
rule:
r_id: 9264
rv_id: 1263174
rule_id: x8Uneb
version_id: bZT534J
url: https://semgrep.dev/playground/r/bZT534J/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- pattern: $REQ.files.$ANYTHING.data.toString('utf8')
- pattern: $REQ.files.$ANYTHING['data'].toString('utf8')
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
- pattern: files.$ANYTHING.data.toString('utf8')
- pattern: files.$ANYTHING['data'].toString('utf8')
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
require('xml2json');
...
- pattern-inside: |
import 'xml2json';
...
- pattern: $EXPAT.toJson($SINK,...)
- focus-metavariable: $SINK
- id: javascript.express.security.require-request.require-request
message: If an attacker controls the x in require(x) then they can cause code to
load that was not intended to run on the server.
options:
interfile: true
metadata:
interfile: true
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-706: Use of Incorrectly-Resolved Name or Reference'
source-rule-url: https://nodesecroadmap.fyi/chapter-1/threat-UIR.html
category: security
technology:
- express
references:
- https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/javascript.express.security.require-request.require-request
shortlink: https://sg.run/jRbl
semgrep.dev:
rule:
r_id: 9265
rv_id: 1263177
rule_id: OrU3WK
version_id: w8TRo0d
url: https://semgrep.dev/playground/r/w8TRo0d/javascript.express.security.require-request.require-request
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern: require($SINK)
- focus-metavariable: $SINK
- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name
message: "Don\u2019t use the default session cookie name Using the default session
cookie name can open your app to attacks. The security issue posed is similar
to X-Powered-By: a potential attacker can use it to fingerprint the server and
target attacks accordingly."
severity: WARNING
languages:
- javascript
- typescript
metadata:
cwe:
- 'CWE-522: Insufficiently Protected Credentials'
owasp:
- A02:2017 - Broken Authentication
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html
category: security
technology:
- express
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: LOW
confidence: MEDIUM
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name
shortlink: https://sg.run/1Z5x
semgrep.dev:
rule:
r_id: 9266
rv_id: 1263130
rule_id: eqU8k2
version_id: bZT536J
url: https://semgrep.dev/playground/r/bZT536J/javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name
origin: community
patterns:
- pattern-either:
- pattern-inside: |
$SESSION = require('cookie-session');
...
- pattern-inside: |
$SESSION = require('express-session');
...
- pattern: $SESSION(...)
- pattern-not-inside: $SESSION(<... {name:...} ...>,...)
- pattern-not-inside: |
$OPTS = <... {name:...} ...>;
...
$SESSION($OPTS,...);
- pattern-not-inside: |
$OPTS = ...;
...
$OPTS.name = ...;
...
$SESSION($OPTS,...);
- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure
message: 'Default session middleware settings: `secure` not set. It ensures the
browser only sends the cookie over HTTPS.'
severity: WARNING
languages:
- javascript
- typescript
metadata:
cwe:
- 'CWE-522: Insufficiently Protected Credentials'
owasp:
- A02:2017 - Broken Authentication
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html
category: security
technology:
- express
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: LOW
confidence: MEDIUM
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure
shortlink: https://sg.run/9oKz
semgrep.dev:
rule:
r_id: 9267
rv_id: 1263131
rule_id: v8Unzw
version_id: NdTzyrv
url: https://semgrep.dev/playground/r/NdTzyrv/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure
origin: community
patterns:
- pattern-either:
- pattern-inside: |
$SESSION = require('cookie-session');
...
- pattern-inside: |
$SESSION = require('express-session');
...
- pattern: $SESSION(...)
- pattern-not-inside: $SESSION(<... {cookie:{secure:true}} ...>,...)
- pattern-not-inside: |
$OPTS = <... {cookie:{secure:true}} ...>;
...
$SESSION($OPTS,...);
- pattern-not-inside: |
$OPTS = ...;
...
$COOKIE = <... {secure:true} ...>;
...
$SESSION($OPTS,...);
- pattern-not-inside: |
$OPTS = ...;
...
$OPTS.cookie = <... {secure:true} ...>;
...
$SESSION($OPTS,...);
- pattern-not-inside: |
$OPTS = ...;
...
$COOKIE.secure = true;
...
$SESSION($OPTS,...);
- pattern-not-inside: |
$OPTS = ...;
...
$OPTS.cookie.secure = true;
...
$SESSION($OPTS,...);
- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly
message: 'Default session middleware settings: `httpOnly` not set. It ensures the
cookie is sent only over HTTP(S), not client JavaScript, helping to protect against
cross-site scripting attacks.'
severity: WARNING
languages:
- javascript
- typescript
metadata:
cwe:
- 'CWE-522: Insufficiently Protected Credentials'
owasp:
- A02:2017 - Broken Authentication
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html
category: security
technology:
- express
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: LOW
confidence: MEDIUM
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly
shortlink: https://sg.run/ydBO
semgrep.dev:
rule:
r_id: 9268
rv_id: 1263132
rule_id: d8UjGo
version_id: kbTzGev
url: https://semgrep.dev/playground/r/kbTzGev/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly
origin: community
patterns:
- pattern-either:
- pattern-inside: |
$SESSION = require('cookie-session');
...
- pattern-inside: |
$SESSION = require('express-session');
...
- pattern: $SESSION(...)
- pattern-not-inside: $SESSION(<... {cookie:{httpOnly:true}} ...>,...)
- pattern-not-inside: |
$OPTS = <... {cookie:{httpOnly:true}} ...>;
...
$SESSION($OPTS,...);
- pattern-not-inside: |
$OPTS = ...;
...
$COOKIE = <... {httpOnly:true} ...>;
...
$SESSION($OPTS,...);
- pattern-not-inside: |
$OPTS = ...;
...
$OPTS.cookie = <... {httpOnly:true} ...>;
...
$SESSION($OPTS,...);
- pattern-not-inside: |
$OPTS = ...;
...
$COOKIE.httpOnly = true;
...
$SESSION($OPTS,...);
- pattern-not-inside: |
$OPTS = ...;
...
$OPTS.cookie.httpOnly = true;
...
$SESSION($OPTS,...);
- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain
message: 'Default session middleware settings: `domain` not set. It indicates the
domain of the cookie; use it to compare against the domain of the server in which
the URL is being requested. If they match, then check the path attribute next.'
severity: WARNING
languages:
- javascript
- typescript
metadata:
cwe:
- 'CWE-522: Insufficiently Protected Credentials'
owasp:
- A02:2017 - Broken Authentication
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html
category: security
technology:
- express
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: LOW
confidence: MEDIUM
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain
shortlink: https://sg.run/rd41
semgrep.dev:
rule:
r_id: 9269
rv_id: 1263133
rule_id: ZqU5Pn
version_id: w8TRoyd
url: https://semgrep.dev/playground/r/w8TRoyd/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain
origin: community
patterns:
- pattern-either:
- pattern-inside: |
$SESSION = require('cookie-session');
...
- pattern-inside: |
$SESSION = require('express-session');
...
- pattern: $SESSION(...)
- pattern-not-inside: $SESSION(<... {cookie:{domain:...}} ...>,...)
- pattern-not-inside: |
$OPTS = <... {cookie:{domain:...}} ...>;
...
$SESSION($OPTS,...);
- pattern-not-inside: |
$OPTS = ...;
...
$COOKIE = <... {domain:...} ...>;
...
$SESSION($OPTS,...);
- pattern-not-inside: |
$OPTS = ...;
...
$OPTS.cookie = <... {domain:...} ...>;
...
$SESSION($OPTS,...);
- pattern-not-inside: |
$OPTS = ...;
...
$COOKIE.domain = ...;
...
$SESSION($OPTS,...);
- pattern-not-inside: |
$OPTS = ...;
...
$OPTS.cookie.domain = ...;
...
$SESSION($OPTS,...);
- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path
message: 'Default session middleware settings: `path` not set. It indicates the
path of the cookie; use it to compare against the request path. If this and domain
match, then send the cookie in the request.'
severity: WARNING
languages:
- javascript
- typescript
metadata:
cwe:
- 'CWE-522: Insufficiently Protected Credentials'
owasp:
- A02:2017 - Broken Authentication
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html
category: security
technology:
- express
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: LOW
confidence: MEDIUM
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path
shortlink: https://sg.run/b7pd
semgrep.dev:
rule:
r_id: 9270
rv_id: 1263134
rule_id: nJUz4X
version_id: xyTjzQD
url: https://semgrep.dev/playground/r/xyTjzQD/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path
origin: community
patterns:
- pattern-either:
- pattern-inside: |
$SESSION = require('cookie-session');
...
- pattern-inside: |
$SESSION = require('express-session');
...
- pattern: $SESSION(...)
- pattern-not-inside: $SESSION(<... {cookie:{path:...}} ...>,...)
- pattern-not-inside: |
$OPTS = <... {cookie:{path:...}} ...>;
...
$SESSION($OPTS,...);
- pattern-not-inside: |
$OPTS = ...;
...
$COOKIE = <... {path:...} ...>;
...
$SESSION($OPTS,...);
- pattern-not-inside: |
$OPTS = ...;
...
$OPTS.cookie = <... {path:...} ...>;
...
$SESSION($OPTS,...);
- pattern-not-inside: |
$OPTS = ...;
...
$COOKIE.path = ...;
...
$SESSION($OPTS,...);
- pattern-not-inside: |
$OPTS = ...;
...
$OPTS.cookie.path = ...;
...
$SESSION($OPTS,...);
- id: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires
message: 'Default session middleware settings: `expires` not set. Use it to set
expiration date for persistent cookies.'
severity: WARNING
languages:
- javascript
- typescript
metadata:
cwe:
- 'CWE-522: Insufficiently Protected Credentials'
owasp:
- A02:2017 - Broken Authentication
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
source-rule-url: https://expressjs.com/en/advanced/best-practice-security.html
category: security
technology:
- express
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: LOW
confidence: MEDIUM
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires
shortlink: https://sg.run/N4eG
semgrep.dev:
rule:
r_id: 9271
rv_id: 1263135
rule_id: EwU2DZ
version_id: O9TpxRq
url: https://semgrep.dev/playground/r/O9TpxRq/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires
origin: community
patterns:
- pattern-either:
- pattern-inside: |
$SESSION = require('cookie-session');
...
- pattern-inside: |
$SESSION = require('express-session');
...
- pattern: $SESSION(...)
- pattern-not-inside: $SESSION(<... {cookie:{expires:...}} ...>,...)
- pattern-not-inside: |
$OPTS = <... {cookie:{expires:...}} ...>;
...
$SESSION($OPTS,...);
- pattern-not-inside: |
$OPTS = ...;
...
$COOKIE = <... {expires:...} ...>;
...
$SESSION($OPTS,...);
- pattern-not-inside: |
$OPTS = ...;
...
$OPTS.cookie = <... {expires:...} ...>;
...
$SESSION($OPTS,...);
- pattern-not-inside: |
$OPTS = ...;
...
$COOKIE.expires = ...;
...
$SESSION($OPTS,...);
- pattern-not-inside: |-
$OPTS = ...;
...
$OPTS.cookie.expires = ...;
...
$SESSION($OPTS,...);
- id: javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked
message: No token revoking configured for `express-jwt`. A leaked token could still
be used and unable to be revoked. Consider using function as the `isRevoked` option.
metadata:
cwe:
- 'CWE-522: Insufficiently Protected Credentials'
owasp:
- A02:2017 - Broken Authentication
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
source-rule-url: https://github.com/goldbergyoni/nodebestpractices/blob/master/sections/security/expirejwt.md
asvs:
section: 'V3: Session Management Verification Requirements'
control_id: 3.5.3 Insecure Stateless Session Tokens
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
version: '4'
category: security
technology:
- express
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked
shortlink: https://sg.run/kXNo
semgrep.dev:
rule:
r_id: 9272
rv_id: 1263137
rule_id: 7KUQ9k
version_id: vdT06Bg
url: https://semgrep.dev/playground/r/vdT06Bg/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
$JWT = require('express-jwt');
...
- pattern: $JWT(...)
- pattern-not-inside: $JWT(<... {isRevoked:...} ...>,...)
- pattern-not-inside: |-
$OPTS = <... {isRevoked:...} ...>;
...
$JWT($OPTS,...);
- id: javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal
message: Possible writing outside of the destination, make sure that the target
path is nested in the intended destination
metadata:
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
category: security
references:
- https://owasp.org/www-community/attacks/Path_Traversal
technology:
- express
- node.js
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal
shortlink: https://sg.run/weRn
semgrep.dev:
rule:
r_id: 9273
rv_id: 1263141
rule_id: L1Uyb8
version_id: ExTExX0
url: https://semgrep.dev/playground/r/ExTExX0/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- focus-metavariable: $SINK
- pattern-either:
- pattern-inside: |
$PATH = require('path');
...
- pattern-inside: |
import $PATH from 'path';
...
- pattern-either:
- pattern: $PATH.join(...,$SINK,...)
- pattern: $PATH.resolve(...,$SINK,...)
- patterns:
- focus-metavariable: $SINK
- pattern-inside: |
import 'path';
...
- pattern-either:
- pattern: path.join(...,$SINK,...)
- pattern: path.resolve(...,$SINK,...)
pattern-sanitizers:
- pattern: $Y.replace(...)
- pattern: $Y.indexOf(...)
- pattern: |
function ... (...) {
...
<... $Y.indexOf(...) ...>
...
}
- patterns:
- pattern: $FUNC(...)
- metavariable-regex:
metavariable: $FUNC
regex: sanitize
- id: javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event
message: Xml Parser is used inside Request Event. Make sure that unverified user
data can not reach the XML Parser, as it can result in XML External or Internal
Entity (XXE) Processing vulnerabilities
metadata:
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
category: security
technology:
- express
references:
- https://www.npmjs.com/package/xml2json
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event
shortlink: https://sg.run/x1AA
semgrep.dev:
rule:
r_id: 9274
rv_id: 1263146
rule_id: 8GUjkk
version_id: QkTGqgo
url: https://semgrep.dev/playground/r/QkTGqgo/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
require('xml2json');
...
- pattern-inside: |
import 'xml2json';
...
- pattern: $REQ.on('...', function(...) { ... $EXPAT.toJson($INPUT,...); ... })
- focus-metavariable: $INPUT
- id: javascript.express.security.audit.res-render-injection.res-render-injection
message: User controllable data `$REQ` enters `$RES.render(...)` this can lead to
the loading of other HTML/templating pages that they may not be authorized to
render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index`
to access other HTML pages on the file system. Where possible, do not allow users
to define what should be loaded in $RES.render or use an allow list for the existing
application.
options:
interfile: true
metadata:
interfile: true
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-706: Use of Incorrectly-Resolved Name or Reference'
category: security
technology:
- express
references:
- http://expressjs.com/en/4x/api.html#res.render
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/javascript.express.security.audit.res-render-injection.res-render-injection
shortlink: https://sg.run/eLjd
semgrep.dev:
rule:
r_id: 9276
rv_id: 1263149
rule_id: QrUzrq
version_id: PkTR3OY
url: https://semgrep.dev/playground/r/PkTR3OY/javascript.express.security.audit.res-render-injection.res-render-injection
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern-either:
- pattern: $RES.render($SINK, ...)
- focus-metavariable: $SINK
- id: javascript.express.security.audit.xss.direct-response-write.direct-response-write
message: Detected directly writing to a Response object from user-defined input.
This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting
(XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML.
options:
interfile: true
metadata:
interfile: true
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
category: security
technology:
- express
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
vulnerability_class:
- Cross-Site-Scripting (XSS)
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write
shortlink: https://sg.run/vzGl
semgrep.dev:
rule:
r_id: 9277
rv_id: 1263150
rule_id: 3qUPA1
version_id: JdTzxeg
url: https://semgrep.dev/playground/r/JdTzxeg/javascript.express.security.audit.xss.direct-response-write.direct-response-write
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)
- pattern-not-inside: |
function ... ($REQ, $RES) {
...
$RES.$SET('Content-Type', '$TYPE')
}
- pattern-not-inside: |
$APP.$METHOD(..., function $FUNC($REQ, $RES) {
...
$RES.$SET('Content-Type', '$TYPE')
})
- pattern-not-inside: |
function ... ($REQ, $RES, $NEXT) {
...
$RES.$SET('Content-Type', '$TYPE')
}
- pattern-not-inside: |
function ... ($REQ, $RES) {
...
$RES.set('$TYPE')
}
- pattern-not-inside: |
$APP.$METHOD(..., function $FUNC($REQ, $RES) {
...
$RES.set('$TYPE')
})
- pattern-not-inside: |
function ... ($REQ, $RES, $NEXT) {
...
$RES.set('$TYPE')
}
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- pattern-not-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{
...
$RES.$SET('Content-Type', '$TYPE')
}
- pattern-not-inside: |
({ $REQ }: Request,$RES: Response) => {
...
$RES.$SET('Content-Type', '$TYPE')
}
- pattern-not-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{
...
$RES.set('$TYPE')
}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: body
pattern-sinks:
- patterns:
- pattern-inside: function ... (..., $RES,...) {...}
- pattern-either:
- pattern: $RES.write($ARG)
- pattern: $RES.send($ARG)
- pattern-not: $RES. ... .set('...'). ... .send($ARG)
- pattern-not: $RES. ... .type('...'). ... .send($ARG)
- pattern-not-inside: $RES.$METHOD({ ... })
- focus-metavariable: $ARG
pattern-sanitizers:
- patterns:
- pattern-either:
- pattern-inside: |
import $S from "underscore.string"
...
- pattern-inside: |
import * as $S from "underscore.string"
...
- pattern-inside: |
import $S from "underscore.string"
...
- pattern-inside: |
$S = require("underscore.string")
...
- pattern-either:
- pattern: $S.escapeHTML(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from "dompurify"
...
- pattern-inside: |
import { ..., $S,... } from "dompurify"
...
- pattern-inside: |
import * as $S from "dompurify"
...
- pattern-inside: |
$S = require("dompurify")
...
- pattern-inside: |
import $S from "isomorphic-dompurify"
...
- pattern-inside: |
import * as $S from "isomorphic-dompurify"
...
- pattern-inside: |
$S = require("isomorphic-dompurify")
...
- pattern-either:
- patterns:
- pattern-inside: |
$VALUE = $S(...)
...
- pattern: $VALUE.sanitize(...)
- patterns:
- pattern-inside: |
$VALUE = $S.sanitize
...
- pattern: $S(...)
- pattern: $S.sanitize(...)
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'xss';
...
- pattern-inside: |
import * as $S from 'xss';
...
- pattern-inside: |
$S = require("xss")
...
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'sanitize-html';
...
- pattern-inside: |
import * as $S from "sanitize-html";
...
- pattern-inside: |
$S = require("sanitize-html")
...
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
$S = new Remarkable()
...
- pattern: $S.render(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'express-xss-sanitizer';
...
- pattern-inside: |
import * as $S from "express-xss-sanitizer";
...
- pattern-inside: |
const { ..., $S, ... } = require('express-xss-sanitizer');
...
- pattern-inside: |
var { ..., $S, ... } = require('express-xss-sanitizer');
...
- pattern-inside: |
let { ...,$S,... } = require('express-xss-sanitizer');
...
- pattern-inside: |
$S = require("express-xss-sanitizer")
...
- pattern: $S(...)
- patterns:
- pattern: $RES. ... .type('$F'). ... .send(...)
- metavariable-regex:
metavariable: $F
regex: (?!.*text/html)
- patterns:
- pattern-inside: |
$X = [...];
...
- pattern: |
if(<... !$X.includes($SOURCE)...>) {
...
return ...
}
...
- pattern: $SOURCE
- id: javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape
message: Detected an explicit unescape in an EJS template, using '<%- ... %>' If
external data can reach these locations, your application is exposed to a cross-site
scripting (XSS) vulnerability. Use '<%= ... %>' to escape this data. If you need
escaping, ensure no external data can reach this location.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- http://www.managerjs.com/blog/2015/05/will-ejs-escape-save-me-from-xss-sorta/
category: security
technology:
- express
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape
shortlink: https://sg.run/dKXQ
semgrep.dev:
rule:
r_id: 9278
rv_id: 1263151
rule_id: 4bUkPO
version_id: 5PTo13n
url: https://semgrep.dev/playground/r/5PTo13n/javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape
origin: community
languages:
- regex
severity: WARNING
paths:
include:
- '*.ejs'
- '*.html'
pattern-regex: <%-((?!include).)*?%>
fix-regex:
regex: <%-(.*?)%>
replacement: <%=\1%>
- id: javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src
message: Detected a template variable used as the 'src' in a script tag. Although
template variables are HTML escaped, HTML escaping does not always prevent malicious
URLs from being injected and could results in a cross-site scripting (XSS) vulnerability.
Prefer not to dynamically generate the 'src' attribute and use static URLs instead.
If you must do this, carefully check URLs against an allowlist and be sure to
URL-encode the result.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough
- https://github.com/ESAPI/owasp-esapi-js
category: security
technology:
- express
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src
shortlink: https://sg.run/ndxZ
semgrep.dev:
rule:
r_id: 9280
rv_id: 1263153
rule_id: JDUyrJ
version_id: RGT0LwD
url: https://semgrep.dev/playground/r/RGT0LwD/javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src
origin: community
languages:
- generic
severity: WARNING
patterns:
- pattern-inside: <script ...>
- pattern-either:
- pattern-inside: src = '...'
- pattern-inside: src = "..."
- pattern: <% ... >
paths:
include:
- '*.ejs'
- '*.html'
- id: javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag
message: Detected a template variable used in a script tag. Although template variables
are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS)
attacks when used directly in JavaScript. If you need this data on the rendered
page, consider placing it in the HTML portion (outside of a script tag). Alternatively,
use a JavaScript-specific encoder, such as the one available in OWASP ESAPI.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough
- https://github.com/ESAPI/owasp-esapi-js
category: security
technology:
- express
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag
shortlink: https://sg.run/Ek9L
semgrep.dev:
rule:
r_id: 9281
rv_id: 1263154
rule_id: 5rUOD6
version_id: A8Tgdnk
url: https://semgrep.dev/playground/r/A8Tgdnk/javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag
origin: community
languages:
- generic
severity: WARNING
patterns:
- pattern-inside: <script ...> ... </script>
- pattern-not-inside: <script ... $ATTR = "..." ...>
- pattern-not-inside: <script ... $ATTR = '...' ...>
- pattern: <% ... >
paths:
include:
- '*.ejs'
- '*.html'
- id: javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite
message: 'The Mustache escape function is being overwritten. This could bypass HTML
escaping safety measures built into the rendering engine, exposing your application
to cross-site scripting (XSS) vulnerabilities. If you need unescaped HTML, use
the triple brace operator in your template: ''{{{ ... }}}''.'
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://github.com/janl/mustache.js/#variables
category: security
technology:
- express
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite
shortlink: https://sg.run/7oWe
semgrep.dev:
rule:
r_id: 9282
rv_id: 1263155
rule_id: GdU7Ew
version_id: BjTkZGD
url: https://semgrep.dev/playground/r/BjTkZGD/javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite
origin: community
languages:
- javascript
- typescript
severity: WARNING
pattern-either:
- pattern: Mustache.escape = ...
- patterns:
- pattern-inside: |
$MUSTACHE = require("mustache");
...
- pattern: $MUSTACHE.escape = ...
- id: javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape
message: Detected an explicit unescape in a Mustache template, using triple braces
'{{{...}}}' or ampersand '&'. If external data can reach these locations, your
application is exposed to a cross-site scripting (XSS) vulnerability. If you must
do this, ensure no external data can reach this location.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://github.com/janl/mustache.js/#variables
- https://ractive.js.org/v0.x/0.7/mustaches#variables
category: security
technology:
- express
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape
shortlink: https://sg.run/Lwx9
semgrep.dev:
rule:
r_id: 9283
rv_id: 1263156
rule_id: ReUgG1
version_id: DkTRbep
url: https://semgrep.dev/playground/r/DkTRbep/javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape
origin: community
languages:
- regex
severity: WARNING
paths:
include:
- '*.mustache'
- '*.hbs'
- '*.html'
pattern-either:
- pattern-regex: '{{{((?!include).)*?}}}'
- pattern-regex: '{{[\\s]*&.*}}'
- id: javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes
message: Detected a unescaped variables using '&attributes'. If external data can
reach these locations, your application is exposed to a cross-site scripting (XSS)
vulnerability. If you must do this, ensure no external data can reach this location.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://pugjs.org/language/attributes.html#attributes
category: security
technology:
- express
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes
shortlink: https://sg.run/Q5jk
semgrep.dev:
rule:
r_id: 9286
rv_id: 1263158
rule_id: DbUpyq
version_id: 0bTKz6J
url: https://semgrep.dev/playground/r/0bTKz6J/javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes
origin: community
languages:
- regex
severity: WARNING
paths:
include:
- '*.pug'
pattern-regex: .*&attributes.*
- id: javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape
message: Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'.
If external data can reach these locations, your application is exposed to a cross-site
scripting (XSS) vulnerability. If you must do this, ensure no external data can
reach this location.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://pugjs.org/language/code.html#unescaped-buffered-code
- https://pugjs.org/language/attributes.html#unescaped-attributes
category: security
technology:
- express
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape
shortlink: https://sg.run/3xbe
semgrep.dev:
rule:
r_id: 9287
rv_id: 1263159
rule_id: WAUonl
version_id: K3TKkO7
url: https://semgrep.dev/playground/r/K3TKkO7/javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape
origin: community
languages:
- regex
severity: WARNING
paths:
include:
- '*.pug'
pattern-either:
- pattern-regex: \w.*(!=)[^=].*
- pattern-regex: '!{.*?}'
- id: javascript.express.security.audit.xss.pug.var-in-href.var-in-href
message: 'Detected a template variable used in an anchor tag with the ''href'' attribute.
This allows a malicious actor to input the ''javascript:'' URI and is subject
to cross- site scripting (XSS) attacks. If using a relative URL, start with a
literal forward slash and concatenate the URL, like this: a(href=''/''+url). You
may also consider setting the Content Security Policy (CSP) header.'
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://github.com/pugjs/pug/issues/2952
- https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI
category: security
technology:
- express
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-href.var-in-href
shortlink: https://sg.run/4xNx
semgrep.dev:
rule:
r_id: 9288
rv_id: 1263160
rule_id: 0oU535
version_id: qkTR7KW
url: https://semgrep.dev/playground/r/qkTR7KW/javascript.express.security.audit.xss.pug.var-in-href.var-in-href
origin: community
languages:
- regex
severity: WARNING
paths:
include:
- '*.pug'
pattern-regex: a\(.*href=[^'"].*\)
- id: javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag
message: Detected a template variable used in a script tag. Although template variables
are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS)
attacks when used directly in JavaScript. If you need this data on the rendered
page, consider placing it in the HTML portion (outside of a script tag). Alternatively,
use a JavaScript-specific encoder, such as the one available in OWASP ESAPI.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough
- https://github.com/ESAPI/owasp-esapi-js
category: security
technology:
- express
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag
shortlink: https://sg.run/PJXp
semgrep.dev:
rule:
r_id: 9289
rv_id: 1263161
rule_id: KxUbL4
version_id: l4TJRNy
url: https://semgrep.dev/playground/r/l4TJRNy/javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag
origin: community
languages:
- regex
severity: WARNING
paths:
include:
- '*.pug'
pattern-either:
- pattern-regex: script\s*=[A-Za-z0-9]+
- pattern-regex: script\s*=.*["']\s*\+.*
- pattern-regex: script\s*=[^'"]+\+.*
- pattern-regex: script\(.*?\)\s*=\s*[A-Za-z0-9]+
- pattern-regex: script\(.*?\)\s*=\s*.*["']\s*\+.*
- pattern-regex: script\(.*?\)\s*=\s*[^'"]+\+.*
- id: javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup
message: User controlled data in a `createNodesFromMarkup` is an anti-pattern that
can lead to XSS vulnerabilities
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- fbjs
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup
shortlink: https://sg.run/J9Yj
semgrep.dev:
rule:
r_id: 9290
rv_id: 1263179
rule_id: qNUjwb
version_id: O9TpxZq
url: https://semgrep.dev/playground/r/O9TpxZq/javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-either:
- pattern: createNodesFromMarkup(...)
- pattern: $X.createNodesFromMarkup(...)
- pattern-not: createNodesFromMarkup("...",...)
- pattern-not: $X.createNodesFromMarkup("...",...)
- id: javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection
message: Found an insecure gRPC connection. This creates a connection without encryption
to a gRPC client/server. A malicious attacker could tamper with the gRPC message,
which could compromise the machine.
metadata:
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
category: security
technology:
- grpc
references:
- https://blog.gopheracademy.com/advent-2017/go-grpc-beyond-basics/#:~:text=disables%20transport%20security
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection
shortlink: https://sg.run/5QkD
semgrep.dev:
rule:
r_id: 9291
rv_id: 1263180
rule_id: lBU9D8
version_id: e1TyjAl
url: https://semgrep.dev/playground/r/e1TyjAl/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection
origin: community
languages:
- javascript
- typescript
severity: ERROR
pattern-either:
- pattern: |
require('grpc');
...
$GRPC($ADDR,...,$CREDENTIALS.createInsecure(),...);
- pattern: |
require('grpc');
...
new $GRPC($ADDR,...,$CREDENTIALS.createInsecure(),...);
- pattern: |-
require('grpc');
...
$CREDS = <... $CREDENTIALS.createInsecure() ...>;
...
$GRPC($ADDR,...,$CREDS,...);
- pattern: |-
require('grpc');
...
$CREDS = <... $CREDENTIALS.createInsecure() ...>;
...
new $GRPC($ADDR,...,$CREDS,...);
- id: javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
metadata:
interfile: true
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
asvs:
section: 'V3: Session Management Verification Requirements'
control_id: 3.5.2 Static API keys or secret
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
version: '4'
category: security
technology:
- jose
- jwt
- secrets
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret
shortlink: https://sg.run/Ro1g
semgrep.dev:
rule:
r_id: 9293
rv_id: 1263182
rule_id: JDUyRl
version_id: d6TyxbX
url: https://semgrep.dev/playground/r/d6TyxbX/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
$JOSE = require("jose");
...
- pattern-either:
- pattern-inside: |
var {JWT} = $JOSE;
...
- pattern-inside: |
var {JWK, JWT} = $JOSE;
...
- pattern-inside: |
const {JWT} = $JOSE;
...
- pattern-inside: |
const {JWK, JWT} = $JOSE;
...
- pattern-inside: |
let {JWT} = $JOSE;
...
- pattern-inside: |
let {JWK, JWT} = $JOSE;
...
- pattern-either:
- pattern: |
JWT.verify($P, "...", ...);
- pattern: |
JWT.sign($P, "...", ...);
- pattern: "JWT.verify($P, JWK.asKey(\"...\"), ...); \n"
- pattern: |
$JWT.sign($P, JWK.asKey("..."), ...);
options:
symbolic_propagation: true
interfile: true
- id: javascript.jose.security.jwt-none-alg.jwt-none-alg
message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm
assumes the integrity of the token has already been verified. This would allow
a malicious actor to forge a JWT token that will automatically be verified. Do
not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
asvs:
section: 'V3: Session Management Verification Requirements'
control_id: 3.5.3 Insecue Stateless Session Tokens
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
version: '4'
category: security
technology:
- jose
- jwt
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg
shortlink: https://sg.run/AvRL
semgrep.dev:
rule:
r_id: 9294
rv_id: 1263183
rule_id: 5rUOGN
version_id: ZRTKAyb
url: https://semgrep.dev/playground/r/ZRTKAyb/javascript.jose.security.jwt-none-alg.jwt-none-alg
origin: community
languages:
- javascript
- typescript
severity: ERROR
pattern-either:
- pattern: |
var $JOSE = require("jose");
...
var { JWK, JWT } = $JOSE;
...
var $T = JWT.verify($P, JWK.None,...);
- pattern: |
var $JOSE = require("jose");
...
var { JWK, JWT } = $JOSE;
...
$T = JWT.verify($P, JWK.None,...);
- pattern: |
var $JOSE = require("jose");
...
var { JWK, JWT } = $JOSE;
...
JWT.verify($P, JWK.None,...);
- id: javascript.jose.security.audit.jose-exposed-data.jose-exposed-data
message: The object is passed strictly to jose.JWT.sign(...) Make sure that sensitive
information is not exposed through JWT token payload.
metadata:
owasp:
- A02:2017 - Broken Authentication
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
cwe:
- 'CWE-522: Insufficiently Protected Credentials'
source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
asvs:
section: 'V3: Session Management Verification Requirements'
control_id: 3.5.2 Static API keys or secret
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
version: '4'
category: security
technology:
- jose
- jwt
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/javascript.jose.security.audit.jose-exposed-data.jose-exposed-data
shortlink: https://sg.run/BkAx
semgrep.dev:
rule:
r_id: 9295
rv_id: 1263181
rule_id: GdU7XP
version_id: vdT063g
url: https://semgrep.dev/playground/r/vdT063g/javascript.jose.security.audit.jose-exposed-data.jose-exposed-data
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
require('jose');
...
- pattern-either:
- patterns:
- pattern-inside: function (...,$INPUT,...) {...}
- pattern-either:
- pattern: $JOSE.JWT.sign($INPUT,...)
- pattern: $JWT.sign($INPUT,...)
- patterns:
- pattern-inside: function $F(...,$INPUT,...) {...}
- pattern-either:
- pattern: $JOSE.JWT.sign($INPUT,...)
- pattern: $JWT.sign($INPUT,...)
- id: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
asvs:
section: 'V3: Session Management Verification Requirements'
control_id: 3.5.2 Static API keys or secret
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
version: '4'
category: security
technology:
- jwt
- javascript
- secrets
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret
shortlink: https://sg.run/4xN9
semgrep.dev:
rule:
r_id: 9300
rv_id: 1263189
rule_id: WAUon7
version_id: gETB75D
url: https://semgrep.dev/playground/r/gETB75D/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern: "$X = '...' \n"
- pattern: "$X = '$Y' \n"
- patterns:
- pattern-either:
- pattern-inside: |
$JWT.sign($DATA,"...",...);
- pattern-inside: |
$JWT.verify($DATA,"...",...);
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
$JWT = require("jsonwebtoken")
...
- pattern-inside: |
import $JWT from "jsonwebtoken"
...
- pattern-inside: |
import * as $JWT from "jsonwebtoken"
...
- pattern-inside: |
import {...,$JWT,...} from "jsonwebtoken"
...
- pattern-either:
- pattern-inside: |
$JWT.sign($DATA,$VALUE,...);
- pattern-inside: |
$JWT.verify($DATA,$VALUE,...);
- focus-metavariable: $VALUE
- id: javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg
message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm
assumes the integrity of the token has already been verified. This would allow
a malicious actor to forge a JWT token that will automatically be verified. Do
not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
asvs:
section: 'V3: Session Management Verification Requirements'
control_id: 3.5.3 Insecue Stateless Session Tokens
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
version: '4'
category: security
technology:
- jwt
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg
shortlink: https://sg.run/PJXv
semgrep.dev:
rule:
r_id: 9301
rv_id: 1263190
rule_id: 0oU53g
version_id: QkTGqQo
url: https://semgrep.dev/playground/r/QkTGqQo/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg
origin: community
languages:
- javascript
- typescript
severity: ERROR
patterns:
- pattern-inside: |
$JWT = require("jsonwebtoken");
...
- pattern: $JWT.verify($P, $X, {algorithms:[...,'none',...]},...)
- id: javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify
message: Detected the decoding of a JWT token without a verify step. JWT tokens
must be verified before use, otherwise the token's integrity is unknown. This
means a malicious actor could forge a JWT token with any claims. Call '.verify()'
before using the token.
metadata:
cwe:
- 'CWE-345: Insufficient Verification of Data Authenticity'
owasp:
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
asvs:
section: 'V3: Session Management Verification Requirements'
control_id: 3.5.3 Insecue Stateless Session Tokens
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
version: '4'
category: security
technology:
- jwt
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
references:
- https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify
shortlink: https://sg.run/J9YP
semgrep.dev:
rule:
r_id: 9302
rv_id: 1263187
rule_id: KxUbL3
version_id: LjTkgpe
url: https://semgrep.dev/playground/r/LjTkgpe/javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
$JWT = require('jsonwebtoken');
...
- pattern-not-inside: |
...
$JWT.verify($TOKEN, ...)
...
- pattern-not-inside: |
...
if (<... $JWT.verify($TOKEN, ...) ...>) { ... }
...
- pattern: $JWT.decode($TOKEN, ...)
- id: javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data
message: The object is passed strictly to jsonwebtoken.sign(...) Make sure that
sensitive information is not exposed through JWT token payload.
metadata:
owasp:
- A02:2017 - Broken Authentication
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
cwe:
- 'CWE-522: Insufficiently Protected Credentials'
source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
asvs:
section: 'V3: Session Management Verification Requirements'
control_id: 3.5.3 Insecue Stateless Session Tokens
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
version: '4'
category: security
technology:
- jwt
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data
shortlink: https://sg.run/5Qkj
semgrep.dev:
rule:
r_id: 9303
rv_id: 1263188
rule_id: qNUjwe
version_id: 8KT5rLr
url: https://semgrep.dev/playground/r/8KT5rLr/javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
$JWT = require('jsonwebtoken');
...
- pattern-either:
- pattern-inside: function (...,$INPUT,...) {...}
- pattern-inside: function $F(...,$INPUT,...) {...}
- pattern: $JWT.sign($INPUT,...)
- id: javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert
message: Detected usage of noassert in Buffer API, which allows the offset the be
beyond the end of the buffer. This could result in writing or reading beyond the
end of the buffer.
metadata:
cwe:
- 'CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer'
source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-buffer-noassert.js
category: security
technology:
- javascript
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
references:
- https://cwe.mitre.org/data/definitions/119.html
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Memory Issues
source: https://semgrep.dev/r/javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert
shortlink: https://sg.run/qxpO
semgrep.dev:
rule:
r_id: 9312
rv_id: 945886
rule_id: j2Uvj8
version_id: 9lTy1Y6
url: https://semgrep.dev/playground/r/9lTy1Y6/javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern: $OBJ.$API(..., true)
- metavariable-regex:
metavariable: $API
regex: (read|write)(U?Int8|(U?Int(16|32)|Float|Double)(LE|BE))
- id: javascript.lang.security.detect-child-process.detect-child-process
message: 'Detected calls to child_process from a function argument `$FUNC`. This
could lead to a command injection if the input is user controllable. Try to avoid
calls to child_process, and if it is needed ensure user input is correctly sanitized
or sandboxed. '
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions
source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-child-process.js
category: security
technology:
- javascript
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/javascript.lang.security.detect-child-process.detect-child-process
shortlink: https://sg.run/l2lo
semgrep.dev:
rule:
r_id: 9313
rv_id: 1409399
rule_id: 10UKNB
version_id: 5PT7KnG
url: https://semgrep.dev/playground/r/5PT7KnG/javascript.lang.security.detect-child-process.detect-child-process
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-inside: |
function ... (...,$FUNC,...) {
...
}
- focus-metavariable: $FUNC
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
$CP = require('child_process')
...
- pattern-inside: |
import * as $CP from 'child_process'
...
- pattern-inside: |
import $CP from 'child_process'
...
- pattern-either:
- pattern: $CP.exec($CMD,...)
- pattern: $CP.execSync($CMD,...)
- pattern: $CP.spawn($CMD,...)
- pattern: $CP.spawnSync($CMD,...)
- pattern-not-inside: $CP.$EXEC("...",...)
- pattern-not-inside: $CP.$EXEC(["...",...],...)
- pattern-not-inside: |
$CMD = "..."
...
- pattern-not-inside: |
$CMD = ["...",...]
...
- focus-metavariable: $CMD
- patterns:
- pattern-either:
- pattern: child_process.exec($CMD,...)
- pattern: child_process.execSync($CMD,...)
- pattern: child_process.spawn($CMD,...)
- pattern: child_process.spawnSync($CMD,...)
- pattern-not-inside: child_process.$EXEC("...",...)
- pattern-not-inside: child_process.$EXEC(["...",...],...)
- pattern-not-inside: |
$CMD = "..."
...
- pattern-not-inside: |
$CMD = ["...",...]
...
- focus-metavariable: $CMD
- id: javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape
message: Markup escaping disabled. This can be used with some template engines to
escape disabling of HTML entities, which can lead to XSS attacks.
metadata:
cwe:
- 'CWE-116: Improper Encoding or Escaping of Output'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-disable-mustache-escape.js
category: security
technology:
- mustache
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Encoding
source: https://semgrep.dev/r/javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape
shortlink: https://sg.run/Yvwd
semgrep.dev:
rule:
r_id: 9314
rv_id: 1263213
rule_id: 9AU17r
version_id: DkTRb3X
url: https://semgrep.dev/playground/r/DkTRb3X/javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape
origin: community
languages:
- javascript
- typescript
severity: WARNING
pattern: $OBJ.escapeMarkup = false
- id: javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression
message: Detected use of dynamic execution of JavaScript which may come from user-input,
which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input
in functions which dynamically execute user-input.
metadata:
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-eval-with-expression.js
references:
- https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!
category: security
technology:
- javascript
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression
shortlink: https://sg.run/6nwK
semgrep.dev:
rule:
r_id: 9315
rv_id: 1263214
rule_id: yyUngo
version_id: WrTqKkJ
url: https://semgrep.dev/playground/r/WrTqKkJ/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
$PROP = new URLSearchParams($WINDOW. ... .location.search).get('...')
...
- pattern-inside: |
$PROP = new URLSearchParams(location.search).get('...')
...
- pattern-inside: |
$PROP = new URLSearchParams($WINDOW. ... .location.hash.substring(1)).get('...')
...
- pattern-inside: |
$PROP = new URLSearchParams(location.hash.substring(1)).get('...')
...
- focus-metavariable: $PROP
- patterns:
- pattern-either:
- pattern-inside: |
$PROPS = new URLSearchParams($WINDOW. ... .location.search)
...
- pattern-inside: |
$PROPS = new URLSearchParams(location.search)
...
- pattern-inside: |
$PROPS = new
URLSearchParams($WINDOW. ... .location.hash.substring(1))
...
- pattern-inside: |
$PROPS = new URLSearchParams(location.hash.substring(1))
...
- pattern: $PROPS.get('...')
- focus-metavariable: $PROPS
- patterns:
- pattern-either:
- pattern: location.href
- pattern: location.hash
- pattern: location.search
- pattern: $WINDOW. ... .location.href
- pattern: $WINDOW. ... .location.hash
- pattern: $WINDOW. ... .location.search
pattern-sinks:
- patterns:
- pattern-either:
- pattern: eval(<... $SINK ...>)
- pattern: window.eval(<... $SINK ...>)
- pattern: new Function(<... $SINK ...>)
- pattern: new Function(<... $SINK ...>)(...)
- pattern: setTimeout(<... $SINK ...>,...)
- pattern: setInterval(<... $SINK ...>,...)
- focus-metavariable: $SINK
pattern-sanitizers:
- patterns:
- pattern-either:
- pattern: location.href = $FUNC(...)
- pattern: location.hash = $FUNC(...)
- pattern: location.search = $FUNC(...)
- pattern: $WINDOW. ... .location.href = $FUNC(...)
- pattern: $WINDOW. ... .location.hash = $FUNC(...)
- pattern: $WINDOW. ... .location.search = $FUNC(...)
- id: javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override
message: Detected use of express.csrf() middleware before express.methodOverride().
This can allow GET requests (which are not checked by csrf) to turn into POST
requests later.
metadata:
cwe:
- 'CWE-352: Cross-Site Request Forgery (CSRF)'
source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-no-csrf-before-method-override.js
references:
- https://github.com/nodesecurity/eslint-plugin-security/blob/master/docs/bypass-connect-csrf-protection-by-abusing.md
category: security
technology:
- javascript
owasp:
- A01:2021 - Broken Access Control
- A05:2017 - Broken Access Control
- A01:2025 - Broken Access Control
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site Request Forgery (CSRF)
source: https://semgrep.dev/r/javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override
shortlink: https://sg.run/oxoX
semgrep.dev:
rule:
r_id: 9316
rv_id: 1263216
rule_id: r6UrvQ
version_id: K3TKkPO
url: https://semgrep.dev/playground/r/K3TKkPO/javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override
origin: community
languages:
- javascript
- typescript
severity: WARNING
pattern: |
express.csrf();
...
express.methodOverride();
- id: javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes
message: Detected usage of crypto.pseudoRandomBytes, which does not produce secure
random numbers.
metadata:
cwe:
- 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)'
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-pseudoRandomBytes.js
asvs:
section: 'V6: Stored Cryptography Verification Requirements'
control_id: 6.3.1 Insecure Randomness
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v63-random-values
version: '4'
category: security
technology:
- javascript
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes
shortlink: https://sg.run/pxze
semgrep.dev:
rule:
r_id: 9318
rv_id: 1263217
rule_id: NbUkR2
version_id: qkTR799
url: https://semgrep.dev/playground/r/qkTR799/javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes
origin: community
languages:
- javascript
- typescript
severity: WARNING
pattern: crypto.pseudoRandomBytes
- id: javascript.lang.security.spawn-git-clone.spawn-git-clone
message: Git allows shell commands to be specified in ext URLs for remote repositories.
For example, git clone 'ext::sh -c whoami% >&2' will execute the whoami command
to try to connect to a remote repository. Make sure that the URL is not controlled
by external input.
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- git
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/javascript.lang.security.spawn-git-clone.spawn-git-clone
shortlink: https://sg.run/2xrr
semgrep.dev:
rule:
r_id: 9319
rv_id: 1263220
rule_id: kxUkPP
version_id: 6xT29A7
url: https://semgrep.dev/playground/r/6xT29A7/javascript.lang.security.spawn-git-clone.spawn-git-clone
origin: community
languages:
- javascript
- typescript
severity: ERROR
patterns:
- pattern-either:
- pattern: spawn('git', ['clone',...,$F])
- pattern: $X.spawn('git', ['clone',...,$F])
- pattern: spawn('git', ['clone',...,$P,$F])
- pattern: $X.spawn('git', ['clone',...,$P,$F])
- pattern-not: spawn('git', ['clone',...,"..."])
- pattern-not: $X.spawn('git', ['clone',...,"..."])
- pattern-not: spawn('git', ['clone',...,"...","..."])
- pattern-not: $X.spawn('git', ['clone',...,"...","..."])
- id: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag
message: Cannot determine what '$UNK' is and it is used with a '<script>' tag. This
could be susceptible to cross-site scripting (XSS). Ensure '$UNK' is not externally
controlled, or sanitize this data.
metadata:
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://www.developsec.com/2017/11/09/xss-in-a-script-tag/
- https://github.com/juice-shop/juice-shop/blob/1ceb8751e986dacd3214a618c37e7411be6bc11a/routes/videoHandler.ts#L68
category: security
technology:
- javascript
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag
shortlink: https://sg.run/1Zy1
semgrep.dev:
rule:
r_id: 9322
rv_id: 1263209
rule_id: OrU37Y
version_id: GxTke48
url: https://semgrep.dev/playground/r/GxTke48/javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
$UNK = $ANYFUNC(...);
...
$OTHERFUNC(..., <... $UNK ...>, ...);
- pattern: $OTHERFUNC(..., <... "=~/.*<script.*/" ...>, ...)
- pattern: $UNK
- id: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
message: Detected possible user input going into a `path.join` or `path.resolve`
function. This could possibly lead to a path traversal vulnerability, where the
attacker can access arbitrary files stored in the file system. Instead, be sure
to sanitize or validate user input first.
metadata:
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
category: security
references:
- https://owasp.org/www-community/attacks/Path_Traversal
technology:
- javascript
- node.js
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
shortlink: https://sg.run/OPqk
semgrep.dev:
rule:
r_id: 9331
rv_id: 1409398
rule_id: 8GUjrq
version_id: JdTnO7r
url: https://semgrep.dev/playground/r/JdTnO7r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- focus-metavariable: $X
- pattern-either:
- pattern-inside: |
function ... (...,$X,...) {...}
- pattern-inside: |
function ... (...,{...,$X,...},...) {...}
pattern-sinks:
- patterns:
- focus-metavariable: $SINK
- pattern-either:
- pattern-inside: |
$PATH = require('path');
...
- pattern-inside: |
import $PATH from 'path';
...
- pattern-either:
- pattern: $PATH.join(...,$SINK,...)
- pattern: $PATH.resolve(...,$SINK,...)
- patterns:
- focus-metavariable: $SINK
- pattern-inside: |
import 'path';
...
- pattern-either:
- pattern-inside: path.join(...,$SINK,...)
- pattern-inside: path.resolve(...,$SINK,...)
pattern-sanitizers:
- pattern: $Y.replace(...)
- pattern: $Y.indexOf(...)
- pattern: |
function ... (...) {
...
<... $Y.indexOf(...) ...>
...
}
- patterns:
- pattern: $FUNC(...)
- metavariable-regex:
metavariable: $FUNC
regex: sanitize
- id: javascript.node-expat.security.audit.expat-xxe.expat-xxe
message: If unverified user data can reach the XML Parser it can result in XML External
or Internal Entity (XXE) Processing vulnerabilities
metadata:
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
category: security
technology:
- node-expat
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
references:
- https://owasp.org/Top10/A05_2021-Security_Misconfiguration
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/javascript.node-expat.security.audit.expat-xxe.expat-xxe
shortlink: https://sg.run/eLdL
semgrep.dev:
rule:
r_id: 9332
rv_id: 1263224
rule_id: gxU171
version_id: 2KTv2AZ
url: https://semgrep.dev/playground/r/2KTv2AZ/javascript.node-expat.security.audit.expat-xxe.expat-xxe
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-either:
- pattern: |
var $EXPAT = require('node-expat');
...
new $EXPAT.Parser(...);
...
$PARSER.parse(...);
- pattern: |
var $EXPAT = require('node-expat');
...
new $EXPAT.Parser(...);
...
$PARSER.write(...);
- pattern: |
require('node-expat');
...
new Parser(...);
...
$PARSER.parse(...);
- pattern: |
require('node-expat');
...
new Parser(...);
...
$PARSER.write(...);
- pattern-not: |
var $EXPAT = require('node-expat');
...
new $EXPAT.Parser(...);
...
$PARSER.parse("...");
- pattern-not: |
var $EXPAT = require('node-expat');
...
new $EXPAT.Parser(...);
...
$PARSER.write("...");
- pattern-not: |
require('node-expat');
...
new Parser(...);
...
$PARSER.parse("...");
- pattern-not: |
require('node-expat');
...
new Parser(...);
...
$PARSER.write("...");
- pattern-not: |
$X = "...";
...
$PARSER.parse($X);
- pattern-not: |-
$X = "...";
...
$PARSER.write($X);
- id: javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
asvs:
section: 'V3: Session Management Verification Requirements'
control_id: 3.5.2 Static API keys or secret
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
version: '4'
category: security
technology:
- jwt
- nodejs
- secrets
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret
shortlink: https://sg.run/vz70
semgrep.dev:
rule:
r_id: 9333
rv_id: 1263225
rule_id: QrUzq6
version_id: X0TzyoE
url: https://semgrep.dev/playground/r/X0TzyoE/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- by-side-effect: true
patterns:
- pattern-either:
- pattern: |
{..., clientSecret: "...", ...}
- pattern: |
{..., secretOrKey: "...", ...}
- pattern: |
{..., consumerSecret: "...", ...}
- patterns:
- pattern-inside: |
$OBJ = {}
...
- pattern-either:
- pattern: |
$OBJ.clientSecret = "..."
- pattern: |
$OBJ.secretOrKey = "..."
- pattern: |
$OBJ.consumerSecret = "..."
- pattern: $OBJ
- patterns:
- pattern-inside: |
$SECRET = '...'
...
- pattern-either:
- pattern: |
{..., clientSecret: $SECRET, ...}
- pattern: |
{..., secretOrKey: $SECRET, ...}
- pattern: |
{..., consumerSecret: $SECRET, ...}
- patterns:
- pattern-inside: |
$SECRET = '...'
...
- pattern-either:
- pattern-inside: |
$VALUE = {..., clientSecret: $SECRET, ...}
...
- pattern-inside: |
$VALUE = {..., secretOrKey: $SECRET, ...}
...
- pattern-inside: |
$VALUE = {..., consumerSecret: $SECRET, ...}
...
- pattern: $VALUE
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
$F = require("$I").Strategy
...
- pattern-inside: |
$F = require("$I")
...
- pattern-inside: |
import { $STRAT as $F } from '$I'
...
- pattern-inside: |
import $F from '$I'
...
- metavariable-regex:
metavariable: $I
regex: (passport-.*)
- pattern-inside: |
new $F($VALUE,...)
- focus-metavariable: $VALUE
- id: javascript.phantom.security.audit.phantom-injection.phantom-injection
message: If unverified user data can reach the `phantom` page methods it can result
in Server-Side Request Forgery vulnerabilities
metadata:
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
category: security
technology:
- phantom
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
references:
- https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/javascript.phantom.security.audit.phantom-injection.phantom-injection
shortlink: https://sg.run/dKv0
semgrep.dev:
rule:
r_id: 9334
rv_id: 1263226
rule_id: 3qUPXE
version_id: jQTn5Ld
url: https://semgrep.dev/playground/r/jQTn5Ld/javascript.phantom.security.audit.phantom-injection.phantom-injection
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
$PHANTOM = require('phantom');
...
- pattern-either:
- pattern: $PAGE.open($INPUT,...)
- pattern: $PAGE.property("content",$INPUT,...)
- pattern: $PAGE.setContent($INPUT,...)
- pattern: $PAGE.openUrl($INPUT,...)
- pattern: $PAGE.evaluateJavaScript($INPUT,...)
- pattern-not: $PAGE.open("...",...)
- pattern-not: $PAGE.property("content","...",...)
- pattern-not: $PAGE.setContent("...",...)
- pattern-not: $PAGE.openUrl("...",...)
- pattern-not: $PAGE.evaluateJavaScript("...",...)
- id: javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection
message: If unverified user data can reach the `addInitScript` method it can result
in Server-Side Request Forgery vulnerabilities
metadata:
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
category: security
technology:
- playwright
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
references:
- https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection
shortlink: https://sg.run/Zv94
semgrep.dev:
rule:
r_id: 9335
rv_id: 1263227
rule_id: 4bUkj1
version_id: 1QTyp0G
url: https://semgrep.dev/playground/r/1QTyp0G/javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
require('playwright');
...
- pattern-not-inside: |
var $INPUT = function $FNAME(...){...};
...
- pattern: $CONTEXT.addInitScript($INPUT,...)
- pattern-not: $CONTEXT.addInitScript("...",...)
- pattern-not: $CONTEXT.addInitScript(function(...){...},...)
- id: javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection
message: If unverified user data can reach the `evaluate` method it can result in
Server-Side Request Forgery vulnerabilities
metadata:
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
category: security
technology:
- playwright
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
references:
- https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection
shortlink: https://sg.run/ndgr
semgrep.dev:
rule:
r_id: 9336
rv_id: 1263228
rule_id: PeUZ30
version_id: 9lT4bEx
url: https://semgrep.dev/playground/r/9lT4bEx/javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
require('playwright');
...
- pattern-either:
- pattern-inside: function $FUNC (...,$INPUT,...) {...}
- pattern-inside: function (...,$INPUT,...) {...}
- pattern-either:
- pattern: $PAGE.evaluate($CODE,...,<... $INPUT ...>,...)
- pattern: $PAGE.evaluateHandle($CODE,...,<... $INPUT ...>,...)
- id: javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection
message: If unverified user data can reach the `evaluate` method it can result in
Server-Side Request Forgery vulnerabilities
metadata:
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
category: security
technology:
- playwright
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
references:
- https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection
shortlink: https://sg.run/EkJB
semgrep.dev:
rule:
r_id: 9337
rv_id: 1263229
rule_id: JDUyxl
version_id: yeTxpQ7
url: https://semgrep.dev/playground/r/yeTxpQ7/javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
require('playwright');
...
- pattern-not-inside: |
var $INPUT = function $FNAME(...){...};
...
- pattern-either:
- pattern: $PAGE.evaluate($INPUT,...)
- pattern: $PAGE.evaluateHandle($INPUT,...)
- pattern: $PAGE.evaluateOnNewDocument($INPUT,...)
- pattern-not: $PAGE.evaluate("...",...)
- pattern-not: $PAGE.evaluate(function(...){...},...)
- pattern-not: $PAGE.evaluateHandle("...",...)
- pattern-not: $PAGE.evaluateHandle(function(...){...},...)
- pattern-not: $PAGE.evaluateOnNewDocument("...",...)
- pattern-not: $PAGE.evaluateOnNewDocument(function(...){...},...)
- id: javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools
message: Remote debugging protocol does not perform any authentication, so exposing
it too widely can be a security risk.
metadata:
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
category: security
technology:
- playwright
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools
shortlink: https://sg.run/7oEQ
semgrep.dev:
rule:
r_id: 9338
rv_id: 1263230
rule_id: 5rUO1N
version_id: rxTAKbz
url: https://semgrep.dev/playground/r/rxTAKbz/javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
require('playwright');
...
- pattern-either:
- pattern-regex: --remote-debugging-address
- pattern-regex: --remote-debugging-port
- pattern-regex: --remote-debugging-socket-name
- pattern-regex: --remote-debugging-targets
- id: javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection
message: If unverified user data can reach the `goto` method it can result in Server-Side
Request Forgery vulnerabilities
metadata:
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
category: security
technology:
- playwright
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
references:
- https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection
shortlink: https://sg.run/LwWY
semgrep.dev:
rule:
r_id: 9339
rv_id: 1263231
rule_id: GdU7eP
version_id: bZT53xo
url: https://semgrep.dev/playground/r/bZT53xo/javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
require('playwright');
...
- pattern-not-inside: |
require('playwright');
...
var $INPUT = "...";
...
$PAGE.goto($INPUT,...)
- pattern: $PAGE.goto($INPUT,...)
- pattern-not: $PAGE.goto("...",...)
- id: javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection
message: If unverified user data can reach the `setContent` method it can result
in Server-Side Request Forgery vulnerabilities
metadata:
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
category: security
technology:
- playwright
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
references:
- https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection
shortlink: https://sg.run/8yEQ
semgrep.dev:
rule:
r_id: 9340
rv_id: 1263232
rule_id: ReUgLk
version_id: NdTzy5y
url: https://semgrep.dev/playground/r/NdTzy5y/javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
require('playwright');
...
- pattern-not-inside: |
require('playwright');
...
var $INPUT = "...";
...
$PAGE.setContent($INPUT,...)
- pattern: $PAGE.setContent($INPUT,...)
- pattern-not: $PAGE.setContent("...",...)
- id: javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection
message: If unverified user data can reach the `evaluate` method it can result in
Server-Side Request Forgery vulnerabilities
metadata:
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
category: security
technology:
- puppeteer
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
references:
- https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection
shortlink: https://sg.run/gLQ5
semgrep.dev:
rule:
r_id: 9341
rv_id: 1263233
rule_id: AbUzdX
version_id: kbTzGrb
url: https://semgrep.dev/playground/r/kbTzGrb/javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
require('puppeteer');
...
- pattern-either:
- pattern-inside: function $FUNC (...,$INPUT,...) {...}
- pattern-inside: function (...,$INPUT,...) {...}
- pattern-either:
- pattern: $PAGE.evaluate($CODE,...,<... $INPUT ...>,...)
- pattern: $PAGE.evaluateHandle($CODE,...,<... $INPUT ...>,...)
- pattern: $PAGE.evaluateOnNewDocument($CODE,...,<... $INPUT ...>,...)
- id: javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection
message: If unverified user data can reach the `evaluate` method it can result in
Server-Side Request Forgery vulnerabilities
metadata:
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
category: security
technology:
- puppeteer
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
references:
- https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection
shortlink: https://sg.run/Q5Yq
semgrep.dev:
rule:
r_id: 9342
rv_id: 1263234
rule_id: BYUNZk
version_id: w8TRo4w
url: https://semgrep.dev/playground/r/w8TRo4w/javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
require('puppeteer');
...
- pattern-not-inside: |
var $INPUT = function $FNAME(...){...};
...
- pattern-either:
- pattern: $PAGE.evaluate($INPUT,...)
- pattern: $PAGE.evaluateHandle($INPUT,...)
- pattern: $PAGE.evaluateOnNewDocument($INPUT,...)
- pattern-not: $PAGE.evaluate("...",...)
- pattern-not: $PAGE.evaluate(function(...){...},...)
- pattern-not: $PAGE.evaluateHandle("...",...)
- pattern-not: $PAGE.evaluateHandle(function(...){...},...)
- pattern-not: $PAGE.evaluateOnNewDocument("...",...)
- pattern-not: $PAGE.evaluateOnNewDocument(function(...){...},...)
- id: javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools
message: Remote debugging protocol does not perform any authentication, so exposing
it too widely can be a security risk.
metadata:
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
category: security
technology:
- puppeteer
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools
shortlink: https://sg.run/3xEW
semgrep.dev:
rule:
r_id: 9343
rv_id: 1263235
rule_id: DbUpbk
version_id: xyTjz9X
url: https://semgrep.dev/playground/r/xyTjz9X/javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
require('puppeteer');
...
- pattern-either:
- pattern-regex: --remote-debugging-address
- pattern-regex: --remote-debugging-port
- pattern-regex: --remote-debugging-socket-name
- pattern-regex: --remote-debugging-targets
- id: javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection
message: If unverified user data can reach the `goto` method it can result in Server-Side
Request Forgery vulnerabilities
metadata:
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
category: security
technology:
- puppeteer
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
references:
- https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection
shortlink: https://sg.run/4xE9
semgrep.dev:
rule:
r_id: 9344
rv_id: 1263236
rule_id: WAUoK7
version_id: O9Tpx4P
url: https://semgrep.dev/playground/r/O9Tpx4P/javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
require('puppeteer');
...
- pattern-not-inside: |
require('puppeteer');
...
var $INPUT = "...";
...
$PAGE.goto($INPUT,...)
- pattern: $PAGE.goto($INPUT,...)
- pattern-not: $PAGE.goto("...",...)
- id: javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection
message: If unverified user data can reach the `setContent` method it can result
in Server-Side Request Forgery vulnerabilities
metadata:
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
category: security
technology:
- puppeteer
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
references:
- https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection
shortlink: https://sg.run/PJlv
semgrep.dev:
rule:
r_id: 9345
rv_id: 1263237
rule_id: 0oU5zg
version_id: e1TyjEx
url: https://semgrep.dev/playground/r/e1TyjEx/javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
require('puppeteer');
...
- pattern-not-inside: |
require('puppeteer');
...
var $INPUT = "...";
...
- pattern: $PAGE.setContent($INPUT,...)
- pattern-not: $PAGE.setContent("...",...)
- id: javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection
message: Make sure that unverified user data can not reach `sandbox`.
metadata:
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
category: security
technology:
- sandbox
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection
shortlink: https://sg.run/J9BP
semgrep.dev:
rule:
r_id: 9346
rv_id: 1263238
rule_id: KxUbk3
version_id: vdT06Dk
url: https://semgrep.dev/playground/r/vdT06Dk/javascript.sandbox.security.audit.sandbox-code-injection.sandbox-code-injection
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
$SANDBOX = require('sandbox');
...
- pattern-not-inside: |
$CODE = "...";
...
- pattern-either:
- patterns:
- pattern-inside: |
$S = new $SANDBOX(...);
...
- pattern: $S.run($CODE,...);
- pattern: |
new $SANDBOX(...).run($CODE,...);
- pattern-not-inside: |
$S = new $SANDBOX(...);
...
$S.run("...",...);
- pattern-not-inside: new $SANDBOX(...).run("...",...);
- id: javascript.sax.security.audit.sax-xxe.sax-xxe
message: Use of 'ondoctype' in 'sax' library detected. By default, 'sax' won't do
anything with custom DTD entity definitions. If you're implementing a custom DTD
entity definition, be sure not to introduce XML External Entity (XXE) vulnerabilities,
or be absolutely sure that external entities received from a trusted source while
processing XML.
metadata:
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
references:
- https://github.com/Leonidas-from-XIV/node-xml2js/issues/415
- https://github.com/isaacs/sax-js
category: security
technology:
- sax
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/javascript.sax.security.audit.sax-xxe.sax-xxe
shortlink: https://sg.run/5QEj
semgrep.dev:
rule:
r_id: 9347
rv_id: 1263239
rule_id: qNUj7e
version_id: d6Tyxn9
url: https://semgrep.dev/playground/r/d6Tyxn9/javascript.sax.security.audit.sax-xxe.sax-xxe
origin: community
languages:
- javascript
- typescript
severity: WARNING
pattern-either:
- pattern: |
require('sax');
...
$PARSER.ondoctype = ...;
- pattern: |-
require('sax');
...
$PARSER.on('doctype',...);
- id: javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript
message: '`serialize-javascript` used with `unsafe` parameter, this could be vulnerable
to XSS.'
metadata:
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic
XSS)'
category: security
technology:
- serialize-javascript
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript
shortlink: https://sg.run/Ro6N
semgrep.dev:
rule:
r_id: 9349
rv_id: 1263245
rule_id: YGURez
version_id: 8KT5r0E
url: https://semgrep.dev/playground/r/8KT5r0E/javascript.serialize-javascript.security.audit.unsafe-serialize-javascript.unsafe-serialize-javascript
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
$S = require('serialize-javascript');
...
- pattern-not-inside: escape(...)
- pattern-not-inside: encodeURI(...)
- pattern: |
$S(..., {unsafe: true});
- id: javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection
message: If unverified user data can reach the `exec` method it can result in Remote
Code Execution
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
category: security
technology:
- shelljs
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection
shortlink: https://sg.run/AvEB
semgrep.dev:
rule:
r_id: 9350
rv_id: 1263246
rule_id: 6JUj9k
version_id: gETB7pY
url: https://semgrep.dev/playground/r/gETB7pY/javascript.shelljs.security.shelljs-exec-injection.shelljs-exec-injection
origin: community
languages:
- javascript
- typescript
severity: ERROR
patterns:
- pattern-inside: |
require('shelljs');
...
- pattern-not-inside: |
require('shelljs');
...
var $INPUT = "...";
...
- pattern: $SHELL.exec($INPUT,...)
- pattern-not: $SHELL.exec("...",...)
- id: javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution
message: Potential arbitrary code execution, piped to eval
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- thenify
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution
shortlink: https://sg.run/BkER
semgrep.dev:
rule:
r_id: 9351
rv_id: 1263247
rule_id: oqUeDG
version_id: QkTGqLd
url: https://semgrep.dev/playground/r/QkTGqLd/javascript.thenify.security.audit.multiargs-code-execution.multiargs-code-execution
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-either:
- pattern: |
$THENIFY($FN, {multiArgs: ...},...)
- pattern: |
$OPTS = {multiArgs: ...};
...
$THENIFY($FN,$OPTS,...);
- pattern-not: |
$THENIFY($FN, {multiArgs: false},...)
- pattern-not: |
$OPTS = {multiArgs: false};
...
$THENIFY($FN,$OPTS,...)
- pattern-either:
- pattern-inside: |
$THENIFY = require('thenify');
...
- pattern-inside: |
import 'thenify';
...
- id: javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection
message: Make sure that unverified user data can not reach `vm2`.
metadata:
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
category: security
technology:
- vm2
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection
shortlink: https://sg.run/DoPG
semgrep.dev:
rule:
r_id: 9352
rv_id: 1263248
rule_id: zdUk2g
version_id: 3ZT4Xg6
url: https://semgrep.dev/playground/r/3ZT4Xg6/javascript.vm2.security.audit.vm2-code-injection.vm2-code-injection
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
require('vm2');
...
- pattern-not-inside: |
$CODE = "...";
...
- pattern-not-inside: |
require('vm2');
...
$CODE = new VMScript(...);
...
- pattern-either:
- pattern: |
$VM = new VM(...);
...
$VM.run($CODE,...);
- pattern: |
new VM(...).run($CODE,...);
- pattern: |
$VM = new NodeVM(...);
...
$VM.run($CODE,...);
- pattern: |
new NodeVM(...).run($CODE,...);
- pattern: |
new VMScript($CODE,...);
- pattern-not: |
$VM = new VM(...);
...
$VM.run("...",...);
- pattern-not: |
$VM = new NodeVM(...);
...
$VM.run("...",...);
- pattern-not: |
(new VM(...)).run("...",...);
- pattern-not: |
(new NodeVM(...)).run("...",...);
- pattern-not: new VMScript("...",...);
- id: php.lang.security.assert-use.assert-use
mode: taint
pattern-sources:
- pattern-either:
- patterns:
- pattern-either:
- pattern: $_GET
- pattern: $_POST
- pattern: $_COOKIE
- pattern: $_REQUEST
- pattern: $_SERVER
- patterns:
- pattern: |
Route::$METHOD($ROUTENAME, function(..., $ARG, ...) { ... })
- focus-metavariable: $ARG
pattern-sinks:
- patterns:
- pattern: assert($SINK, ...);
- pattern-not: assert("...", ...);
- pattern: $SINK
message: Calling assert with user input is equivalent to eval'ing.
metadata:
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
references:
- https://www.php.net/manual/en/function.assert
- https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/AssertsSniff.php
category: security
technology:
- php
confidence: HIGH
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/php.lang.security.assert-use.assert-use
shortlink: https://sg.run/3xXW
semgrep.dev:
rule:
r_id: 9387
rv_id: 1263272
rule_id: DbUpjk
version_id: 9lT4bLx
url: https://semgrep.dev/playground/r/9lT4bLx/php.lang.security.assert-use.assert-use
origin: community
languages:
- php
severity: ERROR
- id: php.lang.security.backticks-use.backticks-use
pattern: '`...`;'
message: Backticks use may lead to command injection vulnerabilities.
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
references:
- https://www.php.net/manual/en/language.operators.execution.php
- https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/BackticksSniff.php
category: security
technology:
- php
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/php.lang.security.backticks-use.backticks-use
shortlink: https://sg.run/4xj9
semgrep.dev:
rule:
r_id: 9388
rv_id: 1263276
rule_id: WAUow7
version_id: NdTzyEy
url: https://semgrep.dev/playground/r/NdTzyEy/php.lang.security.backticks-use.backticks-use
origin: community
languages:
- php
severity: ERROR
- id: javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection
message: Make sure that unverified user data can not reach `vm2`.
metadata:
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
category: security
technology:
- vm2
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection
shortlink: https://sg.run/W8XE
semgrep.dev:
rule:
r_id: 9353
rv_id: 1263249
rule_id: pKUO3v
version_id: 44TEjJQ
url: https://semgrep.dev/playground/r/44TEjJQ/javascript.vm2.security.audit.vm2-context-injection.vm2-context-injection
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
$VM = require('vm2');
...
- pattern-either:
- pattern: |
function (...,$INPUT,...) {
...
new VM({sandbox: <... $INPUT ...>},...);
...
}
- pattern: |
function (...,$INPUT,...) {
...
$CONTEXT = <... $INPUT ...>;
...
new VM({sandbox: <... $CONTEXT ...>},...);
...
}
- pattern: |
function (...,$INPUT,...) {
...
$CONTEXT = <... {$NAME:$INPUT} ...>;
...
new VM({sandbox: <... $CONTEXT ...>},...);
...
}
- pattern: |
function (...,$INPUT,...) {
...
$CONTEXT = {$NAME: <... $INPUT ...>};
...
new VM({sandbox: <... $CONTEXT ...>},...);
...
}
- pattern: |
function (...,$INPUT,...) {
...
$VAR = <... $INPUT ...>;
...
$CONTEXT = {$NAME: <... $VAR ...>};
...
new VM({sandbox: <... $CONTEXT ...>},...);
...
}
- pattern: |
function (...,$INPUT,...) {
...
$OPTS = {sandbox: <... $INPUT ...>};
...
new VM($OPTS,...);
...
}
- pattern: |
function (...,$INPUT,...) {
...
$CONTEXT = <... $INPUT ...>;
...
$OPTS = {sandbox: <... $CONTEXT ...>};
...
new VM($OPTS,...);
...
}
- pattern: |
function (...,$INPUT,...) {
...
$CONTEXT = {$NAME: <... $INPUT ...>};
...
$OPTS = {sandbox: <... $CONTEXT ...>};
...
new VM($OPTS,...);
...
}
- pattern: |
function (...,$INPUT,...) {
...
$VAR = <... $INPUT ...>;
...
$CONTEXT = {$NAME: <... $VAR ...>};
...
$OPTS = {sandbox: <... $CONTEXT ...>};
...
new VM($OPTS,...);
...
}
- pattern: |
function $F(...,$INPUT,...) {
...
new VM({sandbox: <... $INPUT ...>},...);
...
}
- pattern: |
function $F(...,$INPUT,...) {
...
$CONTEXT = <... $INPUT ...>;
...
new VM({sandbox: <... $CONTEXT ...>},...);
...
}
- pattern: |
function $F(...,$INPUT,...) {
...
$CONTEXT = <... {$NAME:$INPUT} ...>;
...
new VM({sandbox: <... $CONTEXT ...>},...);
...
}
- pattern: |
function $F(...,$INPUT,...) {
...
$CONTEXT = {$NAME: <... $INPUT ...>};
...
new VM({sandbox: <... $CONTEXT ...>},...);
...
}
- pattern: |
function $F(...,$INPUT,...) {
...
$VAR = <... $INPUT ...>;
...
$CONTEXT = {$NAME: <... $VAR ...>};
...
new VM({sandbox: <... $CONTEXT ...>},...);
...
}
- pattern: |
function $F(...,$INPUT,...) {
...
$OPTS = {sandbox: <... $INPUT ...>};
...
new VM($OPTS,...);
...
}
- pattern: |
function $F(...,$INPUT,...) {
...
$CONTEXT = <... $INPUT ...>;
...
$OPTS = {sandbox: <... $CONTEXT ...>};
...
new VM($OPTS,...);
...
}
- pattern: |
function $F(...,$INPUT,...) {
...
$CONTEXT = {$NAME: <... $INPUT ...>};
...
$OPTS = {sandbox: <... $CONTEXT ...>};
...
new VM($OPTS,...);
...
}
- pattern: |
function $F(...,$INPUT,...) {
...
$VAR = <... $INPUT ...>;
...
$CONTEXT = {$NAME: <... $VAR ...>};
...
$OPTS = {sandbox: <... $CONTEXT ...>};
...
new VM($OPTS,...);
...
}
- pattern: |
function (...,$INPUT,...) {
...
new NodeVM({sandbox: <... $INPUT ...>},...);
...
}
- pattern: |
function (...,$INPUT,...) {
...
$CONTEXT = <... $INPUT ...>;
...
new NodeVM({sandbox: <... $CONTEXT ...>},...);
...
}
- pattern: |
function (...,$INPUT,...) {
...
$CONTEXT = <... {$NAME:$INPUT} ...>;
...
new NodeVM({sandbox: <... $CONTEXT ...>},...);
...
}
- pattern: |
function (...,$INPUT,...) {
...
$CONTEXT = {$NAME: <... $INPUT ...>};
...
new NodeVM({sandbox: <... $CONTEXT ...>},...);
...
}
- pattern: |
function (...,$INPUT,...) {
...
$VAR = <... $INPUT ...>;
...
$CONTEXT = {$NAME: <... $VAR ...>};
...
new NodeVM({sandbox: <... $CONTEXT ...>},...);
...
}
- pattern: |
function (...,$INPUT,...) {
...
$OPTS = {sandbox: <... $INPUT ...>};
...
new NodeVM($OPTS,...);
...
}
- pattern: |
function (...,$INPUT,...) {
...
$CONTEXT = <... $INPUT ...>;
...
$OPTS = {sandbox: <... $CONTEXT ...>};
...
new NodeVM($OPTS,...);
...
}
- pattern: |
function (...,$INPUT,...) {
...
$CONTEXT = {$NAME: <... $INPUT ...>};
...
$OPTS = {sandbox: <... $CONTEXT ...>};
...
new NodeVM($OPTS,...);
...
}
- pattern: |
function (...,$INPUT,...) {
...
$VAR = <... $INPUT ...>;
...
$CONTEXT = {$NAME: <... $VAR ...>};
...
$OPTS = {sandbox: <... $CONTEXT ...>};
...
new NodeVM($OPTS,...);
...
}
- pattern: |
function $F(...,$INPUT,...) {
...
new NodeVM({sandbox: <... $INPUT ...>},...);
...
}
- pattern: |
function $F(...,$INPUT,...) {
...
$CONTEXT = <... $INPUT ...>;
...
new NodeVM({sandbox: <... $CONTEXT ...>},...);
...
}
- pattern: |
function $F(...,$INPUT,...) {
...
$CONTEXT = <... {$NAME:$INPUT} ...>;
...
new NodeVM({sandbox: <... $CONTEXT ...>},...);
...
}
- pattern: |
function $F(...,$INPUT,...) {
...
$CONTEXT = {$NAME: <... $INPUT ...>};
...
new NodeVM({sandbox: <... $CONTEXT ...>},...);
...
}
- pattern: |
function $F(...,$INPUT,...) {
...
$VAR = <... $INPUT ...>;
...
$CONTEXT = {$NAME: <... $VAR ...>};
...
new NodeVM({sandbox: <... $CONTEXT ...>},...);
...
}
- pattern: |
function $F(...,$INPUT,...) {
...
$OPTS = {sandbox: <... $INPUT ...>};
...
new NodeVM($OPTS,...);
...
}
- pattern: |
function $F(...,$INPUT,...) {
...
$CONTEXT = <... $INPUT ...>;
...
$OPTS = {sandbox: <... $CONTEXT ...>};
...
new NodeVM($OPTS,...);
...
}
- pattern: |
function $F(...,$INPUT,...) {
...
$CONTEXT = {$NAME: <... $INPUT ...>};
...
$OPTS = {sandbox: <... $CONTEXT ...>};
...
new NodeVM($OPTS,...);
...
}
- pattern: |-
function $F(...,$INPUT,...) {
...
$VAR = <... $INPUT ...>;
...
$CONTEXT = {$NAME: <... $VAR ...>};
...
$OPTS = {sandbox: <... $CONTEXT ...>};
...
new NodeVM($OPTS,...);
...
}
- id: php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off
patterns:
- pattern-either:
- pattern: |
$ARG = $IS_VERIFIED;
...
curl_setopt(..., CURLOPT_SSL_VERIFYPEER, $ARG);
- pattern: curl_setopt(..., CURLOPT_SSL_VERIFYPEER, $IS_VERIFIED)
- metavariable-regex:
metavariable: $IS_VERIFIED
regex: 0|false|null
message: SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER=
$IS_VERIFIED)
metadata:
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
references:
- https://www.saotn.org/dont-turn-off-curlopt_ssl_verifypeer-fix-php-configuration/
category: security
technology:
- php
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- vuln
likelihood: LOW
impact: LOW
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off
shortlink: https://sg.run/PJqv
semgrep.dev:
rule:
r_id: 9389
rv_id: 1263277
rule_id: 0oU5Xg
version_id: kbTzG9b
url: https://semgrep.dev/playground/r/kbTzG9b/php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off
origin: community
languages:
- php
severity: ERROR
- id: php.lang.security.eval-use.eval-use
patterns:
- pattern: eval(...);
- pattern-not: eval('...');
message: Evaluating non-constant commands. This can lead to command injection.
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
references:
- https://www.php.net/manual/en/function.eval
- https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php
category: security
technology:
- php
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/php.lang.security.eval-use.eval-use
shortlink: https://sg.run/J9AP
semgrep.dev:
rule:
r_id: 9390
rv_id: 1263279
rule_id: KxUbX3
version_id: xyTjz1X
url: https://semgrep.dev/playground/r/xyTjz1X/php.lang.security.eval-use.eval-use
origin: community
languages:
- php
severity: ERROR
- id: php.lang.security.exec-use.exec-use
patterns:
- pattern: $FUNC(...);
- pattern-not: $FUNC('...', ...);
- metavariable-regex:
metavariable: $FUNC
regex: exec|passthru|proc_open|popen|shell_exec|system|pcntl_exec
message: Executing non-constant commands. This can lead to command injection.
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
references:
- https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/SystemExecFunctionsSniff.php
category: security
technology:
- php
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/php.lang.security.exec-use.exec-use
shortlink: https://sg.run/5Q1j
semgrep.dev:
rule:
r_id: 9391
rv_id: 1263280
rule_id: qNUjye
version_id: O9TpxrP
url: https://semgrep.dev/playground/r/O9TpxrP/php.lang.security.exec-use.exec-use
origin: community
languages:
- php
severity: ERROR
- id: php.lang.security.ftp-use.ftp-use
patterns:
- pattern: $FUNC(...);
- metavariable-regex:
metavariable: $FUNC
regex: ftp_.+
message: FTP allows for unencrypted file transfers. Consider using an encrypted
alternative.
metadata:
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
references:
- https://www.php.net/manual/en/intro.ftp.php
- https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/FringeFunctionsSniff.php
category: security
technology:
- php
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/php.lang.security.ftp-use.ftp-use
shortlink: https://sg.run/RoYN
semgrep.dev:
rule:
r_id: 9393
rv_id: 1263282
rule_id: PeUZyE
version_id: vdT06Jk
url: https://semgrep.dev/playground/r/vdT06Jk/php.lang.security.ftp-use.ftp-use
origin: community
languages:
- php
severity: ERROR
- id: php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval
patterns:
- pattern: mb_ereg_replace($PATTERN, $REPL, $STR, $OPTIONS);
- pattern-not: mb_ereg_replace($PATTERN, $REPL, $STR, "...");
message: Calling mb_ereg_replace with user input in the options can lead to arbitrary
code execution. The eval modifier (`e`) evaluates the replacement argument as
code.
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
references:
- https://www.php.net/manual/en/function.mb-ereg-replace.php
- https://www.php.net/manual/en/function.mb-regex-set-options.php
category: security
technology:
- php
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval
shortlink: https://sg.run/AvdB
semgrep.dev:
rule:
r_id: 9394
rv_id: 1263293
rule_id: JDUyj4
version_id: 44TEjKQ
url: https://semgrep.dev/playground/r/44TEjKQ/php.lang.security.mb-ereg-replace-eval.mb-ereg-replace-eval
origin: community
languages:
- php
severity: ERROR
- id: php.lang.security.mcrypt-use.mcrypt-use
patterns:
- pattern: $FUNC(...);
- metavariable-regex:
metavariable: $FUNC
regex: (mcrypt_|mdecrypt_).+
message: Mcrypt functionality has been deprecated and/or removed in recent PHP versions.
Consider using Sodium or OpenSSL.
metadata:
cwe:
- 'CWE-676: Use of Potentially Dangerous Function'
references:
- https://www.php.net/manual/en/intro.mcrypt.php
- https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/CryptoFunctionsSniff.php
category: security
technology:
- php
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Dangerous Method or Function
source: https://semgrep.dev/r/php.lang.security.mcrypt-use.mcrypt-use
shortlink: https://sg.run/BkZR
semgrep.dev:
rule:
r_id: 9395
rv_id: 946006
rule_id: 5rUOzK
version_id: QkTZz5p
url: https://semgrep.dev/playground/r/QkTZz5p/php.lang.security.mcrypt-use.mcrypt-use
origin: community
languages:
- php
severity: ERROR
- id: php.lang.security.md5-loose-equality.md5-loose-equality
mode: taint
pattern-sinks:
- pattern: |
$VAR1 == $VAR2
- pattern: |
$VAR1 != $VAR2
pattern-sources:
- pattern: $PHAR->getSignature()
- pattern: $RARENTRY->getCrc()
- pattern: base_convert(...)
- pattern: bin2hex(...)
- pattern: dechex(...)
- pattern: hash_file(...)
- pattern: hash_final(...)
- pattern: hash_hmac_file(...)
- pattern: hash_hmac(...)
- pattern: hash_pbkdf2(...)
- pattern: hash(...)
- pattern: md5_file(...)
- pattern: md5(...)
- pattern: openssl_x509_fingerprint(...)
- pattern: rnp_locate_key(...)
- pattern: sha1_file(...)
- pattern: sha1(...)
- pattern: sodium_bin2hex(...)
pattern-sanitizers:
- pattern: strlen(...)
message: Make sure comparisons involving md5 values are strict (use `===` not `==`)
to avoid type juggling issues
metadata:
cwe:
- 'CWE-697: Incorrect Comparison'
references:
- https://www.php.net/manual/en/types.comparisons.php
- https://web.archive.org/web/20210430183236/https://www.whitehatsec.com/blog/magic-hashes/
category: security
technology:
- php
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/php.lang.security.md5-loose-equality.md5-loose-equality
shortlink: https://sg.run/Do4G
semgrep.dev:
rule:
r_id: 9396
rv_id: 1024161
rule_id: GdU7RO
version_id: 9lTWdQq
url: https://semgrep.dev/playground/r/9lTWdQq/php.lang.security.md5-loose-equality.md5-loose-equality
origin: community
languages:
- php
severity: ERROR
- id: php.lang.security.phpinfo-use.phpinfo-use
pattern: phpinfo(...);
message: The 'phpinfo' function may reveal sensitive information about your environment.
metadata:
cwe:
- 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
references:
- https://www.php.net/manual/en/function.phpinfo
- https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/PhpinfosSniff.php
category: security
technology:
- php
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/php.lang.security.phpinfo-use.phpinfo-use
shortlink: https://sg.run/W82E
semgrep.dev:
rule:
r_id: 9397
rv_id: 1263298
rule_id: ReUglY
version_id: RGT0LN0
url: https://semgrep.dev/playground/r/RGT0LN0/php.lang.security.phpinfo-use.phpinfo-use
origin: community
languages:
- php
severity: ERROR
- id: problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification
message: Checks for disabling of TLS/SSL certificate verification. This should only
be used for debugging purposes because it leads to vulnerability to MTM attacks.
severity: WARNING
metadata:
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://stackoverflow.com/questions/12122159/how-to-do-a-https-request-with-bad-certificate
subcategory:
- vuln
technology:
- go
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification
shortlink: https://sg.run/4xj5
semgrep.dev:
rule:
r_id: 9400
rv_id: 946043
rule_id: DbUpjg
version_id: ZRT358j
url: https://semgrep.dev/playground/r/ZRT358j/problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification
origin: community
languages:
- go
pattern-either:
- pattern: |
tls.Config{..., InsecureSkipVerify: true, ...}
- pattern: |
$CONFIG = &tls.Config{...}
...
$CONFIG.InsecureSkipVerify = true
- id: problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions
message: Detects creations of tls configuration objects with an insecure MinVersion
of TLS. These protocols are deprecated due to POODLE, man in the middle attacks,
and other vulnerabilities.
severity: WARNING
metadata:
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle
subcategory:
- vuln
technology:
- go
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions
shortlink: https://sg.run/PJqz
semgrep.dev:
rule:
r_id: 9401
rv_id: 946044
rule_id: WAUow9
version_id: nWTpzjW
url: https://semgrep.dev/playground/r/nWTpzjW/problem-based-packs.insecure-transport.go-stdlib.disallow-old-tls-versions.disallow-old-tls-versions
origin: community
languages:
- go
patterns:
- pattern-either:
- pattern: |
tls.Config{..., MinVersion: $TLS.$VERSION, ...}
- pattern: |
$CONFIG = &tls.Config{...}
...
$CONFIG.MinVersion = $TLS.$VERSION
- metavariable-regex:
metavariable: $VERSION
regex: (VersionTLS10|VersionTLS11|VersionSSL30)
- id: problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request
message: Checks for outgoing connections to ftp servers with the ftp package. FTP
does not encrypt traffic, possibly leading to PII being sent plaintext over the
network. Instead, connect via the SFTP protocol.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://godoc.org/github.com/jlaffaye/ftp#Dial
- https://github.com/jlaffaye/ftp
subcategory:
- vuln
technology:
- ftp
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request
shortlink: https://sg.run/J9Ay
semgrep.dev:
rule:
r_id: 9402
rv_id: 946045
rule_id: 0oU5XN
version_id: ExTg2Oj
url: https://semgrep.dev/playground/r/ExTg2Oj/problem-based-packs.insecure-transport.go-stdlib.ftp-request.ftp-request
origin: community
languages:
- go
fix-regex:
regex: '[fF][tT][pP]://'
replacement: sftp://
count: 1
pattern-either:
- pattern: |
ftp.Dial("=~/^[fF][tT][pP]://.*/", ...)
- pattern: |
ftp.DialTimeout("=~/^[fF][tT][pP]://.*/", ...)
- pattern: |
ftp.Connect("=~/^[fF][tT][pP]://.*/")
- pattern: |
$URL = "=~/^[fF][tT][pP]://.*/"
...
ftp.Dial($URL, ...)
- pattern: |
$URL = "=~/^[fF][tT][pP]://.*/"
...
ftp.DialTimeout($URL, ...)
- pattern: |
$URL = "=~/^[fF][tT][pP]://.*/"
...
ftp.Connect($URL)
- id: problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request
message: Checks for requests to http (unencrypted) sites using gorequest, a popular
HTTP client library. This is dangerous because it could result in plaintext PII
being passed around the network.
severity: WARNING
metadata:
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://github.com/parnurzeal/gorequest
subcategory:
- vuln
technology:
- gorequest
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request
shortlink: https://sg.run/5Q10
semgrep.dev:
rule:
r_id: 9403
rv_id: 946046
rule_id: KxUbXx
version_id: 7ZTrQdD
url: https://semgrep.dev/playground/r/7ZTrQdD/problem-based-packs.insecure-transport.go-stdlib.gorequest-http-request.gorequest-http-request
origin: community
languages:
- go
pattern-either:
- patterns:
- pattern-inside: |
$REQ = gorequest.New()
...
$RES = ...
- pattern: |
$REQ.$FUNC("=~/[hH][tT][tT][pP]://.*/")
- metavariable-regex:
metavariable: $FUNC
regex: (Get|Post|Delete|Head|Put|Patch)
- patterns:
- pattern: gorequest.New().$FUNC("=~/[hH][tT][tT][pP]://.*/")
- metavariable-regex:
metavariable: $FUNC
regex: (Get|Post|Delete|Head|Put|Patch)
- id: problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request
message: Checks for requests to http (unencrypted) sites using grequests, a popular
HTTP client library. This is dangerous because it could result in plaintext PII
being passed around the network.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://godoc.org/github.com/levigross/grequests#DoRegularRequest
- https://github.com/levigross/grequests
subcategory:
- vuln
technology:
- grequests
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request
shortlink: https://sg.run/Ge5q
semgrep.dev:
rule:
r_id: 9404
rv_id: 946047
rule_id: qNUjy3
version_id: LjTXyO2
url: https://semgrep.dev/playground/r/LjTXyO2/problem-based-packs.insecure-transport.go-stdlib.grequests-http-request.grequests-http-request
origin: community
languages:
- go
patterns:
- pattern-either:
- pattern: |
grequests.$FUNC(...,"=~/[hH][tT][tT][pP]://.*/", ...)
- pattern: |
$FUNC(...,"=~/[hH][tT][tT][pP]://.*/", ...)
- metavariable-regex:
metavariable: $FUNC
regex: (Get|Head|Post|Put|Delete|Patch|Options|Req|DoRegularRequest)
- id: problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request
message: Checks for requests sent via http.NewRequest to http:// URLS. This is dangerous
because the server is attempting to connect to a website that does not encrypt
traffic with TLS. Instead, send requests only to https:// URLS.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://golang.org/pkg/net/http/#NewRequest
subcategory:
- vuln
technology:
- go
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request
shortlink: https://sg.run/RoYq
semgrep.dev:
rule:
r_id: 9405
rv_id: 946048
rule_id: lBU90n
version_id: 8KTKjXj
url: https://semgrep.dev/playground/r/8KTKjXj/problem-based-packs.insecure-transport.go-stdlib.http-customized-request.http-customized-request
origin: community
languages:
- go
fix-regex:
regex: '[Hh][Tt][Tt][Pp]://'
replacement: https://
count: 1
pattern: |
http.NewRequest(..., "=~/[hH][tT][tT][pP]://.*/", ...)
- id: problem-based-packs.insecure-transport.go-stdlib.http-request.http-request
message: Checks for requests sent via http.$FUNC to http:// URLS. This is dangerous
because the server is attempting to connect to a website that does not encrypt
traffic with TLS. Instead, send requests only to https:// URLS.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://golang.org/pkg/net/http/#Get
subcategory:
- vuln
technology:
- go
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.http-request.http-request
shortlink: https://sg.run/Avd2
semgrep.dev:
rule:
r_id: 9406
rv_id: 946049
rule_id: YGUR70
version_id: gETe1jW
url: https://semgrep.dev/playground/r/gETe1jW/problem-based-packs.insecure-transport.go-stdlib.http-request.http-request
origin: community
languages:
- go
fix-regex:
regex: '[Hh][Tt][Tt][Pp]://'
replacement: https://
count: 1
patterns:
- pattern-either:
- pattern: |
http.$FUNC("=~/[hH][tT][tT][pP]://.*/", ...)
- patterns:
- pattern-inside: |
$CLIENT := &http.Client{...}
...
- pattern: |
client.$FUNC("=~/[hH][tT][tT][pP]://.*/", ...)
- pattern-not: http.$FUNC("=~/[hH][tT][tT][pP]://127.0.0.1.*/", ...)
- pattern-not: client.$FUNC("=~/[hH][tT][tT][pP]://127.0.0.1.*/", ...)
- pattern-not: http.$FUNC("=~/[hH][tT][tT][pP]://localhost.*/", ...)
- pattern-not: client.$FUNC("=~/[hH][tT][tT][pP]://localhost.*/", ...)
- metavariable-regex:
metavariable: $FUNC
regex: (Get|Post|Head|PostForm)
- id: problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request
message: Checks for requests to http (unencrypted) sites using gorequest, a popular
HTTP client library. This is dangerous because it could result in plaintext PII
being passed around the network.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://godoc.org/github.com/dghubble/sling#Sling.Add
- https://github.com/dghubble/sling
subcategory:
- vuln
technology:
- sling
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request
shortlink: https://sg.run/BkZA
semgrep.dev:
rule:
r_id: 9407
rv_id: 946050
rule_id: 6JUjoX
version_id: QkTZzDp
url: https://semgrep.dev/playground/r/QkTZzDp/problem-based-packs.insecure-transport.go-stdlib.sling-http-request.sling-http-request
origin: community
languages:
- go
pattern-either:
- patterns:
- pattern-inside: |
$REQ = sling.New()
...
$RES = ...
- pattern: |
$REQ.$FUNC("=~/[hH][tT][tT][pP]://.*/")
- metavariable-regex:
metavariable: $FUNC
regex: (Get|Post|Delete|Head|Put|Options|Patch|Base|Connect)
- patterns:
- pattern: sling.New().$FUNC("=~/[hH][tT][tT][pP]://.*/")
- metavariable-regex:
metavariable: $FUNC
regex: (Get|Post|Delete|Head|Put|Options|Patch|Base|Connect)
- patterns:
- pattern-inside: |
$REQ = sling.New()
...
$URL = "=~/[hH][tT][tT][pP]://.*/"
...
$RES = ...
- pattern: |
$REQ.$FUNC($URL)
- metavariable-regex:
metavariable: $FUNC
regex: (Get|Post|Delete|Head|Put|Options|Patch|Base|Connect)
- patterns:
- pattern-inside: |
$URL = "=~/[hH][tT][tT][pP]://.*/"
...
$RES = ...
- pattern: |
sling.New().$FUNC($URL)
- metavariable-regex:
metavariable: $FUNC
regex: (Get|Post|Delete|Head|Put|Options|Patch|Base|Connect)
- id: problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request
message: Checks for attempts to connect to an insecure telnet server using the package
telnet. This is bad because it can lead to man in the middle attacks.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://godoc.org/github.com/reiver/go-telnet
subcategory:
- vuln
technology:
- go-telnet
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request
shortlink: https://sg.run/Do4P
semgrep.dev:
rule:
r_id: 9408
rv_id: 946051
rule_id: oqUewD
version_id: 3ZTOPnj
url: https://semgrep.dev/playground/r/3ZTOPnj/problem-based-packs.insecure-transport.go-stdlib.telnet-request.telnet-request
origin: community
languages:
- go
pattern: |
telnet.DialToAndCall(...)
- id: problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification
message: Checks for redefinitions of functions that check TLS/SSL certificate verification.
This can lead to vulnerabilities, as simple errors in the code can result in lack
of proper certificate validation. This should only be used for debugging purposes
because it leads to vulnerability to MTM attacks.
severity: WARNING
metadata:
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://stackoverflow.com/questions/4072585/disabling-ssl-certificate-validation-in-spring-resttemplate
- https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1
subcategory:
- vuln
technology:
- spring
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification
shortlink: https://sg.run/W822
semgrep.dev:
rule:
r_id: 9409
rv_id: 946052
rule_id: zdUkZZ
version_id: 44TZkpg
url: https://semgrep.dev/playground/r/44TZkpg/problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification
origin: community
languages:
- java
pattern-either:
- pattern: |
new HostnameVerifier() {
...
public boolean verify(String hostname, SSLSession session) {
...
}
...
};
- pattern: |
public RestTemplate restTemplate() throws KeyStoreException, NoSuchAlgorithmException, KeyManagementException {
...
TrustStrategy $FUNCNAME = (X509Certificate[] chain, String authType) -> ...;
...
}
- pattern: |
TrustStrategy $FUNCNAME= new TrustStrategy() {
...
public boolean isTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException {
...
}
...
};
- id: problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request
message: Checks for outgoing connections to ftp servers via Spring plugin ftpSessionFactory.
FTP does not encrypt traffic, possibly leading to PII being sent plaintext over
the network.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://docs.spring.io/spring-integration/api/org/springframework/integration/ftp/session/AbstractFtpSessionFactory.html#setClientMode-int-
subcategory:
- vuln
technology:
- spring
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request
shortlink: https://sg.run/0Qzj
semgrep.dev:
rule:
r_id: 9410
rv_id: 946053
rule_id: pKUOYW
version_id: PkTQZvx
url: https://semgrep.dev/playground/r/PkTQZvx/problem-based-packs.insecure-transport.java-spring.spring-ftp-request.spring-ftp-request
origin: community
languages:
- java
fix-regex:
regex: '[fF][tT][pP]://'
replacement: sftp://
count: 1
pattern-either:
- pattern: |
$SF = new DefaultFtpSessionFactory(...);
...
$SF.setHost("=~/^[fF][tT][pP]://.*/");
...
$SF.$FUNC(...);
- pattern: |
$SF = new DefaultFtpSessionFactory(...);
...
String $URL = "=~/^[fF][tT][pP]://.*/";
...
$SF.setHost($URL);
...
$SF.$FUNC(...);
- id: problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request
message: Checks for requests sent via Java Spring RestTemplate API to http:// URLS.
This is dangerous because the server is attempting to connect to a website that
does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://docs.spring.io/spring/docs/current/javadoc-api/org/springframework/web/client/RestTemplate.html#delete-java.lang.String-java.util.Map-
- https://www.baeldung.com/rest-template
subcategory:
- vuln
technology:
- spring
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request
shortlink: https://sg.run/KlB5
semgrep.dev:
rule:
r_id: 9411
rv_id: 946054
rule_id: 2ZUbjg
version_id: JdTDybo
url: https://semgrep.dev/playground/r/JdTDybo/problem-based-packs.insecure-transport.java-spring.spring-http-request.spring-http-request
origin: community
languages:
- java
fix-regex:
regex: '[Hh][Tt][Tt][Pp]://'
replacement: https://
count: 1
patterns:
- pattern-either:
- pattern: |
$RESTTEMP = new RestTemplate(...);
...
$RESTTEMP.$FUNC("=~/[hH][tT][tT][pP]://.*/", ...);
- pattern: |
$RESTTEMP = new RestTemplate(...);
...
String $URL = "=~/[hH][tT][tT][pP]://.*/";
...
$RESTTEMP.$FUNC($URL, ...);
- pattern: |
$RESTTEMP = new RestTemplate(...);
...
$URL = new URI(..., "=~/[hH][tT][tT][pP]://.*/", ...);
...
$RESTTEMP.$FUNC($URL, ...);
- metavariable-regex:
metavariable: $FUNC
regex: (delete|doExecute|exchange|getForEntity|getForObject|headForHeaders|optionsForAllow|patchForObject|postForEntity|postForLocation|postForObject|put)
- id: problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification
message: Checks for redefinitions of the checkServerTrusted function in the X509TrustManager
class that disables TLS/SSL certificate verification. This should only be used
for debugging purposes because it leads to vulnerability to MTM attacks.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://riptutorial.com/java/example/16517/temporarily-disable-ssl-verification--for-testing-purposes-
- https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1
subcategory:
- vuln
technology:
- java
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification
shortlink: https://sg.run/qxD7
semgrep.dev:
rule:
r_id: 9412
rv_id: 946055
rule_id: X5U8qv
version_id: 5PT9Oj9
url: https://semgrep.dev/playground/r/5PT9Oj9/problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification
origin: community
languages:
- java
patterns:
- pattern: |
new X509TrustManager() {
...
public void checkClientTrusted(X509Certificate[] certs, String authType) {...}
...
}
- pattern-not: |
new X509TrustManager() {
...
public void checkServerTrusted(X509Certificate[] certs, String authType) {
...
throw new CertificateException(...);
...
}
...
}
- pattern-not: |
new X509TrustManager() {
...
public void checkServerTrusted(X509Certificate[] certs, String authType) {
...
throw new IllegalArgumentException(...);
...
}
...
}
- id: problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1
message: Detects direct creations of SSLConnectionSocketFactories that don't disallow
SSL v2, SSL v3, and TLS v1. SSLSocketFactory can be used to validate the identity
of the HTTPS server against a list of trusted certificates. These protocols are
deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.
severity: WARNING
metadata:
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle
subcategory:
- vuln
technology:
- java
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1
shortlink: https://sg.run/l25E
semgrep.dev:
rule:
r_id: 9413
rv_id: 946056
rule_id: j2Uv2K
version_id: GxTP7y6
url: https://semgrep.dev/playground/r/GxTP7y6/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions1.disallow-old-tls-versions1
origin: community
languages:
- java
patterns:
- pattern: |
new SSLConnectionSocketFactory(...);
- pattern-not: |
new SSLConnectionSocketFactory(..., new String[] {"TLSv1.2", "TLSv1.3"}, ...);
- pattern-not: |
new SSLConnectionSocketFactory(..., new String[] {"TLSv1.3", "TLSv1.2"}, ...);
- pattern-not: |
new SSLConnectionSocketFactory(..., new String[] {"TLSv1.3"}, ...);
- pattern-not: |
new SSLConnectionSocketFactory(..., new String[] {"TLSv1.2"}, ...);
- pattern-not-inside: |
(SSLConnectionSocketFactory $SF) = new SSLConnectionSocketFactory(...); ... (TlsConfig $TLSCONFIG) = TlsConfig.custom(). ... .setSupportedProtocols(TLS.V_1_2). ... .build(); ... HttpClientConnectionManager cm = $CM.create(). ... .setSSLSocketFactory($SF). ... .setDefaultTlsConfig($TLSCONFIG). ... .build();
- pattern-not-inside: |
(SSLConnectionSocketFactory $SF) = new SSLConnectionSocketFactory(...); ... (TlsConfig $TLSCONFIG) = TlsConfig.custom(). ... .setSupportedProtocols(TLS.V_1_3). ... .build(); ... HttpClientConnectionManager cm = $CM.create(). ... .setSSLSocketFactory($SF). ... .setDefaultTlsConfig($TLSCONFIG). ... .build();
- id: problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2
message: Detects setting client protocols to insecure versions of TLS and SSL. These
protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://stackoverflow.com/questions/26504653/is-it-possible-to-disable-sslv3-for-all-java-applications
subcategory:
- vuln
technology:
- java
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2
shortlink: https://sg.run/Yvjy
semgrep.dev:
rule:
r_id: 9414
rv_id: 946057
rule_id: 10UKvx
version_id: RGTAg7R
url: https://semgrep.dev/playground/r/RGTAg7R/problem-based-packs.insecure-transport.java-stdlib.disallow-old-tls-versions2.disallow-old-tls-versions2
origin: community
languages:
- java
patterns:
- pattern: $VALUE. ... .setProperty("jdk.tls.client.protocols", "$PATTERNS");
- metavariable-pattern:
metavariable: $PATTERNS
language: generic
patterns:
- pattern-either:
- pattern: TLS1
- pattern-regex: ^(.*TLSv1|.*SSLv.*)$
- pattern-regex: ^(.*TLSv1,.*)
- id: problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request
message: Checks for outgoing connections to ftp servers. FTP does not encrypt traffic,
possibly leading to PII being sent plaintext over the network.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://www.codejava.net/java-se/ftp/connect-and-login-to-a-ftp-server
- https://commons.apache.org/proper/commons-net/apidocs/org/apache/commons/net/ftp/FTPClient.html
subcategory:
- vuln
technology:
- java
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request
shortlink: https://sg.run/6n91
semgrep.dev:
rule:
r_id: 9415
rv_id: 946058
rule_id: 9AU1wD
version_id: A8TJz8g
url: https://semgrep.dev/playground/r/A8TJz8g/problem-based-packs.insecure-transport.java-stdlib.ftp-request.ftp-request
origin: community
languages:
- java
fix-regex:
regex: '[fF][tT][pP]://'
replacement: sftp://
count: 1
pattern-either:
- pattern: |
FTPClient $FTPCLIENT = new FTPClient();
...
$FTPCLIENT.connect(...);
- pattern: |
URL $URL = new URL("=~/^[fF][tT][pP]://.*/");
...
URLConnection $CONN = $URL.openConnection(...);
- id: problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request
message: Checks for requests sent via Apache HTTP Components to http:// URLS. This
is dangerous because the server is attempting to connect to a website that does
not encrypt traffic with TLS. Instead, send requests only to https:// URLS.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://hc.apache.org/httpcomponents-client-ga/quickstart.html
subcategory:
- vuln
technology:
- java
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request
shortlink: https://sg.run/oxD0
semgrep.dev:
rule:
r_id: 9416
rv_id: 946059
rule_id: yyUnjk
version_id: BjT1N5b
url: https://semgrep.dev/playground/r/BjT1N5b/problem-based-packs.insecure-transport.java-stdlib.http-components-request.http-components-request
origin: community
languages:
- java
fix-regex:
regex: '[Hh][Tt][Tt][Pp]://'
replacement: https://
count: 1
pattern-either:
- pattern: |
$HTTPCLIENT = HttpClients.$CREATE(...);
...
$HTTPREQ = new $HTTPFUNC("=~/[hH][tT][tT][pP]://.*/");
...
$RESPONSE = $HTTPCLIENT.execute($HTTPREQ);
- pattern: |
$HTTPCLIENT = HttpClients.$CREATE(...);
...
$RESPONSE = $HTTPCLIENT.execute(new $HTTPFUNC("=~/[hH][tT][tT][pP]://.*/"));
- id: problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request
message: Checks for requests sent via HttpClient to http:// URLS. This is dangerous
because the server is attempting to connect to a website that does not encrypt
traffic with TLS. Instead, send requests only to https:// URLS.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://openjdk.java.net/groups/net/httpclient/intro.html
subcategory:
- vuln
technology:
- java
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request
shortlink: https://sg.run/zv2d
semgrep.dev:
rule:
r_id: 9417
rv_id: 946060
rule_id: r6Ur3y
version_id: DkTNpJw
url: https://semgrep.dev/playground/r/DkTNpJw/problem-based-packs.insecure-transport.java-stdlib.httpclient-http-request.httpclient-http-request
origin: community
languages:
- java
fix-regex:
regex: '[Hh][Tt][Tt][Pp]://'
replacement: https://
count: 1
pattern-either:
- patterns:
- pattern: |
URI.create("=~/[hH][tT][tT][pP]://.*/", ...)
- pattern-inside: |
HttpClient $CLIENT = ...;
...
HttpRequest $REQ = ...;
...
$CLIENT.sendAsync(...);
- patterns:
- pattern: |
URI.create("=~/[hH][tT][tT][pP]://.*/", ...)
- pattern-inside: |
HttpClient $CLIENT = ...;
...
HttpRequest $REQ = ...;
...
$CLIENT.send(...);
- patterns:
- pattern: |
URI.create($URI)
- pattern-inside: |
String $URI = "=~/[hH][tT][tT][pP]://.*/";
...
HttpClient $CLIENT = ...;
...
HttpRequest $REQ = ...;
...
$CLIENT.send(...);
- patterns:
- pattern: |
URI.create($URI)
- pattern-inside: |
String $URI = "=~/[hH][tT][tT][pP]://.*/";
...
HttpClient $CLIENT = ...;
...
HttpRequest $REQ = ...;
...
$CLIENT.sendAsync(...);
- id: problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request
message: Detected an HTTP request sent via HttpURLConnection. This could lead to
sensitive information being sent over an insecure channel. Instead, it is recommended
to send requests over HTTPS.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html
- https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection()
subcategory:
- vuln
technology:
- java
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request
shortlink: https://sg.run/px3Z
semgrep.dev:
rule:
r_id: 9418
rv_id: 946062
rule_id: bwUwvR
version_id: 0bT15Bq
url: https://semgrep.dev/playground/r/0bT15Bq/problem-based-packs.insecure-transport.java-stdlib.httpurlconnection-http-request.httpurlconnection-http-request
origin: community
languages:
- java
fix-regex:
regex: '[Hh][Tt][Tt][Pp]://'
replacement: https://
count: 1
patterns:
- pattern: |
"=~/[Hh][Tt][Tt][Pp]://.*/"
- pattern-either:
- pattern-inside: |
URL $URL = new URL ("=~/[Hh][Tt][Tt][Pp]://.*/", ...);
...
$CON = (HttpURLConnection) $URL.openConnection(...);
...
$CON.$FUNC(...);
- pattern-inside: |
URL $URL = new URL ("=~/[Hh][Tt][Tt][Pp]://.*/", ...);
...
$CON = $URL.openConnection(...);
...
$CON.$FUNC(...);
- id: problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request
message: Insecure transport rules to catch socket connections to http, telnet, and
ftp servers. This is dangerous because these are protocols that do not encrypt
traffic.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: LOW
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://docs.oracle.com/javase/8/docs/api/java/net/Socket.html
subcategory:
- audit
technology:
- java
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request
shortlink: https://sg.run/2x9L
semgrep.dev:
rule:
r_id: 9419
rv_id: 946063
rule_id: NbUkl9
version_id: K3TJbeQ
url: https://semgrep.dev/playground/r/K3TJbeQ/problem-based-packs.insecure-transport.java-stdlib.socket-request.socket-request
origin: community
languages:
- java
pattern-either:
- pattern: |
$SOCKET = new Socket("=~/[tT][eE][lL][nN][eE][tT]://.*/", ...);
...
$OUT = new PrintWriter($SOCKET.getOutputStream(...), ...);
...
$OUT.$FUNC(...);
- pattern: |
$SOCKET = new Socket("=~/^[fF][tT][pP]://.*/", ...);
...
$OUT = new PrintWriter($SOCKET.getOutputStream(...), ...);
...
$OUT.$FUNC(...);
- pattern: |
$SOCKET = new Socket("=~/[hH][tT][tT][pP]://.*/", ...);
...
$OUT = new PrintWriter($SOCKET.getOutputStream(...), ...);
...
$OUT.$FUNC(...);
- id: problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request
message: Checks for attempts to connect through telnet. This is insecure as the
telnet protocol supports no encryption, and data passes through unencrypted.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://commons.apache.org/proper/commons-net/javadocs/api-3.6/org/apache/commons/net/telnet/TelnetClient.html
subcategory:
- vuln
technology:
- java
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request
shortlink: https://sg.run/XBQB
semgrep.dev:
rule:
r_id: 9420
rv_id: 946064
rule_id: kxUkXk
version_id: qkT4jGK
url: https://semgrep.dev/playground/r/qkT4jGK/problem-based-packs.insecure-transport.java-stdlib.telnet-request.telnet-request
origin: community
languages:
- java
pattern: |
$TELNETCLIENT = new TelnetClient(...);
...
$TELNETCLIENT.connect(...);
- id: problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation
message: Checks for cases where java applications are allowing unsafe renegotiation.
This leaves the application vulnerable to a man-in-the-middle attack where chosen
plain text is injected as prefix to a TLS connection.
severity: WARNING
metadata:
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://www.oracle.com/java/technologies/javase/tlsreadme.html
subcategory:
- vuln
technology:
- java
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation
shortlink: https://sg.run/jR5N
semgrep.dev:
rule:
r_id: 9421
rv_id: 946065
rule_id: wdUJw8
version_id: l4Tx9be
url: https://semgrep.dev/playground/r/l4Tx9be/problem-based-packs.insecure-transport.java-stdlib.tls-renegotiation.tls-renegotiation
origin: community
languages:
- java
pattern: |
java.lang.System.setProperty("sun.security.ssl.allowUnsafeRenegotiation", true);
- id: problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request
message: Checks for requests sent via Unirest to http:// URLS. This is dangerous
because the server is attempting to connect to a website that does not encrypt
traffic with TLS. Instead, send requests only to https:// URLS.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://kong.github.io/unirest-java/#requests
subcategory:
- vuln
technology:
- unirest
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request
shortlink: https://sg.run/1Z1G
semgrep.dev:
rule:
r_id: 9422
rv_id: 946066
rule_id: x8Uno2
version_id: YDTvR5x
url: https://semgrep.dev/playground/r/YDTvR5x/problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request
origin: community
languages:
- java
fix-regex:
regex: '[Hh][Tt][Tt][Pp]://'
replacement: https://
count: 1
pattern-either:
- pattern: |
Unirest.get("=~/[hH][tT][tT][pP]://.*/")
- pattern: |
Unirest.post("=~/[hH][tT][tT][pP]://.*/")
- id: problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification
message: Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED
to 0, which disables TLS verification. This should only be used for debugging
purposes. Setting the option rejectUnauthorized to false bypasses verification
against the list of trusted CAs, which also leads to insecure transport. These
options lead to vulnerability to MTM attacks, and should not be used.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://nodejs.org/api/https.html#https_https_request_options_callback
- https://stackoverflow.com/questions/20433287/node-js-request-cert-has-expired#answer-29397100
subcategory:
- vuln
technology:
- node.js
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification
shortlink: https://sg.run/9oxr
semgrep.dev:
rule:
r_id: 9423
rv_id: 946067
rule_id: OrU3Y6
version_id: JdTDybO
url: https://semgrep.dev/playground/r/JdTDybO/problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification
origin: community
languages:
- javascript
- typescript
pattern-either:
- pattern: |
process.env["NODE_TLS_REJECT_UNAUTHORIZED"] = 0;
- pattern: |
{rejectUnauthorized:false}
- id: problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1
message: Detects direct creations of $HTTPS servers that don't disallow SSL v2,
SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man in the middle
attacks, and other vulnerabilities.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://us-cert.cisa.gov/ncas/alerts/TA14-290A
- https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs
- https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener
subcategory:
- vuln
technology:
- node.js
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1
shortlink: https://sg.run/ydpP
semgrep.dev:
rule:
r_id: 9424
rv_id: 946068
rule_id: eqU8nr
version_id: 5PT9Ojl
url: https://semgrep.dev/playground/r/5PT9Ojl/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions1.disallow-old-tls-versions1
origin: community
languages:
- javascript
- typescript
patterns:
- pattern-either:
- pattern-inside: |
$CONST = require('crypto');
...
- pattern-inside: |
$CONST = require('constants');
...
- pattern-inside: |
$HTTPS = require('https');
...
- pattern: |
$HTTPS.createServer(...).$FUNC(...);
- pattern-not: |
$HTTPS.createServer({secureOptions: $CONST.SSL_OP_NO_TLSv1 | $CONST.SSL_OP_NO_SSLv3 | $CONST.SSL_OP_NO_SSLv2 }, ...).$FUNC(...);
- pattern-not: |
$HTTPS.createServer({secureOptions: $CONST.SSL_OP_NO_TLSv1 | $CONST.SSL_OP_NO_SSLv2 |$CONST.SSL_OP_NO_SSLv3 }, ...).$FUNC(...);
- pattern-not: |
$HTTPS.createServer({secureOptions: $CONST.SSL_OP_NO_SSLv2 |$CONST.SSL_OP_NO_SSLv3 |$CONST.SSL_OP_NO_TLSv1 }, ...).$FUNC(...);
- pattern-not: |
$HTTPS.createServer({secureOptions: $CONST.SSL_OP_NO_SSLv2 |$CONST.SSL_OP_NO_TLSv1 | $CONST.SSL_OP_NO_SSLv3}, ...).$FUNC(...);
- pattern-not: |
$HTTPS.createServer({secureOptions:$CONST.SSL_OP_NO_SSLv3 | $CONST.SSL_OP_NO_SSLv2 |$CONST.SSL_OP_NO_TLSv1}, ...).$FUNC(...);
- pattern-not: |
$HTTPS.createServer({secureOptions:$CONST.SSL_OP_NO_SSLv3 | $CONST.SSL_OP_NO_TLSv1| $CONST.SSL_OP_NO_SSLv2}, ...).$FUNC(...);
- id: problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2
message: Detects creations of $HTTPS servers from option objects that don't disallow
SSL v2, SSL v3, and TLS v1. These protocols are deprecated due to POODLE, man
in the middle attacks, and other vulnerabilities.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://us-cert.cisa.gov/ncas/alerts/TA14-290A
- https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs
- https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener
subcategory:
- vuln
technology:
- node.js
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2
shortlink: https://sg.run/rdKe
semgrep.dev:
rule:
r_id: 9425
rv_id: 946069
rule_id: v8UnPO
version_id: GxTP7y5
url: https://semgrep.dev/playground/r/GxTP7y5/problem-based-packs.insecure-transport.js-node.disallow-old-tls-versions2.disallow-old-tls-versions2
origin: community
languages:
- javascript
- typescript
patterns:
- pattern-either:
- pattern-inside: |
$CONST = require('crypto');
...
- pattern-inside: |
$CONST = require('constants');
...
- pattern-inside: |
$HTTPS = require('https');
...
- pattern: |
$OPTIONS = {};
...
$HTTPS.createServer($OPTIONS, ...);
- pattern-not: |
$OPTIONS = {secureOptions: $CONST.SSL_OP_NO_TLSv1 | $CONST.SSL_OP_NO_SSLv3 | $CONST.SSL_OP_NO_SSLv2};
...
$HTTPS.createServer($OPTIONS, ...);
- pattern-not: |
$OPTIONS = {secureOptions: $CONST.SSL_OP_NO_TLSv1 | $CONST.SSL_OP_NO_SSLv2 | $CONST.SSL_OP_NO_SSLv3};
...
$HTTPS.createServer($OPTIONS, ...);
- pattern-not: |
$OPTIONS = {secureOptions: $CONST.SSL_OP_NO_SSLv2 | $CONST.SSL_OP_NO_TLSv1 | $CONST.SSL_OP_NO_SSLv3};
...
$HTTPS.createServer($OPTIONS, ...);
- pattern-not: |
$OPTIONS = {secureOptions: $CONST.SSL_OP_NO_SSLv2 | $CONST.SSL_OP_NO_SSLv3 | $CONST.SSL_OP_NO_TLSv1};
...
$HTTPS.createServer($OPTIONS, ...);
- pattern-not: |
$OPTIONS = {secureOptions: $CONST.SSL_OP_NO_SSLv3 | $CONST.SSL_OP_NO_SSLv2 | $CONST.SSL_OP_NO_TLSv1};
...
$HTTPS.createServer($OPTIONS, ...);
- pattern-not: |
$OPTIONS = {secureOptions: $CONST.SSL_OP_NO_SSLv3 | $CONST.SSL_OP_NO_TLSv1 | $CONST.SSL_OP_NO_SSLv2};
...
$HTTPS.createServer($OPTIONS, ...);
- id: problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request
message: 'Checks for lack of usage of the "secure: true" option when sending ftp
requests through the nodejs ftp module. This leads to unencrypted traffic being
sent to the ftp server. There are other options such as "implicit" that still
does not encrypt all traffic. ftp is the most utilized npm ftp module.'
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://www.npmjs.com/package/ftp
- https://openbase.io/js/ftp
subcategory:
- vuln
technology:
- node.js
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request
shortlink: https://sg.run/b7QW
semgrep.dev:
rule:
r_id: 9426
rv_id: 946070
rule_id: d8UjZ6
version_id: RGTAg7Z
url: https://semgrep.dev/playground/r/RGTAg7Z/problem-based-packs.insecure-transport.js-node.ftp-request.ftp-request
origin: community
languages:
- javascript
- typescript
patterns:
- pattern-inside: |
$X = require('ftp');
...
$C = new $X();
...
- pattern-not-inside: |
$OPTIONS = {secure: true};
...
- pattern: |
$C.connect($OPTIONS,...);
- pattern-not: |
$C.connect({...,secure: true});
- id: problem-based-packs.insecure-transport.js-node.http-request.http-request
message: Checks for requests sent to http:// URLs. This is dangerous as the server
is attempting to connect to a website that does not encrypt traffic with TLS.
Instead, only send requests to https:// URLs.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://nodejs.org/api/http.html#http_http_request_options_callback
subcategory:
- vuln
technology:
- node.js
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.http-request.http-request
shortlink: https://sg.run/N4Qy
semgrep.dev:
rule:
r_id: 9427
rv_id: 946071
rule_id: ZqU5r3
version_id: A8TJz8O
url: https://semgrep.dev/playground/r/A8TJz8O/problem-based-packs.insecure-transport.js-node.http-request.http-request
origin: community
languages:
- javascript
patterns:
- pattern-inside: |
$HTTP = require('http');
...
- pattern-either:
- pattern: |
$HTTP.request("=~/http://.*/",...);
- pattern: |
$HTTP.get("=~/http://.*/", ...)
- pattern: |
$VAR = new URL("=~/http://.*/");
...
$HTTP.request($VAR, ...);
- pattern: |
$VAR = {...,hostname: "..."};
...
$HTTP.request(..., $VAR, ...);
- pattern: |
$HTTP.request(..., {...,hostname: "..."}, ...);
- pattern-not: |
$VAR = {...,protocol: "https"};
...
$HTTP.request(..., $VAR, ...);
- pattern-not: |
$HTTP.request(..., {...,protocol: "https"}, ...);
- id: problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support
message: Checks for requests to http (unencrypted) sites using some of node js's
most popular REST/HTTP libraries, including node-rest-client, axios, and got.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://www.npmjs.com/package/axios
- https://www.npmjs.com/package/got
- https://www.npmjs.com/package/node-rest-client
subcategory:
- vuln
technology:
- node.js
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support
shortlink: https://sg.run/kXGP
semgrep.dev:
rule:
r_id: 9428
rv_id: 946072
rule_id: nJUzKP
version_id: BjT1N5l
url: https://semgrep.dev/playground/r/BjT1N5l/problem-based-packs.insecure-transport.js-node.rest-http-client-support.rest-http-client-support
origin: community
languages:
- javascript
patterns:
- pattern-either:
- pattern-inside: |
$CLIENT = require('node-rest-client').Client;
...
$C = new $CLIENT();
...
- pattern-inside: |
$C = require('axios');
...
- pattern-inside: |
$C = require('got');
...
- pattern-either:
- pattern: |
$C.$REQ("=~/http://.*/", ...)
- pattern: |
$C("=~/http://.*/", ...)
- pattern: |
$C({...,url: "=~/http://.*/"})
- pattern: |
$C.$REQ({...,url: "=~/http://.*/"})
- id: problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request
message: Checks for creation of telnet servers or attempts to connect through telnet.
This is insecure as the telnet protocol supports no encryption, and data passes
through unencrypted.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://www.npmjs.com/package/telnet
- https://www.npmjs.com/package/telnet-client
subcategory:
- vuln
technology:
- node.js
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request
shortlink: https://sg.run/weoA
semgrep.dev:
rule:
r_id: 9429
rv_id: 946073
rule_id: EwU2GA
version_id: DkTNpJJ
url: https://semgrep.dev/playground/r/DkTNpJJ/problem-based-packs.insecure-transport.js-node.telnet-request.telnet-request
origin: community
languages:
- javascript
patterns:
- pattern-either:
- pattern-inside: |
$TEL = require('telnet-client');
...
$SERVER = new $TEL();
...
- pattern-inside: |
$SERVER = require('telnet');
...
- pattern-either:
- pattern: |
$SERVER.on(...)
- pattern: |
$SERVER.connect(...)
- pattern: |
$SERVER.createServer(...)
- id: problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server
message: Checks for any usage of http servers instead of https servers. Encourages
the usage of https protocol instead of http, which does not have TLS and is therefore
unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker
is able to read sensitive information.
severity: WARNING
metadata:
likelihood: LOW
impact: MEDIUM
confidence: LOW
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp:
- A02:2021 - Cryptographic Failures
- A03:2017 - Sensitive Data Exposure
- A04:2025 - Cryptographic Failures
references:
- https://nodejs.org/api/http.html#http_class_http_agent
- https://groups.google.com/g/rubyonrails-security/c/NCCsca7TEtY
subcategory:
- audit
technology:
- node.js
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server
shortlink: https://sg.run/x1zL
semgrep.dev:
rule:
r_id: 9430
rv_id: 1263329
rule_id: 7KUQAE
version_id: 9lT4bNd
url: https://semgrep.dev/playground/r/9lT4bNd/problem-based-packs.insecure-transport.js-node.using-http-server.using-http-server
origin: community
languages:
- javascript
patterns:
- pattern-inside: |
$HTTP = require('http');
...
- pattern-either:
- pattern: |
$HTTP.$FUNC(...);
- pattern: |
new $HTTP.$FUNC2(...);
- pattern: $HTTP
- id: problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests
message: Checks for requests to http (unencrypted) sites using some of ruby's most
popular REST/HTTP libraries, including httparty and restclient.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://github.com/rest-client/rest-client
- https://github.com/jnunemaker/httparty/tree/master/docs
subcategory:
- vuln
technology:
- httparty
- rest-client
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests
shortlink: https://sg.run/OPQL
semgrep.dev:
rule:
r_id: 9431
rv_id: 946075
rule_id: L1UyKG
version_id: 0bT15Bn
url: https://semgrep.dev/playground/r/0bT15Bn/problem-based-packs.insecure-transport.ruby-stdlib.http-client-requests.http-client-requests
origin: community
languages:
- ruby
pattern-either:
- pattern: |
HTTParty.$PARTYVERB("=~/[hH][tT][tT][pP]://.*/", ...)
- pattern: |
$STRING = "=~/[hH][tT][tT][pP]://.*/"
...
HTTParty.$PARTYVERB($STRING, ...)
- pattern: |
RestClient.$RESTVERB "=~/[hH][tT][tT][pP]://.*/", ...
- pattern: |
RestClient::Request.execute(..., url: "=~/[hH][tT][tT][pP]://.*/", ...)
- id: problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request
message: Checks for outgoing connections to ftp servers with the 'net/ftp' package.
FTP does not encrypt traffic, possibly leading to PII being sent plaintext over
the network. Instead, connect via the SFTP protocol.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://docs.ruby-lang.org/en/2.0.0/Net/FTP.html
subcategory:
- vuln
technology:
- ruby
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request
shortlink: https://sg.run/eLQ8
semgrep.dev:
rule:
r_id: 9432
rv_id: 946076
rule_id: 8GUj13
version_id: K3TJbe1
url: https://semgrep.dev/playground/r/K3TJbe1/problem-based-packs.insecure-transport.ruby-stdlib.net-ftp-request.net-ftp-request
origin: community
languages:
- ruby
pattern-either:
- pattern: |
$FTP = Net::FTP.new('...')
...
$FTP.login
- pattern: |
Net::FTP.open('...') do |ftp|
...
ftp.login
end
- id: problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request
message: Checks for requests sent to http:// URLs. This is dangerous as the server
is attempting to connect to a website that does not encrypt traffic with TLS.
Instead, only send requests to https:// URLs.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://ruby-doc.org/stdlib-2.6.5/libdoc/net/http/rdoc/Net/
subcategory:
- vuln
technology:
- ruby
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request
shortlink: https://sg.run/vz6Y
semgrep.dev:
rule:
r_id: 9433
rv_id: 946077
rule_id: gxU1lE
version_id: qkT4jG8
url: https://semgrep.dev/playground/r/qkT4jG8/problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request
origin: community
languages:
- ruby
patterns:
- pattern-either:
- pattern: |
$URI = URI('=~/[hH][tT][tT][pP]://.*/')
...
Net::HTTP::$FUNC.new $URI
- pattern: |
$URI = URI('=~/[hH][tT][tT][pP]://.*/')
...
Net::HTTP.$FUNC($URI, ...)
- pattern: |
Net::HTTP.$FUNC(URI('=~/[hH][tT][tT][pP]://.*/'), ...)
- metavariable-regex:
metavariable: $FUNC
regex: ([gG]et|post_form|[pP]ost|get_response|get_print|Head|Patch|Put|Proppatch|Lock|Unlock|Options|Propfind|Delete|Move|Copy|Trace|Mkcol)
- id: problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request
message: Checks for creation of telnet servers or attempts to connect through telnet.
This is insecure as the telnet protocol supports no encryption, and data passes
through unencrypted.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://docs.ruby-lang.org/en/2.2.0/Net/Telnet.html
- https://www.rubydoc.info/gems/net-ssh-telnet2/0.1.0/Net/SSH/Telnet
subcategory:
- vuln
technology:
- ruby
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request
shortlink: https://sg.run/dKQE
semgrep.dev:
rule:
r_id: 9434
rv_id: 946078
rule_id: QrUzo2
version_id: l4Tx9bO
url: https://semgrep.dev/playground/r/l4Tx9bO/problem-based-packs.insecure-transport.ruby-stdlib.net-telnet-request.net-telnet-request
origin: community
languages:
- ruby
pattern-either:
- pattern: |
Net::Telnet::new(...)
- pattern: |
Net::SSH::Telnet.new(...)
- id: problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request
message: Checks for requests to http and ftp (unencrypted) sites using OpenURI.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://ruby-doc.org/stdlib-2.6.3/libdoc/open-uri/rdoc/OpenURI.html
subcategory:
- vuln
technology:
- open-uri
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request
shortlink: https://sg.run/ZvQw
semgrep.dev:
rule:
r_id: 9435
rv_id: 946079
rule_id: 3qUPNe
version_id: YDTvR5b
url: https://semgrep.dev/playground/r/YDTvR5b/problem-based-packs.insecure-transport.ruby-stdlib.openuri-request.openuri-request
origin: community
languages:
- ruby
pattern-either:
- pattern: |
URI.open('=~/[hH][tT][tT][pP]://.*/', ...)
- pattern: |
$URI = URI.parse('=~/[hH][tT][tT][pP]://.*/', ...)
...
$URI.open
- pattern: |
URI.open('=~/^[fF][tT][pP]://.*/', ...)
- pattern: |
$URI = URI.parse('=~/^[fF][tT][pP]://.*/', ...)
...
$URI.open
- id: python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator
message: 'Found a formatted string in BashOperator: $CMD. This could be vulnerable
to injection. Be extra sure your variables are not controllable by external sources.'
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- airflow
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator
shortlink: https://sg.run/ndBY
semgrep.dev:
rule:
r_id: 9436
rv_id: 1263330
rule_id: 4bUkOY
version_id: yeTxpb3
url: https://semgrep.dev/playground/r/yeTxpb3/python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator
origin: community
languages:
- python
severity: ERROR
pattern-either:
- pattern: |
airflow.operators.bash_operator.BashOperator(..., bash_command="..." + $CONCAT, ...)
- pattern: |
airflow.operators.bash_operator.BashOperator(..., bash_command="...".format(...), ...)
- pattern: |
airflow.operators.bash_operator.BashOperator(..., bash_command=f"...", ...)
- pattern: |
airflow.operators.bash_operator.BashOperator(..., bash_command="..." % $PARAMS, ...)
- pattern: |
$CMD = "..." % $PARAMS
...
airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...)
- pattern: |
$CMD = $STR.format(...)
...
airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...)
- pattern: |
$CMD = f"..."
...
airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...)
- pattern: |
$CMD = "..." + $CONCAT
...
airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...)
- pattern: |
$CMD = "..."
...
$CMD += $CONCAT
...
airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...)
- id: python.boto3.security.hardcoded-token.hardcoded-token
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
- https://bento.dev/checks/boto3/hardcoded-access-token/
- https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
category: security
technology:
- boto3
- secrets
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token
shortlink: https://sg.run/LwQ6
semgrep.dev:
rule:
r_id: 9439
rv_id: 1263347
rule_id: 5rUOwK
version_id: gETB78n
url: https://semgrep.dev/playground/r/gETB78n/python.boto3.security.hardcoded-token.hardcoded-token
origin: community
languages:
- python
severity: WARNING
mode: taint
pattern-sources:
- pattern: |
"..."
pattern-sinks:
- patterns:
- pattern-either:
- pattern: $W(...,$TOKEN="$VALUE",...)
- pattern: $BOTO. ... .$W(...,$TOKEN="$VALUE",...)
- metavariable-regex:
metavariable: $TOKEN
regex: (aws_session_token|aws_access_key_id|aws_secret_access_key)
- metavariable-pattern:
language: generic
metavariable: $VALUE
patterns:
- pattern-either:
- pattern-regex: ^AKI
- pattern-regex: ^[A-Za-z0-9/+=]+$
- metavariable-analysis:
metavariable: $VALUE
analyzer: entropy
- id: python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea
message: IDEA (International Data Encryption Algorithm) is a block cipher created
in 1991. It is an optional component of the OpenPGP standard. This cipher is
susceptible to attacks when using weak keys. It is recommended that you do not
use this cipher for new applications. Use a strong symmetric cipher such as EAS
instead. With the `cryptography` package it is recommended to use `Fernet` which
is a secure implementation of AES in CBC mode with a 128-bit key. Alternatively,
keep using the `Cipher` class from the hazmat primitives but use the AES algorithm
instead.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
bandit-code: B304
references:
- https://tools.ietf.org/html/rfc5469
- https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.IDEA
category: security
technology:
- cryptography
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
functional-categories:
- crypto::search::symmetric-algorithm::cryptography
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea
shortlink: https://sg.run/3xyK
semgrep.dev:
rule:
r_id: 9443
rv_id: 1263350
rule_id: BYUNPg
version_id: 44TEjNJ
url: https://semgrep.dev/playground/r/44TEjNJ/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea
origin: community
severity: WARNING
languages:
- python
patterns:
- pattern: cryptography.hazmat.primitives.ciphers.algorithms.$IDEA($KEY)
- metavariable-regex:
metavariable: $IDEA
regex: ^(IDEA)$
- focus-metavariable: $IDEA
fix: AES
- id: python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb
message: ECB (Electronic Code Book) is the simplest mode of operation for block
ciphers. Each block of data is encrypted in the same way. This means identical
plaintext blocks will always result in identical ciphertext blocks, which can
leave significant patterns in the output. Use a different, cryptographically strong
mode instead, such as GCM.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L101
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
bandit-code: B305
references:
- https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#insecure-modes
- https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption
category: security
technology:
- cryptography
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: MEDIUM
functional-categories:
- crypto::search::mode::cryptography
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb
shortlink: https://sg.run/4xr5
semgrep.dev:
rule:
r_id: 9444
rv_id: 1263351
rule_id: DbUp5g
version_id: PkTR3w7
url: https://semgrep.dev/playground/r/PkTR3w7/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb
origin: community
severity: WARNING
languages:
- python
pattern: cryptography.hazmat.primitives.ciphers.modes.ECB($IV)
fix: cryptography.hazmat.primitives.ciphers.modes.GCM($IV)
- id: python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1
patterns:
- pattern: cryptography.hazmat.primitives.hashes.$SHA(...)
- metavariable-pattern:
metavariable: $SHA
pattern: |
SHA1
- focus-metavariable: $SHA
fix: |
SHA256
message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not
collision resistant and is therefore not suitable as a cryptographic signature.
Use SHA256 or SHA3 instead.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
bandit-code: B303
references:
- https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#sha-1
- https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html
- https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability
- http://2012.sharcs.org/slides/stevens.pdf
- https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
category: security
technology:
- cryptography
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
functional-categories:
- crypto::search::symmetric-algorithm::cryptography
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1
shortlink: https://sg.run/J9Qy
semgrep.dev:
rule:
r_id: 9446
rv_id: 1263353
rule_id: 0oU5dN
version_id: 5PTo1l0
url: https://semgrep.dev/playground/r/5PTo1l0/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1
origin: community
severity: WARNING
languages:
- python
- id: python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size
patterns:
- pattern-either:
- pattern: cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key(...,
key_size=$SIZE, ...)
- pattern: cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key($SIZE,
...)
- metavariable-comparison:
metavariable: $SIZE
comparison: $SIZE < 2048
- focus-metavariable: $SIZE
fix: |
2048
message: Detected an insufficient key size for DSA. NIST recommends a key size of
2048 or higher.
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py
references:
- https://www.cosic.esat.kuleuven.be/ecrypt/ecrypt2/documents/D.SPA.20.pdf
- https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf
category: security
technology:
- cryptography
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
functional-categories:
- crypto::search::key-length::cryptography
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size
shortlink: https://sg.run/5Qb0
semgrep.dev:
rule:
r_id: 9447
rv_id: 1263354
rule_id: KxUb0x
version_id: GxTkeOK
url: https://semgrep.dev/playground/r/GxTkeOK/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size
origin: community
languages:
- python
severity: WARNING
- id: python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size
patterns:
- pattern-inside: cryptography.hazmat.primitives.asymmetric.ec.generate_private_key(...)
- pattern: cryptography.hazmat.primitives.asymmetric.ec.$SIZE
- metavariable-pattern:
metavariable: $SIZE
pattern-either:
- pattern: SECP192R1
- pattern: SECT163K1
- pattern: SECT163R2
- focus-metavariable: $SIZE
fix: |
SECP256R1
message: Detected an insufficient curve size for EC. NIST recommends a key size
of 224 or higher. For example, use 'ec.SECP256R1'.
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py
references:
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf
- https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#elliptic-curves
category: security
technology:
- cryptography
subcategory:
- audit
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
functional-categories:
- crypto::search::key-length::cryptography
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size
shortlink: https://sg.run/GeQq
semgrep.dev:
rule:
r_id: 9448
rv_id: 1263355
rule_id: qNUjZ3
version_id: RGT0LW6
url: https://semgrep.dev/playground/r/RGT0LW6/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size
origin: community
languages:
- python
severity: WARNING
- id: python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size
patterns:
- pattern-either:
- pattern: cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key(...,
key_size=$SIZE, ...)
- pattern: cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key($EXP,
$SIZE, ...)
- metavariable-comparison:
metavariable: $SIZE
comparison: $SIZE < 2048
- focus-metavariable: $SIZE
fix: |
2048
message: Detected an insufficient key size for RSA. NIST recommends a key size of
2048 or higher.
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py
references:
- https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf
category: security
technology:
- cryptography
subcategory:
- audit
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
functional-categories:
- crypto::search::key-length::cryptography
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size
shortlink: https://sg.run/RoQq
semgrep.dev:
rule:
r_id: 9449
rv_id: 1263356
rule_id: lBU9jn
version_id: A8TgdPK
url: https://semgrep.dev/playground/r/A8TgdPK/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size
origin: community
languages:
- python
severity: WARNING
- id: python.distributed.security.require-encryption
patterns:
- pattern: |
distributed.security.Security(..., require_encryption=$VAL, ...)
- metavariable-pattern:
metavariable: $VAL
pattern: |
False
- focus-metavariable: $VAL
fix: |
True
message: Initializing a security context for Dask (`distributed`) without "require_encryption"
keyword argument may silently fail to provide security.
severity: WARNING
metadata:
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://distributed.dask.org/en/latest/tls.html?highlight=require_encryption#parameters
category: security
technology:
- distributed
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/python.distributed.security.require-encryption
shortlink: https://sg.run/AvQ2
semgrep.dev:
rule:
r_id: 9450
rv_id: 1263358
rule_id: YGURy0
version_id: DkTRbol
url: https://semgrep.dev/playground/r/DkTRbol/python.distributed.security.require-encryption
origin: community
languages:
- python
- id: python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization
metadata:
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
references:
- https://docs.python.org/3/library/pickle.html
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization
shortlink: https://sg.run/9oyr
semgrep.dev:
rule:
r_id: 9467
rv_id: 1409400
rule_id: OrU3e6
version_id: GxTlb9e
url: https://semgrep.dev/playground/r/GxTlb9e/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization
origin: community
message: Avoid using insecure deserialization library, backed by `pickle`, `_pickle`,
`cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code
execution vulnerabilities.
languages:
- python
severity: ERROR
mode: taint
pattern-sources:
- pattern-either:
- patterns:
- pattern-inside: |
def $INSIDE(..., $PARAM, ...):
...
- pattern-either:
- pattern: request.$REQFUNC(...)
- pattern: request.$REQFUNC.get(...)
- pattern: request.$REQFUNC[...]
pattern-sinks:
- pattern-either:
- patterns:
- pattern-either:
- pattern: |
pickle.$PICKLEFUNC(...)
- pattern: |
_pickle.$PICKLEFUNC(...)
- pattern: |
cPickle.$PICKLEFUNC(...)
- pattern: |
shelve.$PICKLEFUNC(...)
- metavariable-regex:
metavariable: $PICKLEFUNC
regex: dumps|dump|load|loads
- patterns:
- pattern: dill.$DILLFUNC(...)
- metavariable-regex:
metavariable: $DILLFUNC
regex: dump|dump_session|dumps|load|load_session|loads
- patterns:
- pattern: yaml.$YAMLFUNC(...)
- pattern-not: yaml.$YAMLFUNC(..., Dumper=SafeDumper, ...)
- pattern-not: yaml.$YAMLFUNC(..., Dumper=yaml.SafeDumper, ...)
- pattern-not: yaml.$YAMLFUNC(..., Loader=SafeLoader, ...)
- pattern-not: yaml.$YAMLFUNC(..., Loader=yaml.SafeLoader, ...)
- metavariable-regex:
metavariable: $YAMLFUNC
regex: dump|dump_all|load|load_all
- id: python.django.security.audit.avoid-mark-safe.avoid-mark-safe
patterns:
- pattern-not-inside: django.utils.html.format_html(...)
- pattern-not: django.utils.safestring.mark_safe("...")
- pattern: django.utils.safestring.mark_safe(...)
message: '''mark_safe()'' is used to mark a string as "safe" for HTML output. This
disables escaping and could therefore subject the content to XSS attacks. Use
''django.utils.html.format_html()'' to build HTML for rendering instead.'
metadata:
source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b703_django_mark_safe.html
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.safestring.mark_safe
- https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.html.format_html
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.django.security.audit.avoid-mark-safe.avoid-mark-safe
shortlink: https://sg.run/yd0P
semgrep.dev:
rule:
r_id: 9468
rv_id: 1263360
rule_id: eqU8Wr
version_id: 0bTKzkj
url: https://semgrep.dev/playground/r/0bTKzkj/python.django.security.audit.avoid-mark-safe.avoid-mark-safe
origin: community
languages:
- python
severity: WARNING
- id: python.django.security.audit.csrf-exempt.no-csrf-exempt
pattern: |
@django.views.decorators.csrf.csrf_exempt
def $R(...):
...
message: Detected usage of @csrf_exempt, which indicates that there is no CSRF token
set for this route. This could lead to an attacker manipulating the user's account
and exfiltration of private data. Instead, create a function without this decorator.
metadata:
cwe:
- 'CWE-352: Cross-Site Request Forgery (CSRF)'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
category: security
technology:
- django
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site Request Forgery (CSRF)
source: https://semgrep.dev/r/python.django.security.audit.csrf-exempt.no-csrf-exempt
shortlink: https://sg.run/rd5e
semgrep.dev:
rule:
r_id: 9469
rv_id: 1263361
rule_id: v8UnqO
version_id: K3TKk9W
url: https://semgrep.dev/playground/r/K3TKk9W/python.django.security.audit.csrf-exempt.no-csrf-exempt
origin: community
languages:
- python
severity: WARNING
- id: python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql
languages:
- python
message: Detected a Custom Expression ''$EXPRESSION'' calling ''as_sql(...).'' This
could lead to SQL injection, which can result in attackers exfiltrating sensitive
data. Instead, ensure no user input enters this function or that user input is
properly sanitized.
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.Func.as_sql
- https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql
shortlink: https://sg.run/b7bW
semgrep.dev:
rule:
r_id: 9470
rv_id: 1263362
rule_id: d8Ujk6
version_id: qkTR7gn
url: https://semgrep.dev/playground/r/qkTR7gn/python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql
origin: community
pattern: $EXPRESSION.as_sql(...)
severity: WARNING
- id: python.django.security.audit.extends-custom-expression.extends-custom-expression
languages:
- python
message: 'Found extension of custom expression: $CLASS. Extending expressions in
this way could inadvertently lead to a SQL injection vulnerability, which can
result in attackers exfiltrating sensitive data. Instead, ensure no user input
enters this function or that user input is properly sanitized.'
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.0/ref/models/expressions/#avoiding-sql-injection
- https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.django.security.audit.extends-custom-expression.extends-custom-expression
shortlink: https://sg.run/N4Ay
semgrep.dev:
rule:
r_id: 9471
rv_id: 1263364
rule_id: ZqU5z3
version_id: YDTZeGe
url: https://semgrep.dev/playground/r/YDTZeGe/python.django.security.audit.extends-custom-expression.extends-custom-expression
origin: community
severity: WARNING
pattern-either:
- pattern: |
class $CLASS(..., django.db.models.Func, ...):
...
- pattern: |
class $CLASS(..., django.db.models.expressions.Func, ...):
...
- pattern: |
class $CLASS(..., django.db.models.Expression, ...):
...
- pattern: |
class $CLASS(..., django.db.models.expressions.Expression, ...):
...
- pattern: |
class $CLASS(..., django.db.models.Value, ...):
...
- pattern: |
class $CLASS(..., django.db.models.expressions.Value, ...):
...
- pattern: |
class $CLASS(..., django.db.models.DurationValue, ...):
...
- pattern: |
class $CLASS(..., django.db.models.expressions.DurationValue, ...):
...
- pattern: |
class $CLASS(..., django.db.models.RawSQL, ...):
...
- pattern: |
class $CLASS(..., django.db.models.expressions.RawSQL, ...):
...
- pattern: |
class $CLASS(..., django.db.models.Star, ...):
...
- pattern: |
class $CLASS(..., django.db.models.expressions.Star, ...):
...
- pattern: |
class $CLASS(..., django.db.models.Random, ...):
...
- pattern: |
class $CLASS(..., django.db.models.expressions.Random, ...):
...
- pattern: |
class $CLASS(..., django.db.models.Col, ...):
...
- pattern: |
class $CLASS(..., django.db.models.expressions.Col, ...):
...
- pattern: |
class $CLASS(..., django.db.models.Ref, ...):
...
- pattern: |
class $CLASS(..., django.db.models.expressions.Ref, ...):
...
- pattern: |
class $CLASS(..., django.db.models.ExpressionList, ...):
...
- pattern: |
class $CLASS(..., django.db.models.expressions.ExpressionList, ...):
...
- pattern: |
class $CLASS(..., django.db.models.ExpressionWrapper, ...):
...
- pattern: |
class $CLASS(..., django.db.models.expressions.ExpressionWrapper, ...):
...
- pattern: |
class $CLASS(..., django.db.models.When, ...):
...
- pattern: |
class $CLASS(..., django.db.models.expressions.When, ...):
...
- pattern: |
class $CLASS(..., django.db.models.Case, ...):
...
- pattern: |
class $CLASS(..., django.db.models.expressions.Case, ...):
...
- pattern: |
class $CLASS(..., django.db.models.Subquery, ...):
...
- pattern: |
class $CLASS(..., django.db.models.expressions.Subquery, ...):
...
- pattern: |
class $CLASS(..., django.db.models.Exists, ...):
...
- pattern: |
class $CLASS(..., django.db.models.expressions.Exists, ...):
...
- pattern: |
class $CLASS(..., django.db.models.Window, ...):
...
- pattern: |
class $CLASS(..., django.db.models.expressions.Window, ...):
...
- pattern: |
class $CLASS(..., django.db.models.WindowFrame, ...):
...
- pattern: |
class $CLASS(..., django.db.models.expressions.WindowFrame, ...):
...
- pattern: |
class $CLASS(..., django.db.models.RowRange, ...):
...
- pattern: |
class $CLASS(..., django.db.models.expressions.RowRange, ...):
...
- pattern: |
class $CLASS(..., django.db.models.ValueRange, ...):
...
- pattern: |
class $CLASS(..., django.db.models.expressions.ValueRange, ...):
...
- id: python.django.security.audit.query-set-extra.avoid-query-set-extra
message: QuerySet.extra' does not provide safeguards against SQL injection and requires
very careful use. SQL injection can lead to critical data being stolen by attackers.
Instead of using '.extra', use the Django ORM and parameterized queries such as
`People.objects.get(name='Bob')`.
metadata:
source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b610_django_extra_used.html
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.0/ref/models/querysets/#django.db.models.query.QuerySet.extra
- https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.django.security.audit.query-set-extra.avoid-query-set-extra
shortlink: https://sg.run/kXZP
semgrep.dev:
rule:
r_id: 9472
rv_id: 1263365
rule_id: nJUzBP
version_id: 6xT297o
url: https://semgrep.dev/playground/r/6xT297o/python.django.security.audit.query-set-extra.avoid-query-set-extra
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern: $MODEL.extra(...)
- pattern-not-inside: '$MODEL.extra(select = {$KEY: "..."})'
- id: python.django.security.audit.raw-query.avoid-raw-sql
message: 'Detected the use of ''RawSQL'' or ''raw'' indicating the execution of
a non-parameterized SQL query. This could lead to a SQL injection and therefore
protected information could be leaked. Instead, use Django ORM and parameterized
queries before raw SQL. An example of using the Django ORM is: `People.objects.get(name=''Bob'')`'
metadata:
source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b611_django_rawsql_used.html
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.0/ref/models/expressions/#raw-sql-expressions
- https://semgrep.dev/blog/2020/preventing-sql-injection-a-django-authors-perspective/
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.django.security.audit.raw-query.avoid-raw-sql
shortlink: https://sg.run/weDA
semgrep.dev:
rule:
r_id: 9473
rv_id: 1263366
rule_id: EwU2JA
version_id: o5TbDQN
url: https://semgrep.dev/playground/r/o5TbDQN/python.django.security.audit.raw-query.avoid-raw-sql
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-either:
- pattern: $MODEL.objects.raw($QUERY, ...)
- pattern: django.db.models.expressions.RawSQL(...)
- pattern-not: $MODEL.objects.raw("...")
- pattern-not: django.db.models.expressions.RawSQL("...")
- id: python.django.security.audit.secure-cookies.django-secure-set-cookie
patterns:
- pattern-either:
- pattern-inside: |
import django.http.HttpResponse
...
- pattern-inside: |
import django.shortcuts.render
...
- pattern-not-inside: |
LANGUAGE_QUERY_PARAMETER = 'language'
...
def set_language(request):
...
# Exclude vendored contrib/messages/storage/cookie.py
- pattern-not-inside: |
class CookieStorage(django.contrib.messages.storage.base.BaseStorage):
...
# Exclude cookies handled by vendored middleware
- pattern-not: response.set_cookie(django.conf.settings.SESSION_COOKIE_NAME, ...)
- pattern-not: response.set_cookie(django.conf.settings.CSRF_COOKIE_NAME, ...)
- pattern-not: response.set_cookie(django.conf.settings.LANGUAGE_COOKIE_NAME, ...)
- pattern-not: response.set_cookie(rest_framework_jwt.settings.api_settings.JWT_AUTH_COOKIE,
...)
- pattern-not: response.set_cookie(..., secure=$A, httponly=$B, samesite=$C, ...)
- pattern-not: response.set_cookie(..., **$A)
- pattern: response.set_cookie(...)
message: Django cookies should be handled securely by setting secure=True, httponly=True,
and samesite='Lax' in response.set_cookie(...). If your situation calls for different
settings, explicitly disable the setting. If you want to send the cookie over
http, set secure=False. If you want to let client-side JavaScript read the cookie,
set httponly=False. If you want to attach cookies to requests for external sites,
set samesite=None.
metadata:
cwe:
- 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute'
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: 'V3: Session Management Verification Requirements'
control_id: 3.4 Missing Cookie Attributes
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v34-cookie-based-session-management
version: '4'
references:
- https://docs.djangoproject.com/en/3.0/ref/request-response/#django.http.HttpResponse.set_cookie
- https://semgrep.dev/blog/2020/bento-check-keeping-cookies-safe-in-flask/
- https://bento.dev/checks/flask/secure-set-cookie/
category: security
technology:
- django
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cookie Security
source: https://semgrep.dev/r/python.django.security.audit.secure-cookies.django-secure-set-cookie
shortlink: https://sg.run/x1WL
semgrep.dev:
rule:
r_id: 9474
rv_id: 1263367
rule_id: 7KUQ2E
version_id: zyTb2gp
url: https://semgrep.dev/playground/r/zyTb2gp/python.django.security.audit.secure-cookies.django-secure-set-cookie
origin: community
languages:
- python
severity: WARNING
- id: python.django.security.audit.unvalidated-password.unvalidated-password
patterns:
- pattern-not-inside: |
if <... django.contrib.auth.password_validation.validate_password(...) ...>:
...
- pattern-not-inside: |
django.contrib.auth.password_validation.validate_password(...)
...
- pattern-not-inside: |
try:
...
django.contrib.auth.password_validation.validate_password(...)
...
except $EX:
...
...
- pattern-not-inside: |
try:
...
django.contrib.auth.password_validation.validate_password(...)
...
except $EX as $E:
...
...
- pattern-not: UserModel().set_password($X)
- pattern: $MODEL.set_password($X)
fix: |
if django.contrib.auth.password_validation.validate_password($X, user=$MODEL):
$MODEL.set_password($X)
message: The password on '$MODEL' is being set without validating the password.
Call django.contrib.auth.password_validation.validate_password() with validation
functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/
for more information.
metadata:
cwe:
- 'CWE-521: Weak Password Requirements'
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://docs.djangoproject.com/en/3.0/topics/auth/passwords/#module-django.contrib.auth.password_validation
category: security
technology:
- django
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/python.django.security.audit.unvalidated-password.unvalidated-password
shortlink: https://sg.run/OPBL
semgrep.dev:
rule:
r_id: 9475
rv_id: 1263368
rule_id: L1UywG
version_id: pZT03gB
url: https://semgrep.dev/playground/r/pZT03gB/python.django.security.audit.unvalidated-password.unvalidated-password
origin: community
languages:
- python
severity: WARNING
- id: python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config
patterns:
- pattern-not-inside: |
REST_FRAMEWORK = {
...,
"DEFAULT_THROTTLE_RATES": ...
}
- pattern-inside: |
REST_FRAMEWORK = ...
- pattern: REST_FRAMEWORK
message: Django REST framework configuration is missing default rate- limiting options.
This could inadvertently allow resource starvation or Denial of Service (DoS)
attacks. Add 'DEFAULT_THROTTLE_CLASSES' and 'DEFAULT_THROTTLE_RATES' to add rate-limiting
to your application.
metadata:
owasp:
- A05:2021 - Security Misconfiguration
- A06:2017 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe:
- 'CWE-770: Allocation of Resources Without Limits or Throttling'
references:
- https://www.django-rest-framework.org/api-guide/throttling/#setting-the-throttling-policy
category: security
technology:
- django
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config
shortlink: https://sg.run/vzBY
semgrep.dev:
rule:
r_id: 9477
rv_id: 1263363
rule_id: gxU1wE
version_id: l4TJRqD
url: https://semgrep.dev/playground/r/l4TJRqD/python.django.security.audit.django-rest-framework.missing-throttle-config.missing-throttle-config
origin: community
severity: WARNING
languages:
- python
- id: python.django.security.audit.templates.debug-template-tag.debug-template-tag
languages:
- regex
severity: WARNING
message: Detected a debug template tag in a Django template. This dumps debugging
information to the page when debug mode is enabled. Showing debug information
to users is dangerous because it may reveal information about your environment
that malicious actors can use to gain access to the system. Remove the debug tag.
pattern-regex: ({% debug %})
paths:
include:
- '*.html'
metadata:
owasp: A06:2017 - Security Misconfiguration
cwe:
- 'CWE-489: Active Debug Code'
references:
- https://docs.djangoproject.com/en/4.2/ref/templates/builtins/#debug
- https://stackoverflow.com/questions/2213977/django-debug-display-all-variables-of-a-page
category: security
technology:
- django
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Active Debug Code
source: https://semgrep.dev/r/python.django.security.audit.templates.debug-template-tag.debug-template-tag
shortlink: https://sg.run/dK3E
semgrep.dev:
rule:
r_id: 9478
rv_id: 946146
rule_id: QrUzb2
version_id: ExTg2ZE
url: https://semgrep.dev/playground/r/ExTg2ZE/python.django.security.audit.templates.debug-template-tag.debug-template-tag
origin: community
- id: python.django.security.audit.xss.class-extends-safestring.class-extends-safestring
message: Found a class extending 'SafeString', 'SafeText' or 'SafeData'. These classes
are for bypassing the escaping engine built in to Django and should not be used
directly. Improper use of this class exposes your application to cross-site scripting
(XSS) vulnerabilities. If you need this functionality, use 'mark_safe' instead
and ensure no user data can reach it.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.1/howto/custom-template-tags/#filters-and-auto-escaping
- https://github.com/django/django/blob/f138e75910b1e541686c4dce3d8f467f6fc234cb/django/utils/safestring.py#L11
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.django.security.audit.xss.class-extends-safestring.class-extends-safestring
shortlink: https://sg.run/Zvpw
semgrep.dev:
rule:
r_id: 9479
rv_id: 1263369
rule_id: 3qUPve
version_id: 2KTv2N1
url: https://semgrep.dev/playground/r/2KTv2N1/python.django.security.audit.xss.class-extends-safestring.class-extends-safestring
origin: community
languages:
- python
severity: WARNING
pattern-either:
- pattern: |
class $CLASS(django.utils.safestring.SafeString):
...
- pattern: |
class $CLASS(django.utils.safestring.SafeText):
...
- pattern: |-
class $CLASS(django.utils.safestring.SafeData):
...
- id: python.django.security.audit.xss.context-autoescape-off.context-autoescape-off
message: 'Detected a Context with autoescape disabled. If you are rendering any
web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities.
Remove ''autoescape: False'' or set it to ''True''.'
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.1/ref/settings/#templates
- https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.django.security.audit.xss.context-autoescape-off.context-autoescape-off
shortlink: https://sg.run/nd7Y
semgrep.dev:
rule:
r_id: 9480
rv_id: 1263370
rule_id: 4bUknY
version_id: X0Tzye3
url: https://semgrep.dev/playground/r/X0Tzye3/python.django.security.audit.xss.context-autoescape-off.context-autoescape-off
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-either:
- pattern: |
{..., "autoescape": $FALSE, ...}
- pattern: |
$D["autoescape"] = $FALSE
- metavariable-pattern:
metavariable: $FALSE
pattern: |
False
- focus-metavariable: $FALSE
fix: |
True
- id: python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse
message: Detected data rendered directly to the end user via 'HttpResponse' or a
similar object. This bypasses Django's built-in cross-site scripting (XSS) defenses
and could result in an XSS vulnerability. Use Django's template engine to safely
render HTML.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.1/intro/tutorial03/#a-shortcut-render
- https://docs.djangoproject.com/en/3.1/topics/http/shortcuts/#render
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse
shortlink: https://sg.run/EknN
semgrep.dev:
rule:
r_id: 9481
rv_id: 1263371
rule_id: PeUZgE
version_id: jQTn5eO
url: https://semgrep.dev/playground/r/jQTn5eO/python.django.security.audit.xss.direct-use-of-httpresponse.direct-use-of-httpresponse
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-not: django.http.$ANY("...", ...)
- pattern-not: django.http.$ANY()
- pattern-not: django.http.$ANY(..., content=None, ...)
- pattern-not: django.http.$ANY(status=...)
- pattern-not: django.http.HttpResponseNotAllowed([...])
- pattern-either:
- patterns:
- pattern-either:
- pattern: django.http.HttpResponse(...)
- pattern: django.http.HttpResponseBadRequest(...)
- pattern: django.http.HttpResponseNotFound(...)
- pattern: django.http.HttpResponseForbidden(...)
- pattern: django.http.HttpResponseNotAllowed(...)
- pattern: django.http.HttpResponseGone(...)
- pattern: django.http.HttpResponseServerError(...)
- pattern-not: django.http.$ANY(...,content_type=$TYPE,...)
- patterns:
- pattern-either:
- pattern: django.http.HttpResponse(...,content_type=$TYPE,...)
- pattern: django.http.HttpResponseBadRequest(...,content_type=$TYPE,...)
- pattern: django.http.HttpResponseNotFound(...,content_type=$TYPE,...)
- pattern: django.http.HttpResponseForbidden(...,content_type=$TYPE,...)
- pattern: django.http.HttpResponseNotAllowed(...,content_type=$TYPE,...)
- pattern: django.http.HttpResponseGone(...,content_type=$TYPE,...)
- pattern: django.http.HttpResponseServerError(...,content_type=$TYPE,...)
- metavariable-regex:
metavariable: $TYPE
regex: .*[tT][eE][xX][tT]/[hH][tT][mM][lL].*
- id: python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe
message: Detected Django filters flagged with 'is_safe'. 'is_safe' tells Django
not to apply escaping on the value returned by this filter (although the input
is escaped). Used improperly, 'is_safe' could expose your application to cross-site
scripting (XSS) vulnerabilities. Ensure this filter does not 1) add HTML characters,
2) remove characters, or 3) use external data in any way. Consider instead removing
'is_safe' and explicitly marking safe content with 'mark_safe()'.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.1/topics/security/#cross-site-scripting-xss-protection
- https://docs.djangoproject.com/en/3.1/howto/custom-template-tags/#filters-and-auto-escaping
- https://stackoverflow.com/questions/7665512/why-use-is-safe
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe
shortlink: https://sg.run/7o12
semgrep.dev:
rule:
r_id: 9482
rv_id: 1263372
rule_id: JDUyd4
version_id: 1QTypA8
url: https://semgrep.dev/playground/r/1QTypA8/python.django.security.audit.xss.filter-with-is-safe.filter-with-is-safe
origin: community
languages:
- python
severity: WARNING
pattern: |-
@register.filter(..., is_safe=True, ...)
def $FILTER(...):
...
- id: python.django.security.audit.xss.global-autoescape-off.global-autoescape-off
message: 'Autoescape is globally disbaled for this Django application. If you are
rendering any web pages, this exposes your application to cross-site scripting
(XSS) vulnerabilities. Remove ''autoescape: False'' or set it to ''True''.'
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.1/ref/settings/#templates
- https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.django.security.audit.xss.global-autoescape-off.global-autoescape-off
shortlink: https://sg.run/LwG6
semgrep.dev:
rule:
r_id: 9483
rv_id: 1263374
rule_id: 5rUOXK
version_id: yeTxp93
url: https://semgrep.dev/playground/r/yeTxp93/python.django.security.audit.xss.global-autoescape-off.global-autoescape-off
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern: |
{..., 'BACKEND': ..., 'OPTIONS': {..., 'autoescape': $FALSE, ...}, ...}
- metavariable-pattern:
metavariable: $FALSE
pattern: |
False
- focus-metavariable: $FALSE
fix: |
True
- id: python.django.security.audit.xss.html-magic-method.html-magic-method
message: The `__html__` method indicates to the Django template engine that the
value is 'safe' for rendering. This means that normal HTML escaping will not be
applied to the return value. This exposes your application to cross-site scripting
(XSS) vulnerabilities. If you need to render raw HTML, consider instead using
`mark_safe()` which more clearly marks the intent to render raw HTML than a class
with a magic method.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.0/_modules/django/utils/html/#conditional_escape
- https://gist.github.com/minusworld/7885d8a81dba3ea2d1e4b8fd3c218ef5
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.django.security.audit.xss.html-magic-method.html-magic-method
shortlink: https://sg.run/8y9N
semgrep.dev:
rule:
r_id: 9484
rv_id: 1263375
rule_id: GdU7QO
version_id: rxTAKRo
url: https://semgrep.dev/playground/r/rxTAKRo/python.django.security.audit.xss.html-magic-method.html-magic-method
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-inside: |
class $CLASS(...):
...
- pattern: |
def __html__(...):
...
- id: python.django.security.audit.xss.html-safe.html-safe
message: '`html_safe()` add the `__html__` magic method to the provided class. The
`__html__` method indicates to the Django template engine that the value is ''safe''
for rendering. This means that normal HTML escaping will not be applied to the
return value. This exposes your application to cross-site scripting (XSS) vulnerabilities.
If you need to render raw HTML, consider instead using `mark_safe()` which more
clearly marks the intent to render raw HTML than a class with a magic method.'
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.0/_modules/django/utils/html/#html_safe
- https://gist.github.com/minusworld/7885d8a81dba3ea2d1e4b8fd3c218ef5
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.django.security.audit.xss.html-safe.html-safe
shortlink: https://sg.run/gLO0
semgrep.dev:
rule:
r_id: 9485
rv_id: 1263376
rule_id: ReUg5Y
version_id: bZT53Dw
url: https://semgrep.dev/playground/r/bZT53Dw/python.django.security.audit.xss.html-safe.html-safe
origin: community
languages:
- python
severity: WARNING
pattern-either:
- pattern: django.utils.html.html_safe(...)
- pattern: |
@django.utils.html.html_safe
class $CLASS(...):
...
- id: python.django.security.audit.xss.template-autoescape-off.template-autoescape-off
message: Detected a template block where autoescaping is explicitly disabled with
'{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn
autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider
instead, using `mark_safe` in Python code.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.1/ref/templates/builtins/#autoescape
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.django.security.audit.xss.template-autoescape-off.template-autoescape-off
shortlink: https://sg.run/Q5WZ
semgrep.dev:
rule:
r_id: 9486
rv_id: 1263377
rule_id: AbUzAZ
version_id: NdTzy0A
url: https://semgrep.dev/playground/r/NdTzy0A/python.django.security.audit.xss.template-autoescape-off.template-autoescape-off
origin: community
languages:
- regex
paths:
include:
- '*.html'
severity: WARNING
pattern-regex: '{%\s+autoescape\s+off\s+%}'
- id: python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape
languages:
- generic
severity: INFO
message: Translated strings will not be escaped when rendered in a template. This
leads to a vulnerability where translators could include malicious script tags
in their translations. Consider using `force_escape` to explicitly escape a translated
text.
patterns:
- pattern-either:
- pattern: |
{% blocktranslate...%}
- pattern: |
{% blocktrans...%}
- pattern-not-inside: |
{%...filter...force_escape...%}
...
...
...
...
...
...
...
...
...
...
{%...endfilter...%}
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates
- https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape
shortlink: https://sg.run/3xpK
semgrep.dev:
rule:
r_id: 9487
rv_id: 1263378
rule_id: BYUNwg
version_id: kbTzG08
url: https://semgrep.dev/playground/r/kbTzG08/python.django.security.audit.xss.template-blocktranslate-no-escape.template-blocktranslate-no-escape
origin: community
- id: python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape
languages:
- generic
severity: INFO
message: Translated strings will not be escaped when rendered in a template. This
leads to a vulnerability where translators could include malicious script tags
in their translations. Consider using `force_escape` to explicitly escape a translated
text.
patterns:
- pattern-either:
- pattern: |
{% translate ... as $TRANS ... %}
...
...
...
...
...
...
...
...
...
...
{{ ... $TRANS ... }}
- pattern: |
{% trans ... as $TRANS ... %}
...
...
...
...
...
...
...
...
...
...
{{ ... $TRANS ... }}
- pattern-not: |
{% translate ... as $TRANS ... %}
...
...
...
...
...
...
...
...
...
...
{{ ... $TRANS ... | ... force_escape ... }}
- pattern-not: |
{% trans ... as $TRANS ... %}
...
...
...
...
...
...
...
...
...
...
{{ ... $TRANS ... | ... force_escape ... }}
- pattern-not: |
{% translate ... as $TRANS ... %}
...
...
...
...
...
...
...
...
...
...
{% filter force_escape %}
...
...
...
...
...
...
...
...
...
...
{{ ... $TRANS ... }}
- pattern-not: |
{% trans ... as $TRANS ... %}
...
...
...
...
...
...
...
...
...
...
{% filter force_escape %}
...
...
...
...
...
...
...
...
...
...
{{ ... $TRANS ... }}
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss_in_django_templates.html#html-escaping-translations-in-django-templates
- https://docs.djangoproject.com/en/3.1/topics/i18n/translation/#internationalization-in-template-code
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape
shortlink: https://sg.run/PJDz
semgrep.dev:
rule:
r_id: 9489
rv_id: 1263379
rule_id: WAUov9
version_id: w8TRodj
url: https://semgrep.dev/playground/r/w8TRodj/python.django.security.audit.xss.template-translate-as-no-escape.template-translate-as-no-escape
origin: community
- id: python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq
message: Detected a template variable where autoescaping is explicitly disabled
with '| safeseq' filter. This allows rendering of raw HTML in this segment. Ensure
no user data is rendered here, otherwise this is a cross-site scripting (XSS)
vulnerability. If you must do this, use `mark_safe` in your Python code.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.0/ref/templates/builtins/#safeseq
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq
shortlink: https://sg.run/5Q30
semgrep.dev:
rule:
r_id: 9491
rv_id: 1263380
rule_id: KxUbdx
version_id: xyTjzyG
url: https://semgrep.dev/playground/r/xyTjzyG/python.django.security.audit.xss.template-var-unescaped-with-safeseq.template-var-unescaped-with-safeseq
origin: community
languages:
- regex
paths:
include:
- '*.html'
severity: WARNING
pattern-regex: '{{.*?\|\s+safeseq(\s+}})?'
- id: python.django.security.injection.mass-assignment.mass-assignment
languages:
- python
severity: WARNING
message: Mass assignment detected. This can result in assignment to model fields
that are unintended and can be exploited by an attacker. Instead of using '**request.$W',
assign each field you want to edit individually to prevent mass assignment. You
can read more about mass assignment at https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html.
metadata:
cwe:
- 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object
Attributes'
owasp:
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
owaspapi: 'API6: Mass Assignment'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html
category: security
technology:
- django
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mass Assignment
source: https://semgrep.dev/r/python.django.security.injection.mass-assignment.mass-assignment
shortlink: https://sg.run/Ro0q
semgrep.dev:
rule:
r_id: 9493
rv_id: 1263392
rule_id: lBU97n
version_id: QkTGqlQ
url: https://semgrep.dev/playground/r/QkTGqlQ/python.django.security.injection.mass-assignment.mass-assignment
origin: community
pattern-either:
- pattern: $MODEL.objects.create(**request.$W)
- pattern: |
$OBJ.update(**request.$W)
...
$OBJ.save()
- id: python.django.security.injection.open-redirect.open-redirect
message: Data from request ($DATA) is passed to redirect(). This is an open redirect
and could be exploited. Ensure you are redirecting to safe URLs by using django.utils.http.is_safe_url().
See https://cwe.mitre.org/data/definitions/601.html for more information.
metadata:
cwe:
- 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://www.djm.org.uk/posts/djangos-little-protections-word-redirect-dangers/
- https://github.com/django/django/blob/d1b7bd030b1db111e1a3505b1fc029ab964382cc/django/utils/http.py#L231
category: security
technology:
- django
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Open Redirect
source: https://semgrep.dev/r/python.django.security.injection.open-redirect.open-redirect
shortlink: https://sg.run/Ave2
semgrep.dev:
rule:
r_id: 9494
rv_id: 1263393
rule_id: PeUZgr
version_id: 3ZT4XD7
url: https://semgrep.dev/playground/r/3ZT4XD7/python.django.security.injection.open-redirect.open-redirect
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-not-inside: |
def $FUNC(...):
...
django.utils.http.is_safe_url(...)
...
- pattern-not-inside: |
def $FUNC(...):
...
if <... django.utils.http.is_safe_url(...) ...>:
...
- pattern-not-inside: |
def $FUNC(...):
...
django.utils.http.url_has_allowed_host_and_scheme(...)
...
- pattern-not-inside: |
def $FUNC(...):
...
if <... django.utils.http.url_has_allowed_host_and_scheme(...) ...>:
...
- pattern-either:
- pattern: django.shortcuts.redirect(..., request.$W.get(...), ...)
- pattern: django.shortcuts.redirect(..., $S.format(..., request.$W.get(...),
...), ...)
- pattern: django.shortcuts.redirect(..., $S % request.$W.get(...), ...)
- pattern: django.shortcuts.redirect(..., f"...{request.$W.get(...)}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.shortcuts.redirect(..., $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
django.shortcuts.redirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.shortcuts.redirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.shortcuts.redirect(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
django.shortcuts.redirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.shortcuts.redirect(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
django.shortcuts.redirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.shortcuts.redirect(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
django.shortcuts.redirect(..., $INTERM, ...)
- pattern: $A = django.shortcuts.redirect(..., request.$W.get(...), ...)
- pattern: $A = django.shortcuts.redirect(..., $S.format(..., request.$W.get(...),
...), ...)
- pattern: $A = django.shortcuts.redirect(..., $S % request.$W.get(...), ...)
- pattern: $A = django.shortcuts.redirect(..., f"...{request.$W.get(...)}...",
...)
- pattern: return django.shortcuts.redirect(..., request.$W.get(...), ...)
- pattern: return django.shortcuts.redirect(..., $S.format(..., request.$W.get(...),
...), ...)
- pattern: return django.shortcuts.redirect(..., $S % request.$W.get(...), ...)
- pattern: return django.shortcuts.redirect(..., f"...{request.$W.get(...)}...",
...)
- pattern: django.shortcuts.redirect(..., request.$W(...), ...)
- pattern: django.shortcuts.redirect(..., $S.format(..., request.$W(...), ...),
...)
- pattern: django.shortcuts.redirect(..., $S % request.$W(...), ...)
- pattern: django.shortcuts.redirect(..., f"...{request.$W(...)}...", ...)
- pattern: |
$DATA = request.$W(...)
...
django.shortcuts.redirect(..., $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
django.shortcuts.redirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.shortcuts.redirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.shortcuts.redirect(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
django.shortcuts.redirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.shortcuts.redirect(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
django.shortcuts.redirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.shortcuts.redirect(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
django.shortcuts.redirect(..., $INTERM, ...)
- pattern: $A = django.shortcuts.redirect(..., request.$W(...), ...)
- pattern: $A = django.shortcuts.redirect(..., $S.format(..., request.$W(...),
...), ...)
- pattern: $A = django.shortcuts.redirect(..., $S % request.$W(...), ...)
- pattern: $A = django.shortcuts.redirect(..., f"...{request.$W(...)}...", ...)
- pattern: return django.shortcuts.redirect(..., request.$W(...), ...)
- pattern: return django.shortcuts.redirect(..., $S.format(..., request.$W(...),
...), ...)
- pattern: return django.shortcuts.redirect(..., $S % request.$W(...), ...)
- pattern: return django.shortcuts.redirect(..., f"...{request.$W(...)}...", ...)
- pattern: django.shortcuts.redirect(..., request.$W[...], ...)
- pattern: django.shortcuts.redirect(..., $S.format(..., request.$W[...], ...),
...)
- pattern: django.shortcuts.redirect(..., $S % request.$W[...], ...)
- pattern: django.shortcuts.redirect(..., f"...{request.$W[...]}...", ...)
- pattern: |
$DATA = request.$W[...]
...
django.shortcuts.redirect(..., $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
django.shortcuts.redirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.shortcuts.redirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.shortcuts.redirect(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
django.shortcuts.redirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.shortcuts.redirect(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
django.shortcuts.redirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.shortcuts.redirect(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
django.shortcuts.redirect(..., $INTERM, ...)
- pattern: $A = django.shortcuts.redirect(..., request.$W[...], ...)
- pattern: $A = django.shortcuts.redirect(..., $S.format(..., request.$W[...],
...), ...)
- pattern: $A = django.shortcuts.redirect(..., $S % request.$W[...], ...)
- pattern: $A = django.shortcuts.redirect(..., f"...{request.$W[...]}...", ...)
- pattern: return django.shortcuts.redirect(..., request.$W[...], ...)
- pattern: return django.shortcuts.redirect(..., $S.format(..., request.$W[...],
...), ...)
- pattern: return django.shortcuts.redirect(..., $S % request.$W[...], ...)
- pattern: return django.shortcuts.redirect(..., f"...{request.$W[...]}...", ...)
- pattern: django.shortcuts.redirect(..., request.$W, ...)
- pattern: django.shortcuts.redirect(..., $S.format(..., request.$W, ...), ...)
- pattern: django.shortcuts.redirect(..., $S % request.$W, ...)
- pattern: django.shortcuts.redirect(..., f"...{request.$W}...", ...)
- pattern: |
$DATA = request.$W
...
django.shortcuts.redirect(..., $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
django.shortcuts.redirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.shortcuts.redirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.shortcuts.redirect(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
django.shortcuts.redirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.shortcuts.redirect(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
django.shortcuts.redirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.shortcuts.redirect(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
django.shortcuts.redirect(..., $INTERM, ...)
- pattern: $A = django.shortcuts.redirect(..., request.$W, ...)
- pattern: $A = django.shortcuts.redirect(..., $S.format(..., request.$W, ...),
...)
- pattern: $A = django.shortcuts.redirect(..., $S % request.$W, ...)
- pattern: $A = django.shortcuts.redirect(..., f"...{request.$W}...", ...)
- pattern: return django.shortcuts.redirect(..., request.$W, ...)
- pattern: return django.shortcuts.redirect(..., $S.format(..., request.$W, ...),
...)
- pattern: return django.shortcuts.redirect(..., $S % request.$W, ...)
- pattern: return django.shortcuts.redirect(..., f"...{request.$W}...", ...)
- pattern: django.http.HttpResponseRedirect(..., request.$W.get(...), ...)
- pattern: django.http.HttpResponseRedirect(..., $S.format(..., request.$W.get(...),
...), ...)
- pattern: django.http.HttpResponseRedirect(..., $S % request.$W.get(...), ...)
- pattern: django.http.HttpResponseRedirect(..., f"...{request.$W.get(...)}...",
...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponseRedirect(..., $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
django.http.HttpResponseRedirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.http.HttpResponseRedirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponseRedirect(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
django.http.HttpResponseRedirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponseRedirect(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
django.http.HttpResponseRedirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponseRedirect(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
django.http.HttpResponseRedirect(..., $INTERM, ...)
- pattern: $A = django.http.HttpResponseRedirect(..., request.$W.get(...), ...)
- pattern: $A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W.get(...),
...), ...)
- pattern: $A = django.http.HttpResponseRedirect(..., $S % request.$W.get(...),
...)
- pattern: $A = django.http.HttpResponseRedirect(..., f"...{request.$W.get(...)}...",
...)
- pattern: return django.http.HttpResponseRedirect(..., request.$W.get(...), ...)
- pattern: return django.http.HttpResponseRedirect(..., $S.format(..., request.$W.get(...),
...), ...)
- pattern: return django.http.HttpResponseRedirect(..., $S % request.$W.get(...),
...)
- pattern: return django.http.HttpResponseRedirect(..., f"...{request.$W.get(...)}...",
...)
- pattern: django.http.HttpResponseRedirect(..., request.$W(...), ...)
- pattern: django.http.HttpResponseRedirect(..., $S.format(..., request.$W(...),
...), ...)
- pattern: django.http.HttpResponseRedirect(..., $S % request.$W(...), ...)
- pattern: django.http.HttpResponseRedirect(..., f"...{request.$W(...)}...", ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponseRedirect(..., $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
django.http.HttpResponseRedirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.http.HttpResponseRedirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponseRedirect(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
django.http.HttpResponseRedirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponseRedirect(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
django.http.HttpResponseRedirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponseRedirect(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
django.http.HttpResponseRedirect(..., $INTERM, ...)
- pattern: $A = django.http.HttpResponseRedirect(..., request.$W(...), ...)
- pattern: $A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W(...),
...), ...)
- pattern: $A = django.http.HttpResponseRedirect(..., $S % request.$W(...), ...)
- pattern: $A = django.http.HttpResponseRedirect(..., f"...{request.$W(...)}...",
...)
- pattern: return django.http.HttpResponseRedirect(..., request.$W(...), ...)
- pattern: return django.http.HttpResponseRedirect(..., $S.format(..., request.$W(...),
...), ...)
- pattern: return django.http.HttpResponseRedirect(..., $S % request.$W(...),
...)
- pattern: return django.http.HttpResponseRedirect(..., f"...{request.$W(...)}...",
...)
- pattern: django.http.HttpResponseRedirect(..., request.$W[...], ...)
- pattern: django.http.HttpResponseRedirect(..., $S.format(..., request.$W[...],
...), ...)
- pattern: django.http.HttpResponseRedirect(..., $S % request.$W[...], ...)
- pattern: django.http.HttpResponseRedirect(..., f"...{request.$W[...]}...", ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponseRedirect(..., $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
django.http.HttpResponseRedirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.http.HttpResponseRedirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponseRedirect(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
django.http.HttpResponseRedirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponseRedirect(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
django.http.HttpResponseRedirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponseRedirect(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
django.http.HttpResponseRedirect(..., $INTERM, ...)
- pattern: $A = django.http.HttpResponseRedirect(..., request.$W[...], ...)
- pattern: $A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W[...],
...), ...)
- pattern: $A = django.http.HttpResponseRedirect(..., $S % request.$W[...], ...)
- pattern: $A = django.http.HttpResponseRedirect(..., f"...{request.$W[...]}...",
...)
- pattern: return django.http.HttpResponseRedirect(..., request.$W[...], ...)
- pattern: return django.http.HttpResponseRedirect(..., $S.format(..., request.$W[...],
...), ...)
- pattern: return django.http.HttpResponseRedirect(..., $S % request.$W[...],
...)
- pattern: return django.http.HttpResponseRedirect(..., f"...{request.$W[...]}...",
...)
- pattern: django.http.HttpResponseRedirect(..., request.$W, ...)
- pattern: django.http.HttpResponseRedirect(..., $S.format(..., request.$W, ...),
...)
- pattern: django.http.HttpResponseRedirect(..., $S % request.$W, ...)
- pattern: django.http.HttpResponseRedirect(..., f"...{request.$W}...", ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponseRedirect(..., $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
django.http.HttpResponseRedirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.http.HttpResponseRedirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponseRedirect(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
django.http.HttpResponseRedirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponseRedirect(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
django.http.HttpResponseRedirect(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponseRedirect(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
django.http.HttpResponseRedirect(..., $INTERM, ...)
- pattern: $A = django.http.HttpResponseRedirect(..., request.$W, ...)
- pattern: $A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W,
...), ...)
- pattern: $A = django.http.HttpResponseRedirect(..., $S % request.$W, ...)
- pattern: $A = django.http.HttpResponseRedirect(..., f"...{request.$W}...", ...)
- pattern: return django.http.HttpResponseRedirect(..., request.$W, ...)
- pattern: return django.http.HttpResponseRedirect(..., $S.format(..., request.$W,
...), ...)
- pattern: return django.http.HttpResponseRedirect(..., $S % request.$W, ...)
- pattern: return django.http.HttpResponseRedirect(..., f"...{request.$W}...",
...)
- metavariable-regex:
metavariable: $W
regex: (?!get_full_path)
- id: python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse
message: Found user-controlled request data passed into HttpResponse. This could
be vulnerable to XSS, leading to attackers gaining access to user cookies and
protected information. Ensure that the request data is properly escaped or sanitzed.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse
shortlink: https://sg.run/BkvA
semgrep.dev:
rule:
r_id: 9495
rv_id: 1263398
rule_id: JDUydR
version_id: GxTke5K
url: https://semgrep.dev/playground/r/GxTke5K/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: django.http.HttpResponse(..., $S.format(..., request.$W.get(...), ...),
...)
- pattern: django.http.HttpResponse(..., $S % request.$W.get(...), ...)
- pattern: django.http.HttpResponse(..., f"...{request.$W.get(...)}...", ...)
- pattern: django.http.HttpResponse(..., request.$W.get(...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponse(..., $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponse(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponse(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponse(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: $A = django.http.HttpResponse(..., request.$W.get(...), ...)
- pattern: return django.http.HttpResponse(..., request.$W.get(...), ...)
- pattern: django.http.HttpResponse(..., $S.format(..., request.$W(...), ...),
...)
- pattern: django.http.HttpResponse(..., $S % request.$W(...), ...)
- pattern: django.http.HttpResponse(..., f"...{request.$W(...)}...", ...)
- pattern: django.http.HttpResponse(..., request.$W(...), ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponse(..., $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponse(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponse(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponse(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: $A = django.http.HttpResponse(..., request.$W(...), ...)
- pattern: return django.http.HttpResponse(..., request.$W(...), ...)
- pattern: django.http.HttpResponse(..., $S.format(..., request.$W[...], ...),
...)
- pattern: django.http.HttpResponse(..., $S % request.$W[...], ...)
- pattern: django.http.HttpResponse(..., f"...{request.$W[...]}...", ...)
- pattern: django.http.HttpResponse(..., request.$W[...], ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponse(..., $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponse(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponse(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponse(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: $A = django.http.HttpResponse(..., request.$W[...], ...)
- pattern: return django.http.HttpResponse(..., request.$W[...], ...)
- pattern: django.http.HttpResponse(..., $S.format(..., request.$W, ...), ...)
- pattern: django.http.HttpResponse(..., $S % request.$W, ...)
- pattern: django.http.HttpResponse(..., f"...{request.$W}...", ...)
- pattern: django.http.HttpResponse(..., request.$W, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponse(..., $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponse(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponse(..., f"...{$DATA}...", ...)
- pattern: $A = django.http.HttpResponse(..., request.$W, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
$A = django.http.HttpResponse(..., $INTERM, ...)
- pattern: return django.http.HttpResponse(..., request.$W, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponse(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- id: python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest
message: Found user-controlled request data passed into a HttpResponseBadRequest.
This could be vulnerable to XSS, leading to attackers gaining access to user cookies
and protected information. Ensure that the request data is properly escaped or
sanitzed.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest
shortlink: https://sg.run/DoZP
semgrep.dev:
rule:
r_id: 9496
rv_id: 1263399
rule_id: 5rUOX1
version_id: RGT0LY6
url: https://semgrep.dev/playground/r/RGT0LY6/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W.get(...),
...), ...)
- pattern: django.http.HttpResponseBadRequest(..., $S % request.$W.get(...), ...)
- pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W.get(...)}...",
...)
- pattern: django.http.HttpResponseBadRequest(..., request.$W.get(...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponseBadRequest(..., $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponseBadRequest(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponseBadRequest(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: $A = django.http.HttpResponseBadRequest(..., request.$W.get(...), ...)
- pattern: return django.http.HttpResponseBadRequest(..., request.$W.get(...),
...)
- pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W(...),
...), ...)
- pattern: django.http.HttpResponseBadRequest(..., $S % request.$W(...), ...)
- pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W(...)}...",
...)
- pattern: django.http.HttpResponseBadRequest(..., request.$W(...), ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponseBadRequest(..., $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponseBadRequest(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponseBadRequest(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: $A = django.http.HttpResponseBadRequest(..., request.$W(...), ...)
- pattern: return django.http.HttpResponseBadRequest(..., request.$W(...), ...)
- pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W[...],
...), ...)
- pattern: django.http.HttpResponseBadRequest(..., $S % request.$W[...], ...)
- pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W[...]}...",
...)
- pattern: django.http.HttpResponseBadRequest(..., request.$W[...], ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponseBadRequest(..., $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponseBadRequest(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponseBadRequest(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: $A = django.http.HttpResponseBadRequest(..., request.$W[...], ...)
- pattern: return django.http.HttpResponseBadRequest(..., request.$W[...], ...)
- pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W,
...), ...)
- pattern: django.http.HttpResponseBadRequest(..., $S % request.$W, ...)
- pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W}...", ...)
- pattern: django.http.HttpResponseBadRequest(..., request.$W, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponseBadRequest(..., $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponseBadRequest(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponseBadRequest(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: $A = django.http.HttpResponseBadRequest(..., request.$W, ...)
- pattern: return django.http.HttpResponseBadRequest(..., request.$W, ...)
- id: python.django.security.injection.request-data-fileresponse.request-data-fileresponse
message: Found user-controlled request data being passed into a file open, which
is them passed as an argument into the FileResponse. This is dangerous because
an attacker could specify an arbitrary file to read, which could result in leaking
important data. Be sure to validate or sanitize the user-inputted filename in
the request data before using it in FileResponse.
metadata:
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse
shortlink: https://sg.run/W862
semgrep.dev:
rule:
r_id: 9497
rv_id: 1263400
rule_id: GdU7QR
version_id: A8Tgd1K
url: https://semgrep.dev/playground/r/A8Tgd1K/python.django.security.injection.request-data-fileresponse.request-data-fileresponse
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: django.http.FileResponse(..., request.$W.get(...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.FileResponse(..., open($DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = open($DATA, ...)
...
django.http.FileResponse(..., $INTERM, ...)
- pattern: $A = django.http.FileResponse(..., request.$W.get(...), ...)
- pattern: return django.http.FileResponse(..., request.$W.get(...), ...)
- pattern: django.http.FileResponse(..., request.$W(...), ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.FileResponse(..., open($DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = open($DATA, ...)
...
django.http.FileResponse(..., $INTERM, ...)
- pattern: $A = django.http.FileResponse(..., request.$W(...), ...)
- pattern: return django.http.FileResponse(..., request.$W(...), ...)
- pattern: django.http.FileResponse(..., request.$W[...], ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.FileResponse(..., open($DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = open($DATA, ...)
...
django.http.FileResponse(..., $INTERM, ...)
- pattern: $A = django.http.FileResponse(..., request.$W[...], ...)
- pattern: return django.http.FileResponse(..., request.$W[...], ...)
- pattern: django.http.FileResponse(..., request.$W, ...)
- pattern: |
$DATA = request.$W
...
django.http.FileResponse(..., open($DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = open($DATA, ...)
...
django.http.FileResponse(..., $INTERM, ...)
- pattern: $A = django.http.FileResponse(..., request.$W, ...)
- pattern: return django.http.FileResponse(..., request.$W, ...)
- id: python.django.security.injection.request-data-write.request-data-write
message: Found user-controlled request data passed into '.write(...)'. This could
be dangerous if a malicious actor is able to control data into sensitive files.
For example, a malicious actor could force rolling of critical log files, or cause
a denial-of-service by using up available disk space. Instead, ensure that request
data is properly escaped or sanitized.
metadata:
cwe:
- 'CWE-93: Improper Neutralization of CRLF Sequences (''CRLF Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- django
references:
- https://owasp.org/Top10/A03_2021-Injection
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/python.django.security.injection.request-data-write.request-data-write
shortlink: https://sg.run/0Q6j
semgrep.dev:
rule:
r_id: 9498
rv_id: 1263401
rule_id: ReUg5z
version_id: BjTkZO5
url: https://semgrep.dev/playground/r/BjTkZO5/python.django.security.injection.request-data-write.request-data-write
origin: community
languages:
- python
severity: WARNING
pattern-either:
- pattern: $F.write(..., request.$W.get(...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$F.write(..., $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
$F.write(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$F.write(..., $B.$C(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $B.$C(..., $DATA, ...)
...
$F.write(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$F.write(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
$F.write(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$F.write(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
$F.write(..., $INTERM, ...)
- pattern: $A = $F.write(..., request.$W.get(...), ...)
- pattern: return $F.write(..., request.$W.get(...), ...)
- pattern: $F.write(..., request.$W(...), ...)
- pattern: |
$DATA = request.$W(...)
...
$F.write(..., $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
$F.write(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$F.write(..., $B.$C(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $B.$C(..., $DATA, ...)
...
$F.write(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$F.write(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
$F.write(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$F.write(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
$F.write(..., $INTERM, ...)
- pattern: $A = $F.write(..., request.$W(...), ...)
- pattern: return $F.write(..., request.$W(...), ...)
- pattern: $F.write(..., request.$W[...], ...)
- pattern: |
$DATA = request.$W[...]
...
$F.write(..., $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
$F.write(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$F.write(..., $B.$C(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $B.$C(..., $DATA, ...)
...
$F.write(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$F.write(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
$F.write(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$F.write(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
$F.write(..., $INTERM, ...)
- pattern: $A = $F.write(..., request.$W[...], ...)
- pattern: return $F.write(..., request.$W[...], ...)
- pattern: $F.write(..., request.$W, ...)
- pattern: |
$DATA = request.$W
...
$F.write(..., $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
$F.write(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$F.write(..., $B.$C(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $B.$C(..., $DATA, ...)
...
$F.write(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$F.write(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
$F.write(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$F.write(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
$F.write(..., $INTERM, ...)
- pattern: $A = $F.write(..., request.$W, ...)
- pattern: return $F.write(..., request.$W, ...)
- id: python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution
message: Found request data as an index to 'globals()'. This is extremely dangerous
because it allows an attacker to execute arbitrary code on the system. Refactor
your code not to use 'globals()'.
metadata:
cwe:
- 'CWE-96: Improper Neutralization of Directives in Statically Saved Code (''Static
Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186
category: security
technology:
- django
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution
shortlink: https://sg.run/Kl55
semgrep.dev:
rule:
r_id: 9499
rv_id: 1263382
rule_id: AbUzAA
version_id: e1TyjXZ
url: https://semgrep.dev/playground/r/e1TyjXZ/python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = globals().get($DATA, ...)
...
$INTERM(...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = globals().get("..." % $DATA, ...)
...
$INTERM(...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = globals().get(f"...{$DATA}...", ...)
...
$INTERM(...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = globals().get("...".format(..., $DATA, ...), ...)
...
$INTERM(...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = globals()[$DATA]
...
$INTERM(...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = globals()["..." % $DATA]
...
$INTERM(...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = globals()[f"...{$DATA}..."]
...
$INTERM(...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = globals()["...".format(..., $DATA, ...)]
...
$INTERM(...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = globals().get($DATA, ...)
...
$INTERM(...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = globals().get("..." % $DATA, ...)
...
$INTERM(...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = globals().get(f"...{$DATA}...", ...)
...
$INTERM(...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = globals().get("...".format(..., $DATA, ...), ...)
...
$INTERM(...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = globals()[$DATA]
...
$INTERM(...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = globals()["..." % $DATA]
...
$INTERM(...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = globals()[f"...{$DATA}..."]
...
$INTERM(...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = globals()["...".format(..., $DATA, ...)]
...
$INTERM(...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = globals().get($DATA, ...)
...
$INTERM(...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = globals().get("..." % $DATA, ...)
...
$INTERM(...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = globals().get(f"...{$DATA}...", ...)
...
$INTERM(...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = globals().get("...".format(..., $DATA, ...), ...)
...
$INTERM(...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = globals()[$DATA]
...
$INTERM(...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = globals()["..." % $DATA]
...
$INTERM(...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = globals()[f"...{$DATA}..."]
...
$INTERM(...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = globals()["...".format(..., $DATA, ...)]
...
$INTERM(...)
- pattern: |
$DATA = request.$W
...
$INTERM = globals().get($DATA, ...)
...
$INTERM(...)
- pattern: |
$DATA = request.$W
...
$INTERM = globals().get("..." % $DATA, ...)
...
$INTERM(...)
- pattern: |
$DATA = request.$W
...
$INTERM = globals().get(f"...{$DATA}...", ...)
...
$INTERM(...)
- pattern: |
$DATA = request.$W
...
$INTERM = globals().get("...".format(..., $DATA, ...), ...)
...
$INTERM(...)
- pattern: |
$DATA = request.$W
...
$INTERM = globals()[$DATA]
...
$INTERM(...)
- pattern: |
$DATA = request.$W
...
$INTERM = globals()["..." % $DATA]
...
$INTERM(...)
- pattern: |
$DATA = request.$W
...
$INTERM = globals()[f"...{$DATA}..."]
...
$INTERM(...)
- pattern: |
$DATA = request.$W
...
$INTERM = globals()["...".format(..., $DATA, ...)]
...
$INTERM(...)
- id: python.django.security.injection.code.user-eval-format-string.user-eval-format-string
message: Found user data in a call to 'eval'. This is extremely dangerous because
it can enable an attacker to execute remote code. See https://owasp.org/www-community/attacks/Code_Injection
for more information.
metadata:
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html
category: security
technology:
- django
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/python.django.security.injection.code.user-eval-format-string.user-eval-format-string
shortlink: https://sg.run/4x2z
semgrep.dev:
rule:
r_id: 9500
rv_id: 1263383
rule_id: BYUNw9
version_id: vdT06xG
url: https://semgrep.dev/playground/r/vdT06xG/python.django.security.injection.code.user-eval-format-string.user-eval-format-string
origin: community
patterns:
- pattern-inside: |
def $F(...):
...
- pattern-either:
- pattern: eval(..., $STR % request.$W.get(...), ...)
- pattern: |
$V = request.$W.get(...)
...
eval(..., $STR % $V, ...)
- pattern: |
$V = request.$W.get(...)
...
$S = $STR % $V
...
eval(..., $S, ...)
- pattern: eval(..., "..." % request.$W(...), ...)
- pattern: |
$V = request.$W(...)
...
eval(..., $STR % $V, ...)
- pattern: |
$V = request.$W(...)
...
$S = $STR % $V
...
eval(..., $S, ...)
- pattern: eval(..., $STR % request.$W[...], ...)
- pattern: |
$V = request.$W[...]
...
eval(..., $STR % $V, ...)
- pattern: |
$V = request.$W[...]
...
$S = $STR % $V
...
eval(..., $S, ...)
- pattern: eval(..., $STR.format(..., request.$W.get(...), ...), ...)
- pattern: |
$V = request.$W.get(...)
...
eval(..., $STR.format(..., $V, ...), ...)
- pattern: |
$V = request.$W.get(...)
...
$S = $STR.format(..., $V, ...)
...
eval(..., $S, ...)
- pattern: eval(..., $STR.format(..., request.$W(...), ...), ...)
- pattern: |
$V = request.$W(...)
...
eval(..., $STR.format(..., $V, ...), ...)
- pattern: |
$V = request.$W(...)
...
$S = $STR.format(..., $V, ...)
...
eval(..., $S, ...)
- pattern: eval(..., $STR.format(..., request.$W[...], ...), ...)
- pattern: |
$V = request.$W[...]
...
eval(..., $STR.format(..., $V, ...), ...)
- pattern: |
$V = request.$W[...]
...
$S = $STR.format(..., $V, ...)
...
eval(..., $S, ...)
- pattern: |
$V = request.$W.get(...)
...
eval(..., f"...{$V}...", ...)
- pattern: |
$V = request.$W.get(...)
...
$S = f"...{$V}..."
...
eval(..., $S, ...)
- pattern: |
$V = request.$W(...)
...
eval(..., f"...{$V}...", ...)
- pattern: |
$V = request.$W(...)
...
$S = f"...{$V}..."
...
eval(..., $S, ...)
- pattern: |
$V = request.$W[...]
...
eval(..., f"...{$V}...", ...)
- pattern: |
$V = request.$W[...]
...
$S = f"...{$V}..."
...
eval(..., $S, ...)
languages:
- python
severity: WARNING
- id: python.django.security.injection.code.user-eval.user-eval
message: Found user data in a call to 'eval'. This is extremely dangerous because
it can enable an attacker to execute arbitrary remote code on the system. Instead,
refactor your code to not use 'eval' and instead use a safe library for the specific
functionality you need.
metadata:
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html
- https://owasp.org/www-community/attacks/Code_Injection
category: security
technology:
- django
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/python.django.security.injection.code.user-eval.user-eval
shortlink: https://sg.run/PJDW
semgrep.dev:
rule:
r_id: 9501
rv_id: 1263384
rule_id: DbUpDQ
version_id: d6Tyx2A
url: https://semgrep.dev/playground/r/d6Tyx2A/python.django.security.injection.code.user-eval.user-eval
origin: community
patterns:
- pattern-inside: |
def $F(...):
...
- pattern-either:
- pattern: eval(..., request.$W.get(...), ...)
- pattern: |
$V = request.$W.get(...)
...
eval(..., $V, ...)
- pattern: eval(..., request.$W(...), ...)
- pattern: |
$V = request.$W(...)
...
eval(..., $V, ...)
- pattern: eval(..., request.$W[...], ...)
- pattern: |
$V = request.$W[...]
...
eval(..., $V, ...)
languages:
- python
severity: WARNING
- id: python.django.security.injection.code.user-exec-format-string.user-exec-format-string
message: Found user data in a call to 'exec'. This is extremely dangerous because
it can enable an attacker to execute arbitrary remote code on the system. Instead,
refactor your code to not use 'eval' and instead use a safe library for the specific
functionality you need.
metadata:
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- django
references:
- https://owasp.org/www-community/attacks/Code_Injection
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/python.django.security.injection.code.user-exec-format-string.user-exec-format-string
shortlink: https://sg.run/J9JW
semgrep.dev:
rule:
r_id: 9502
rv_id: 1263385
rule_id: WAUovx
version_id: ZRTKA1p
url: https://semgrep.dev/playground/r/ZRTKA1p/python.django.security.injection.code.user-exec-format-string.user-exec-format-string
origin: community
patterns:
- pattern-inside: |
def $F(...):
...
- pattern-either:
- pattern: exec(..., $STR % request.$W.get(...), ...)
- pattern: |
$V = request.$W.get(...)
...
exec(..., $STR % $V, ...)
- pattern: |
$V = request.$W.get(...)
...
$S = $STR % $V
...
exec(..., $S, ...)
- pattern: exec(..., "..." % request.$W(...), ...)
- pattern: |
$V = request.$W(...)
...
exec(..., $STR % $V, ...)
- pattern: |
$V = request.$W(...)
...
$S = $STR % $V
...
exec(..., $S, ...)
- pattern: exec(..., $STR % request.$W[...], ...)
- pattern: |
$V = request.$W[...]
...
exec(..., $STR % $V, ...)
- pattern: |
$V = request.$W[...]
...
$S = $STR % $V
...
exec(..., $S, ...)
- pattern: exec(..., $STR.format(..., request.$W.get(...), ...), ...)
- pattern: |
$V = request.$W.get(...)
...
exec(..., $STR.format(..., $V, ...), ...)
- pattern: |
$V = request.$W.get(...)
...
$S = $STR.format(..., $V, ...)
...
exec(..., $S, ...)
- pattern: exec(..., $STR.format(..., request.$W(...), ...), ...)
- pattern: |
$V = request.$W(...)
...
exec(..., $STR.format(..., $V, ...), ...)
- pattern: |
$V = request.$W(...)
...
$S = $STR.format(..., $V, ...)
...
exec(..., $S, ...)
- pattern: exec(..., $STR.format(..., request.$W[...], ...), ...)
- pattern: |
$V = request.$W[...]
...
exec(..., $STR.format(..., $V, ...), ...)
- pattern: |
$V = request.$W[...]
...
$S = $STR.format(..., $V, ...)
...
exec(..., $S, ...)
- pattern: |
$V = request.$W.get(...)
...
exec(..., f"...{$V}...", ...)
- pattern: |
$V = request.$W.get(...)
...
$S = f"...{$V}..."
...
exec(..., $S, ...)
- pattern: |
$V = request.$W(...)
...
exec(..., f"...{$V}...", ...)
- pattern: |
$V = request.$W(...)
...
$S = f"...{$V}..."
...
exec(..., $S, ...)
- pattern: |
$V = request.$W[...]
...
exec(..., f"...{$V}...", ...)
- pattern: |
$V = request.$W[...]
...
$S = f"...{$V}..."
...
exec(..., $S, ...)
- pattern: exec(..., base64.decodestring($S.format(..., request.$W.get(...), ...),
...), ...)
- pattern: exec(..., base64.decodestring($S % request.$W.get(...), ...), ...)
- pattern: exec(..., base64.decodestring(f"...{request.$W.get(...)}...", ...),
...)
- pattern: exec(..., base64.decodestring(request.$W.get(...), ...), ...)
- pattern: exec(..., base64.decodestring(bytes($S.format(..., request.$W.get(...),
...), ...), ...), ...)
- pattern: exec(..., base64.decodestring(bytes($S % request.$W.get(...), ...),
...), ...)
- pattern: exec(..., base64.decodestring(bytes(f"...{request.$W.get(...)}...",
...), ...), ...)
- pattern: exec(..., base64.decodestring(bytes(request.$W.get(...), ...), ...),
...)
- pattern: |
$DATA = request.$W.get(...)
...
exec(..., base64.decodestring($DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = base64.decodestring($DATA, ...)
...
exec(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
exec(..., base64.decodestring(bytes($DATA, ...), ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = base64.decodestring(bytes($DATA, ...), ...)
...
exec(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
exec(..., base64.decodestring($DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = base64.decodestring($DATA, ...)
...
exec(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
exec(..., base64.decodestring(bytes($DATA, ...), ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = base64.decodestring(bytes($DATA, ...), ...)
...
exec(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
exec(..., base64.decodestring($DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = base64.decodestring($DATA, ...)
...
exec(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
exec(..., base64.decodestring(bytes($DATA, ...), ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = base64.decodestring(bytes($DATA, ...), ...)
...
exec(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
exec(..., base64.decodestring($DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = base64.decodestring($DATA, ...)
...
exec(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
exec(..., base64.decodestring(bytes($DATA, ...), ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = base64.decodestring(bytes($DATA, ...), ...)
...
exec(..., $INTERM, ...)
languages:
- python
severity: WARNING
- id: python.django.security.injection.code.user-exec.user-exec
message: Found user data in a call to 'exec'. This is extremely dangerous because
it can enable an attacker to execute arbitrary remote code on the system. Instead,
refactor your code to not use 'eval' and instead use a safe library for the specific
functionality you need.
metadata:
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- django
references:
- https://owasp.org/www-community/attacks/Code_Injection
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/python.django.security.injection.code.user-exec.user-exec
shortlink: https://sg.run/5Q3X
semgrep.dev:
rule:
r_id: 9503
rv_id: 1263386
rule_id: 0oU5AW
version_id: nWT2LA2
url: https://semgrep.dev/playground/r/nWT2LA2/python.django.security.injection.code.user-exec.user-exec
origin: community
patterns:
- pattern-inside: |
def $F(...):
...
- pattern-either:
- pattern: exec(..., request.$W.get(...), ...)
- pattern: |
$V = request.$W.get(...)
...
exec(..., $V, ...)
- pattern: exec(..., request.$W(...), ...)
- pattern: |
$V = request.$W(...)
...
exec(..., $V, ...)
- pattern: exec(..., request.$W[...], ...)
- pattern: |
$V = request.$W[...]
...
exec(..., $V, ...)
- pattern: |
loop = asyncio.get_running_loop()
...
await loop.run_in_executor(None, exec, request.$W[...])
- pattern: |
$V = request.$W[...]
...
loop = asyncio.get_running_loop()
...
await loop.run_in_executor(None, exec, $V)
- pattern: |
loop = asyncio.get_running_loop()
...
await loop.run_in_executor(None, exec, request.$W.get(...))
- pattern: |
$V = request.$W.get(...)
...
loop = asyncio.get_running_loop()
...
await loop.run_in_executor(None, exec, $V)
languages:
- python
severity: WARNING
- id: python.django.security.injection.command.command-injection-os-system.command-injection-os-system
message: Request data detected in os.system. This could be vulnerable to a command
injection and should be avoided. If this must be done, use the 'subprocess' module
instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection
for more information.
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/www-community/attacks/Command_Injection
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system
shortlink: https://sg.run/Gen2
semgrep.dev:
rule:
r_id: 9504
rv_id: 1263387
rule_id: KxUbp2
version_id: ExTExPo
url: https://semgrep.dev/playground/r/ExTExPo/python.django.security.injection.command.command-injection-os-system.command-injection-os-system
origin: community
languages:
- python
severity: ERROR
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: os.system(..., request.$W.get(...), ...)
- pattern: os.system(..., $S.format(..., request.$W.get(...), ...), ...)
- pattern: os.system(..., $S % request.$W.get(...), ...)
- pattern: os.system(..., f"...{request.$W.get(...)}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
os.system(..., $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
os.system(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
os.system(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
os.system(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
os.system(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
os.system(..., $INTERM, ...)
- pattern: $A = os.system(..., request.$W.get(...), ...)
- pattern: $A = os.system(..., $S.format(..., request.$W.get(...), ...), ...)
- pattern: $A = os.system(..., $S % request.$W.get(...), ...)
- pattern: $A = os.system(..., f"...{request.$W.get(...)}...", ...)
- pattern: return os.system(..., request.$W.get(...), ...)
- pattern: return os.system(..., $S.format(..., request.$W.get(...), ...), ...)
- pattern: return os.system(..., $S % request.$W.get(...), ...)
- pattern: return os.system(..., f"...{request.$W.get(...)}...", ...)
- pattern: os.system(..., request.$W(...), ...)
- pattern: os.system(..., $S.format(..., request.$W(...), ...), ...)
- pattern: os.system(..., $S % request.$W(...), ...)
- pattern: os.system(..., f"...{request.$W(...)}...", ...)
- pattern: |
$DATA = request.$W(...)
...
os.system(..., $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
os.system(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
os.system(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
os.system(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
os.system(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
os.system(..., $INTERM, ...)
- pattern: $A = os.system(..., request.$W(...), ...)
- pattern: $A = os.system(..., $S.format(..., request.$W(...), ...), ...)
- pattern: $A = os.system(..., $S % request.$W(...), ...)
- pattern: $A = os.system(..., f"...{request.$W(...)}...", ...)
- pattern: return os.system(..., request.$W(...), ...)
- pattern: return os.system(..., $S.format(..., request.$W(...), ...), ...)
- pattern: return os.system(..., $S % request.$W(...), ...)
- pattern: return os.system(..., f"...{request.$W(...)}...", ...)
- pattern: os.system(..., request.$W[...], ...)
- pattern: os.system(..., $S.format(..., request.$W[...], ...), ...)
- pattern: os.system(..., $S % request.$W[...], ...)
- pattern: os.system(..., f"...{request.$W[...]}...", ...)
- pattern: |
$DATA = request.$W[...]
...
os.system(..., $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
os.system(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
os.system(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
os.system(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
os.system(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
os.system(..., $INTERM, ...)
- pattern: $A = os.system(..., request.$W[...], ...)
- pattern: $A = os.system(..., $S.format(..., request.$W[...], ...), ...)
- pattern: $A = os.system(..., $S % request.$W[...], ...)
- pattern: $A = os.system(..., f"...{request.$W[...]}...", ...)
- pattern: return os.system(..., request.$W[...], ...)
- pattern: return os.system(..., $S.format(..., request.$W[...], ...), ...)
- pattern: return os.system(..., $S % request.$W[...], ...)
- pattern: return os.system(..., f"...{request.$W[...]}...", ...)
- pattern: os.system(..., request.$W, ...)
- pattern: os.system(..., $S.format(..., request.$W, ...), ...)
- pattern: os.system(..., $S % request.$W, ...)
- pattern: os.system(..., f"...{request.$W}...", ...)
- pattern: |
$DATA = request.$W
...
os.system(..., $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
os.system(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
os.system(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
os.system(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
os.system(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
os.system(..., $INTERM, ...)
- pattern: $A = os.system(..., request.$W, ...)
- pattern: $A = os.system(..., $S.format(..., request.$W, ...), ...)
- pattern: $A = os.system(..., $S % request.$W, ...)
- pattern: $A = os.system(..., f"...{request.$W}...", ...)
- pattern: return os.system(..., request.$W, ...)
- pattern: return os.system(..., $S.format(..., request.$W, ...), ...)
- pattern: return os.system(..., $S % request.$W, ...)
- pattern: return os.system(..., f"...{request.$W}...", ...)
- id: python.django.security.injection.email.xss-html-email-body.xss-html-email-body
message: Found request data in an EmailMessage that is set to use HTML. This is
dangerous because HTML emails are susceptible to XSS. An attacker could inject
data into this HTML email, causing XSS.
metadata:
cwe:
- 'CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream
Component (''Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://www.damonkohler.com/2008/12/email-injection.html
category: security
technology:
- django
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/python.django.security.injection.email.xss-html-email-body.xss-html-email-body
shortlink: https://sg.run/RoBe
semgrep.dev:
rule:
r_id: 9505
rv_id: 1263390
rule_id: qNUj02
version_id: 8KT5rOn
url: https://semgrep.dev/playground/r/8KT5rOn/python.django.security.injection.email.xss-html-email-body.xss-html-email-body
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-inside: |
def $FUNC(...):
...
$EMAIL.content_subtype = "html"
...
- pattern-either:
- pattern: django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.core.mail.EmailMessage($SUBJ, $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $B.$C(..., $DATA, ...)
...
django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
- pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...)
- pattern: return django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...)
- pattern: django.core.mail.EmailMessage($SUBJ, request.$W(...), ...)
- pattern: |
$DATA = request.$W(...)
...
django.core.mail.EmailMessage($SUBJ, $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $B.$C(..., $DATA, ...)
...
django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
- pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W(...), ...)
- pattern: return django.core.mail.EmailMessage($SUBJ, request.$W(...), ...)
- pattern: django.core.mail.EmailMessage($SUBJ, request.$W[...], ...)
- pattern: |
$DATA = request.$W[...]
...
django.core.mail.EmailMessage($SUBJ, $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $B.$C(..., $DATA, ...)
...
django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
- pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W[...], ...)
- pattern: return django.core.mail.EmailMessage($SUBJ, request.$W[...], ...)
- pattern: django.core.mail.EmailMessage($SUBJ, request.$W, ...)
- pattern: |
$DATA = request.$W
...
django.core.mail.EmailMessage($SUBJ, $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $B.$C(..., $DATA, ...)
...
django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.core.mail.EmailMessage($SUBJ, f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
django.core.mail.EmailMessage($SUBJ, $INTERM, ...)
- pattern: $A = django.core.mail.EmailMessage($SUBJ, request.$W, ...)
- pattern: return django.core.mail.EmailMessage($SUBJ, request.$W, ...)
- id: python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message
message: Found request data in 'send_mail(...)' that uses 'html_message'. This is
dangerous because HTML emails are susceptible to XSS. An attacker could inject
data into this HTML email, causing XSS.
metadata:
cwe:
- 'CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream
Component (''Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://www.damonkohler.com/2008/12/email-injection.html
category: security
technology:
- django
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message
shortlink: https://sg.run/Avx8
semgrep.dev:
rule:
r_id: 9506
rv_id: 1263391
rule_id: lBU9Ll
version_id: gETB7Gn
url: https://semgrep.dev/playground/r/gETB7Gn/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: django.core.mail.send_mail(..., html_message=request.$W.get(...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.core.mail.send_mail(..., html_message=$DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
django.core.mail.send_mail(..., html_message=$INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.core.mail.send_mail(..., html_message=$INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.core.mail.send_mail(..., html_message=$STR % $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
django.core.mail.send_mail(..., html_message=$INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
django.core.mail.send_mail(..., html_message=$INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.core.mail.send_mail(..., html_message=$STR + $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
django.core.mail.send_mail(..., html_message=$INTERM, ...)
- pattern: $A = django.core.mail.send_mail(..., html_message=request.$W.get(...),
...)
- pattern: return django.core.mail.send_mail(..., html_message=request.$W.get(...),
...)
- pattern: django.core.mail.send_mail(..., html_message=request.$W(...), ...)
- pattern: |
$DATA = request.$W(...)
...
django.core.mail.send_mail(..., html_message=$DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
django.core.mail.send_mail(..., html_message=$INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.core.mail.send_mail(..., html_message=$INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.core.mail.send_mail(..., html_message=$STR % $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
django.core.mail.send_mail(..., html_message=$INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
django.core.mail.send_mail(..., html_message=$INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.core.mail.send_mail(..., html_message=$STR + $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
django.core.mail.send_mail(..., html_message=$INTERM, ...)
- pattern: $A = django.core.mail.send_mail(..., html_message=request.$W(...),
...)
- pattern: return django.core.mail.send_mail(..., html_message=request.$W(...),
...)
- pattern: django.core.mail.send_mail(..., html_message=request.$W[...], ...)
- pattern: |
$DATA = request.$W[...]
...
django.core.mail.send_mail(..., html_message=$DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
django.core.mail.send_mail(..., html_message=$INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.core.mail.send_mail(..., html_message=$INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.core.mail.send_mail(..., html_message=$STR % $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
django.core.mail.send_mail(..., html_message=$INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
django.core.mail.send_mail(..., html_message=$INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.core.mail.send_mail(..., html_message=$STR + $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
django.core.mail.send_mail(..., html_message=$INTERM, ...)
- pattern: $A = django.core.mail.send_mail(..., html_message=request.$W[...],
...)
- pattern: return django.core.mail.send_mail(..., html_message=request.$W[...],
...)
- pattern: django.core.mail.send_mail(..., html_message=request.$W, ...)
- pattern: |
$DATA = request.$W
...
django.core.mail.send_mail(..., html_message=$DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
django.core.mail.send_mail(..., html_message=$INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.core.mail.send_mail(..., html_message=$INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.core.mail.send_mail(..., html_message=$STR % $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
django.core.mail.send_mail(..., html_message=$INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.core.mail.send_mail(..., html_message=f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
django.core.mail.send_mail(..., html_message=$INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.core.mail.send_mail(..., html_message=$STR + $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
django.core.mail.send_mail(..., html_message=$INTERM, ...)
- pattern: $A = django.core.mail.send_mail(..., html_message=request.$W, ...)
- pattern: return django.core.mail.send_mail(..., html_message=request.$W, ...)
- id: python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name
message: Data from request is passed to a file name `$FILE`. This is a path traversal
vulnerability, which can lead to sensitive data being leaked. To mitigate, consider
using os.path.abspath or os.path.realpath or the pathlib library.
metadata:
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://owasp.org/www-community/attacks/Path_Traversal
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name
shortlink: https://sg.run/BkO2
semgrep.dev:
rule:
r_id: 9507
rv_id: 1263394
rule_id: YGUR36
version_id: 44TEjWJ
url: https://semgrep.dev/playground/r/44TEjWJ/python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name
origin: community
patterns:
- pattern-inside: |
def $F(...):
...
- pattern-not-inside: |
def $F(...):
...
os.path.realpath(...)
...
- pattern-not-inside: |
def $F(...):
...
os.path.abspath(...)
...
- pattern-either:
- pattern: |
$V = request.$W.get($X)
...
$FILE % ($V)
- pattern: |
$V = request.$W[$X]
...
$FILE % ($V)
- pattern: |
$V = request.$W($X)
...
$FILE % ($V)
- pattern: |
$V = request.$W
...
$FILE % ($V)
# match format use cases
- pattern: |
$V = request.$W.get($X)
...
$FILE.format(..., $V, ...)
- pattern: |
$V = request.$W[$X]
...
$FILE.format(..., $V, ...)
- pattern: |
$V = request.$W($X)
...
$FILE.format(..., $V, ...)
- pattern: |
$V = request.$W
...
$FILE.format(..., $V, ...)
- metavariable-regex:
metavariable: $FILE
regex: .*\.(log|zip|txt|csv|xml|html).*
languages:
- python
severity: WARNING
- id: python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join
message: Data from request is passed to os.path.join() and to open(). This is a
path traversal vulnerability, which can lead to sensitive data being leaked. To
mitigate, consider using os.path.abspath or os.path.realpath or Path library.
metadata:
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://owasp.org/www-community/attacks/Path_Traversal
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join
shortlink: https://sg.run/Dovo
semgrep.dev:
rule:
r_id: 9508
rv_id: 1263395
rule_id: 6JUjLj
version_id: PkTR3q7
url: https://semgrep.dev/playground/r/PkTR3q7/python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join
origin: community
patterns:
- pattern-inside: |
def $F(...):
...
- pattern-not-inside: |
def $F(...):
...
os.path.abspath(...)
...
- pattern-not-inside: |
def $F(...):
...
os.path.realpath(...)
...
- pattern-either:
- pattern: open(os.path.join(..., request.$W.get(...), ...), ...)
- pattern: open(os.path.join(..., request.$W(...), ...), ...)
- pattern: open(os.path.join(..., request.$W, ...), ...)
- pattern: open(os.path.join(..., request.$W[...], ...), ...)
- pattern: |
$P = os.path.join(..., request.$W.get(...), ...)
...
open($P, ...)
- pattern: |
$P = os.path.join(..., request.$W(...), ...)
...
open($P, ...)
- pattern: |
$P = os.path.join(..., request.$W, ...)
...
open($P, ...)
- pattern: |
$P = os.path.join(..., request.$W[...], ...)
...
open($P, ...)
- pattern: |
$V = request.$W.get($X)
...
$P = os.path.join(..., $V, ...)
...
open($P, ...)
- pattern: |
$V = request.$W($X)
...
$P = os.path.join(..., $V, ...)
...
open($P, ...)
- pattern: |
$V = request.$W[$X]
...
$P = os.path.join(..., $V, ...)
...
open($P, ...)
- pattern: |
$V = request.$W
...
$P = os.path.join(..., $V, ...)
...
open($P, ...)
- pattern: |
$P = request.$W.get(...)
...
open(os.path.join(..., $P, ...), ...)
- pattern: |
$P = request.$W(...)
...
open(os.path.join(..., $P, ...), ...)
- pattern: |
$P = request.$W
...
open(os.path.join(..., $P, ...), ...)
- pattern: |
$P = request.$W[...]
...
open(os.path.join(..., $P, ...), ...)
languages:
- python
severity: WARNING
- id: python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open
message: Found request data in a call to 'open'. Ensure the request data is validated
or sanitized, otherwise it could result in path traversal attacks and therefore
sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath
or the pathlib library.
metadata:
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://owasp.org/www-community/attacks/Path_Traversal
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open
shortlink: https://sg.run/W8qg
semgrep.dev:
rule:
r_id: 9509
rv_id: 1263396
rule_id: oqUe7z
version_id: JdTzxAw
url: https://semgrep.dev/playground/r/JdTzxAw/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: open(..., request.$W.get(...), ...)
- pattern: open(..., $S.format(..., request.$W.get(...), ...), ...)
- pattern: open(..., $S % request.$W.get(...), ...)
- pattern: open(..., f"...{request.$W.get(...)}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
open(..., $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W.get(...)
...
open(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W.get(...)
...
open(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W.get(...)
...
open(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W.get(...)
...
open(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: $A = open(..., request.$W.get(...), ...)
- pattern: $A = open(..., $S.format(..., request.$W.get(...), ...), ...)
- pattern: $A = open(..., $S % request.$W.get(...), ...)
- pattern: $A = open(..., f"...{request.$W.get(...)}...", ...)
- pattern: return open(..., request.$W.get(...), ...)
- pattern: return open(..., $S.format(..., request.$W.get(...), ...), ...)
- pattern: return open(..., $S % request.$W.get(...), ...)
- pattern: return open(..., f"...{request.$W.get(...)}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
with open(..., $DATA, ...) as $FD:
...
- pattern: open(..., request.$W(...), ...)
- pattern: open(..., $S.format(..., request.$W(...), ...), ...)
- pattern: open(..., $S % request.$W(...), ...)
- pattern: open(..., f"...{request.$W(...)}...", ...)
- pattern: |
$DATA = request.$W(...)
...
open(..., $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W(...)
...
open(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W(...)
...
open(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W(...)
...
open(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W(...)
...
open(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: $A = open(..., request.$W(...), ...)
- pattern: $A = open(..., $S.format(..., request.$W(...), ...), ...)
- pattern: $A = open(..., $S % request.$W(...), ...)
- pattern: $A = open(..., f"...{request.$W(...)}...", ...)
- pattern: return open(..., request.$W(...), ...)
- pattern: return open(..., $S.format(..., request.$W(...), ...), ...)
- pattern: return open(..., $S % request.$W(...), ...)
- pattern: return open(..., f"...{request.$W(...)}...", ...)
- pattern: |
$DATA = request.$W(...)
...
with open(..., $DATA, ...) as $FD:
...
- pattern: open(..., request.$W[...], ...)
- pattern: open(..., $S.format(..., request.$W[...], ...), ...)
- pattern: open(..., $S % request.$W[...], ...)
- pattern: open(..., f"...{request.$W[...]}...", ...)
- pattern: |
$DATA = request.$W[...]
...
open(..., $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W[...]
...
open(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W[...]
...
open(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W[...]
...
open(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W[...]
...
open(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: $A = open(..., request.$W[...], ...)
- pattern: $A = open(..., $S.format(..., request.$W[...], ...), ...)
- pattern: $A = open(..., $S % request.$W[...], ...)
- pattern: $A = open(..., f"...{request.$W[...]}...", ...)
- pattern: return open(..., request.$W[...], ...)
- pattern: return open(..., $S.format(..., request.$W[...], ...), ...)
- pattern: return open(..., $S % request.$W[...], ...)
- pattern: return open(..., f"...{request.$W[...]}...", ...)
- pattern: |
$DATA = request.$W[...]
...
with open(..., $DATA, ...) as $FD:
...
- pattern: open(..., request.$W, ...)
- pattern: open(..., $S.format(..., request.$W, ...), ...)
- pattern: open(..., $S % request.$W, ...)
- pattern: open(..., f"...{request.$W}...", ...)
- pattern: |
$DATA = request.$W
...
open(..., $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W
...
open(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W
...
open(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W
...
open(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W
...
open(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: $A = open(..., request.$W, ...)
- pattern: $A = open(..., $S.format(..., request.$W, ...), ...)
- pattern: $A = open(..., $S % request.$W, ...)
- pattern: $A = open(..., f"...{request.$W}...", ...)
- pattern: return open(..., request.$W, ...)
- pattern: return open(..., $S.format(..., request.$W, ...), ...)
- pattern: return open(..., $S % request.$W, ...)
- pattern: return open(..., f"...{request.$W}...", ...)
- pattern: |
$DATA = request.$W
...
with open(..., $DATA, ...) as $FD:
...
- id: python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where
message: User-controlled data from a request is passed to 'extra()'. This could
lead to a SQL injection and therefore protected information could be leaked. Instead,
use parameterized queries or escape the user-controlled data by using `params`
and not using quote placeholders in the SQL string.
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.0/ref/models/expressions/#.objects.extra
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where
shortlink: https://sg.run/0Ql5
semgrep.dev:
rule:
r_id: 9510
rv_id: 1263402
rule_id: zdUkx1
version_id: DkTRb4l
url: https://semgrep.dev/playground/r/DkTRb4l/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W.get(...),
...), ...], ...)
- pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W.get(...), ...],
...)
- pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W.get(...)}...",
...], ...)
- pattern: $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...],
...)
- pattern: return $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...],
...)
- pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W(...),
...), ...], ...)
- pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W(...), ...], ...)
- pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W(...)}...", ...],
...)
- pattern: $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...)
- pattern: return $MODEL.objects.extra(..., where=[..., request.$W(...), ...],
...)
- pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W[...],
...), ...], ...)
- pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W[...], ...], ...)
- pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W[...]}...", ...],
...)
- pattern: $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...)
- pattern: return $MODEL.objects.extra(..., where=[..., request.$W[...], ...],
...)
- pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W, ...),
...], ...)
- pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W, ...], ...)
- pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W}...", ...],
...)
- pattern: $MODEL.objects.extra(..., where=[..., request.$W, ...], ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W, ...], ...)
- pattern: return $MODEL.objects.extra(..., where=[..., request.$W, ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % (..., $DATA, ...)
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % (..., $DATA, ...)
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % (..., $DATA, ...)
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % (..., $DATA, ...)
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- id: python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql
message: User-controlled data from request is passed to 'RawSQL()'. This could lead
to a SQL injection and therefore protected information could be leaked. Instead,
use parameterized queries or escape the user-controlled data by using `params`
and not using quote placeholders in the SQL string.
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.expressions.RawSQL
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql
shortlink: https://sg.run/Kl4X
semgrep.dev:
rule:
r_id: 9511
rv_id: 1263403
rule_id: pKUOBp
version_id: WrTqK2L
url: https://semgrep.dev/playground/r/WrTqK2L/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W.get(...),
...), ...)
- pattern: django.db.models.expressions.RawSQL(..., $S % request.$W.get(...),
...)
- pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W.get(...)}...",
...)
- pattern: django.db.models.expressions.RawSQL(..., request.$W.get(...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.db.models.expressions.RawSQL(..., $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.db.models.expressions.RawSQL(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.db.models.expressions.RawSQL(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: $A = django.db.models.expressions.RawSQL(..., request.$W.get(...),
...)
- pattern: return django.db.models.expressions.RawSQL(..., request.$W.get(...),
...)
- pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W(...),
...), ...)
- pattern: django.db.models.expressions.RawSQL(..., $S % request.$W(...), ...)
- pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W(...)}...",
...)
- pattern: django.db.models.expressions.RawSQL(..., request.$W(...), ...)
- pattern: |
$DATA = request.$W(...)
...
django.db.models.expressions.RawSQL(..., $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.db.models.expressions.RawSQL(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.db.models.expressions.RawSQL(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: $A = django.db.models.expressions.RawSQL(..., request.$W(...), ...)
- pattern: return django.db.models.expressions.RawSQL(..., request.$W(...), ...)
- pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W[...],
...), ...)
- pattern: django.db.models.expressions.RawSQL(..., $S % request.$W[...], ...)
- pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W[...]}...",
...)
- pattern: django.db.models.expressions.RawSQL(..., request.$W[...], ...)
- pattern: |
$DATA = request.$W[...]
...
django.db.models.expressions.RawSQL(..., $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.db.models.expressions.RawSQL(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.db.models.expressions.RawSQL(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: $A = django.db.models.expressions.RawSQL(..., request.$W[...], ...)
- pattern: return django.db.models.expressions.RawSQL(..., request.$W[...], ...)
- pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W,
...), ...)
- pattern: django.db.models.expressions.RawSQL(..., $S % request.$W, ...)
- pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W}...", ...)
- pattern: django.db.models.expressions.RawSQL(..., request.$W, ...)
- pattern: |
$DATA = request.$W
...
django.db.models.expressions.RawSQL(..., $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.db.models.expressions.RawSQL(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.db.models.expressions.RawSQL(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: $A = django.db.models.expressions.RawSQL(..., request.$W, ...)
- pattern: return django.db.models.expressions.RawSQL(..., request.$W, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % (..., $DATA, ...)
...
django.db.models.expressions.RawSQL($INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % (..., $DATA, ...)
...
django.db.models.expressions.RawSQL($INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % (..., $DATA, ...)
...
django.db.models.expressions.RawSQL($INTERM, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % (..., $DATA, ...)
...
django.db.models.expressions.RawSQL($INTERM, ...)
- id: python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute
message: User-controlled data from a request is passed to 'execute()'. This could
lead to a SQL injection and therefore protected information could be leaked. Instead,
use django's QuerySets, which are built with query parameterization and therefore
not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute
shortlink: https://sg.run/qx7y
semgrep.dev:
rule:
r_id: 9512
rv_id: 1263404
rule_id: 2ZUbDL
version_id: 0bTKzRj
url: https://semgrep.dev/playground/r/0bTKzRj/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: $CURSOR.execute(..., $S.format(..., request.$W.get(...), ...), ...)
- pattern: $CURSOR.execute(..., $S % request.$W.get(...), ...)
- pattern: $CURSOR.execute(..., f"...{request.$W.get(...)}...", ...)
- pattern: $CURSOR.execute(..., request.$W.get(...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$CURSOR.execute(..., $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$CURSOR.execute(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$CURSOR.execute(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$CURSOR.execute(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: $A = $CURSOR.execute(..., request.$W.get(...), ...)
- pattern: return $CURSOR.execute(..., request.$W.get(...), ...)
- pattern: $CURSOR.execute(..., $S.format(..., request.$W(...), ...), ...)
- pattern: $CURSOR.execute(..., $S % request.$W(...), ...)
- pattern: $CURSOR.execute(..., f"...{request.$W(...)}...", ...)
- pattern: $CURSOR.execute(..., request.$W(...), ...)
- pattern: |
$DATA = request.$W(...)
...
$CURSOR.execute(..., $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$CURSOR.execute(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$CURSOR.execute(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$CURSOR.execute(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: $A = $CURSOR.execute(..., request.$W(...), ...)
- pattern: return $CURSOR.execute(..., request.$W(...), ...)
- pattern: $CURSOR.execute(..., $S.format(..., request.$W[...], ...), ...)
- pattern: $CURSOR.execute(..., $S % request.$W[...], ...)
- pattern: $CURSOR.execute(..., f"...{request.$W[...]}...", ...)
- pattern: $CURSOR.execute(..., request.$W[...], ...)
- pattern: |
$DATA = request.$W[...]
...
$CURSOR.execute(..., $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$CURSOR.execute(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$CURSOR.execute(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$CURSOR.execute(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: $A = $CURSOR.execute(..., request.$W[...], ...)
- pattern: return $CURSOR.execute(..., request.$W[...], ...)
- pattern: $CURSOR.execute(..., $S.format(..., request.$W, ...), ...)
- pattern: $CURSOR.execute(..., $S % request.$W, ...)
- pattern: $CURSOR.execute(..., f"...{request.$W}...", ...)
- pattern: $CURSOR.execute(..., request.$W, ...)
- pattern: |
$DATA = request.$W
...
$CURSOR.execute(..., $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$CURSOR.execute(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$CURSOR.execute(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$CURSOR.execute(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: $A = $CURSOR.execute(..., request.$W, ...)
- pattern: return $CURSOR.execute(..., request.$W, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$CURSOR.execute($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$CURSOR.execute($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$CURSOR.execute($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$CURSOR.execute($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % (..., $DATA, ...)
...
$CURSOR.execute($INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % (..., $DATA, ...)
...
$CURSOR.execute($INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % (..., $DATA, ...)
...
$CURSOR.execute($INTERM, ...)
- pattern: |-
$DATA = request.$W
...
$INTERM = $STR % (..., $DATA, ...)
...
$CURSOR.execute($INTERM, ...)
- id: python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw
message: Data that is possible user-controlled from a python request is passed to
`raw()`. This could lead to SQL injection and attackers gaining access to protected
information. Instead, use django's QuerySets, which are built with query parameterization
and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw
shortlink: https://sg.run/l2v9
semgrep.dev:
rule:
r_id: 9513
rv_id: 1263405
rule_id: X5U8v5
version_id: K3TKkBW
url: https://semgrep.dev/playground/r/K3TKkBW/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: $MODEL.objects.raw(..., $S.format(..., request.$W.get(...), ...), ...)
- pattern: $MODEL.objects.raw(..., $S % request.$W.get(...), ...)
- pattern: $MODEL.objects.raw(..., f"...{request.$W.get(...)}...", ...)
- pattern: $MODEL.objects.raw(..., request.$W.get(...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.raw(..., $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.raw(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.raw(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.raw(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: $A = $MODEL.objects.raw(..., request.$W.get(...), ...)
- pattern: return $MODEL.objects.raw(..., request.$W.get(...), ...)
- pattern: $MODEL.objects.raw(..., $S.format(..., request.$W(...), ...), ...)
- pattern: $MODEL.objects.raw(..., $S % request.$W(...), ...)
- pattern: $MODEL.objects.raw(..., f"...{request.$W(...)}...", ...)
- pattern: $MODEL.objects.raw(..., request.$W(...), ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.raw(..., $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.raw(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.raw(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.raw(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: $A = $MODEL.objects.raw(..., request.$W(...), ...)
- pattern: return $MODEL.objects.raw(..., request.$W(...), ...)
- pattern: $MODEL.objects.raw(..., $S.format(..., request.$W[...], ...), ...)
- pattern: $MODEL.objects.raw(..., $S % request.$W[...], ...)
- pattern: $MODEL.objects.raw(..., f"...{request.$W[...]}...", ...)
- pattern: $MODEL.objects.raw(..., request.$W[...], ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.raw(..., $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.raw(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.raw(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.raw(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: $A = $MODEL.objects.raw(..., request.$W[...], ...)
- pattern: return $MODEL.objects.raw(..., request.$W[...], ...)
- pattern: $MODEL.objects.raw(..., $S.format(..., request.$W, ...), ...)
- pattern: $MODEL.objects.raw(..., $S % request.$W, ...)
- pattern: $MODEL.objects.raw(..., f"...{request.$W}...", ...)
- pattern: $MODEL.objects.raw(..., request.$W, ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.raw(..., $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.raw(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.raw(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.raw(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: $A = $MODEL.objects.raw(..., request.$W, ...)
- pattern: return $MODEL.objects.raw(..., request.$W, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.raw($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.raw($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.raw($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.raw($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % (..., $DATA, ...)
...
$MODEL.objects.raw($INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % (..., $DATA, ...)
...
$MODEL.objects.raw($INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % (..., $DATA, ...)
...
$MODEL.objects.raw($INTERM, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % (..., $DATA, ...)
...
$MODEL.objects.raw($INTERM, ...)
- id: python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests
message: Data from request object is passed to a new server-side request. This could
lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes
and hosts are validated against an allowlist, do not forward the response to the
user, and ensure proper authentication and transport-layer security in the proxied
request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
to learn more about SSRF vulnerabilities.
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests
shortlink: https://sg.run/YvY4
semgrep.dev:
rule:
r_id: 9514
rv_id: 1263406
rule_id: j2UvEw
version_id: qkTR7zn
url: https://semgrep.dev/playground/r/qkTR7zn/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests
origin: community
languages:
- python
severity: ERROR
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: requests.$METHOD(..., $S.format(..., request.$W.get(...), ...), ...)
- pattern: requests.$METHOD(..., $S % request.$W.get(...), ...)
- pattern: requests.$METHOD(..., f"...{request.$W.get(...)}...", ...)
- pattern: requests.$METHOD(..., request.$W.get(...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
requests.$METHOD(..., $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
requests.$METHOD(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
requests.$METHOD(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
requests.$METHOD(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
requests.$METHOD(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: $A = requests.$METHOD(..., request.$W.get(...), ...)
- pattern: return requests.$METHOD(..., request.$W.get(...), ...)
- pattern: requests.$METHOD(..., $S.format(..., request.$W(...), ...), ...)
- pattern: requests.$METHOD(..., $S % request.$W(...), ...)
- pattern: requests.$METHOD(..., f"...{request.$W(...)}...", ...)
- pattern: requests.$METHOD(..., request.$W(...), ...)
- pattern: |
$DATA = request.$W(...)
...
requests.$METHOD(..., $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
requests.$METHOD(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
requests.$METHOD(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
requests.$METHOD(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
requests.$METHOD(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: $A = requests.$METHOD(..., request.$W(...), ...)
- pattern: return requests.$METHOD(..., request.$W(...), ...)
- pattern: requests.$METHOD(..., $S.format(..., request.$W[...], ...), ...)
- pattern: requests.$METHOD(..., $S % request.$W[...], ...)
- pattern: requests.$METHOD(..., f"...{request.$W[...]}...", ...)
- pattern: requests.$METHOD(..., request.$W[...], ...)
- pattern: |
$DATA = request.$W[...]
...
requests.$METHOD(..., $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
requests.$METHOD(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
requests.$METHOD(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
requests.$METHOD(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
requests.$METHOD(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: $A = requests.$METHOD(..., request.$W[...], ...)
- pattern: return requests.$METHOD(..., request.$W[...], ...)
- pattern: requests.$METHOD(..., $S.format(..., request.$W, ...), ...)
- pattern: requests.$METHOD(..., $S % request.$W, ...)
- pattern: requests.$METHOD(..., f"...{request.$W}...", ...)
- pattern: requests.$METHOD(..., request.$W, ...)
- pattern: |
$DATA = request.$W
...
requests.$METHOD(..., $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
requests.$METHOD(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
requests.$METHOD(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
requests.$METHOD(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
requests.$METHOD(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: $A = requests.$METHOD(..., request.$W, ...)
- pattern: return requests.$METHOD(..., request.$W, ...)
- id: python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib
message: Data from request object is passed to a new server-side request. This could
lead to a server-side request forgery (SSRF), which could result in attackers
gaining access to private organization data. To mitigate, ensure that schemes
and hosts are validated against an allowlist, do not forward the response to the
user, and ensure proper authentication and transport-layer security in the proxied
request.
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib
shortlink: https://sg.run/6n2B
semgrep.dev:
rule:
r_id: 9515
rv_id: 1263407
rule_id: 10UKDo
version_id: l4TJRwD
url: https://semgrep.dev/playground/r/l4TJRwD/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib
origin: community
languages:
- python
severity: ERROR
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: urllib.request.urlopen(..., $S.format(..., request.$W.get(...), ...),
...)
- pattern: urllib.request.urlopen(..., $S % request.$W.get(...), ...)
- pattern: urllib.request.urlopen(..., f"...{request.$W.get(...)}...", ...)
- pattern: urllib.request.urlopen(..., request.$W.get(...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
urllib.request.urlopen(..., $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
urllib.request.urlopen(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
urllib.request.urlopen(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
urllib.request.urlopen(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: $A = urllib.request.urlopen(..., request.$W.get(...), ...)
- pattern: return urllib.request.urlopen(..., request.$W.get(...), ...)
- pattern: urllib.request.urlopen(..., $S.format(..., request.$W(...), ...), ...)
- pattern: urllib.request.urlopen(..., $S % request.$W(...), ...)
- pattern: urllib.request.urlopen(..., f"...{request.$W(...)}...", ...)
- pattern: urllib.request.urlopen(..., request.$W(...), ...)
- pattern: |
$DATA = request.$W(...)
...
urllib.request.urlopen(..., $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
urllib.request.urlopen(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
urllib.request.urlopen(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
urllib.request.urlopen(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: $A = urllib.request.urlopen(..., request.$W(...), ...)
- pattern: return urllib.request.urlopen(..., request.$W(...), ...)
- pattern: urllib.request.urlopen(..., $S.format(..., request.$W[...], ...), ...)
- pattern: urllib.request.urlopen(..., $S % request.$W[...], ...)
- pattern: urllib.request.urlopen(..., f"...{request.$W[...]}...", ...)
- pattern: urllib.request.urlopen(..., request.$W[...], ...)
- pattern: |
$DATA = request.$W[...]
...
urllib.request.urlopen(..., $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
urllib.request.urlopen(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
urllib.request.urlopen(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
urllib.request.urlopen(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: $A = urllib.request.urlopen(..., request.$W[...], ...)
- pattern: return urllib.request.urlopen(..., request.$W[...], ...)
- pattern: urllib.request.urlopen(..., $S.format(..., request.$W, ...), ...)
- pattern: urllib.request.urlopen(..., $S % request.$W, ...)
- pattern: urllib.request.urlopen(..., f"...{request.$W}...", ...)
- pattern: urllib.request.urlopen(..., request.$W, ...)
- pattern: |
$DATA = request.$W
...
urllib.request.urlopen(..., $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
urllib.request.urlopen(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
urllib.request.urlopen(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
urllib.request.urlopen(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: $A = urllib.request.urlopen(..., request.$W, ...)
- pattern: return urllib.request.urlopen(..., request.$W, ...)
- id: python.django.security.passwords.password-empty-string.password-empty-string
message: '''$VAR'' is the empty string and is being used to set the password on
''$MODEL''. If you meant to set an unusable password, set the password to None
or call ''set_unusable_password()''.'
metadata:
cwe:
- 'CWE-521: Weak Password Requirements'
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password
category: security
technology:
- django
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/python.django.security.passwords.password-empty-string.password-empty-string
shortlink: https://sg.run/oxnR
semgrep.dev:
rule:
r_id: 9516
rv_id: 1263411
rule_id: 9AU1jW
version_id: GxTke5Q
url: https://semgrep.dev/playground/r/GxTke5Q/python.django.security.passwords.password-empty-string.password-empty-string
origin: community
patterns:
- pattern-either:
- pattern: |
$MODEL.set_password($EMPTY)
...
$MODEL.save()
- pattern: |
$VAR = $EMPTY
...
$MODEL.set_password($VAR)
...
$MODEL.save()
- metavariable-regex:
metavariable: $EMPTY
regex: (\'\'|\"\")
languages:
- python
severity: ERROR
- id: python.django.security.passwords.use-none-for-password-default.use-none-for-password-default
message: '''$VAR'' is using the empty string as its default and is being used to
set the password on ''$MODEL''. If you meant to set an unusable password, set
the default value to ''None'' or call ''set_unusable_password()''.'
metadata:
cwe:
- 'CWE-521: Weak Password Requirements'
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password
category: security
technology:
- django
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default
shortlink: https://sg.run/zvBW
semgrep.dev:
rule:
r_id: 9517
rv_id: 1263412
rule_id: yyUn6Z
version_id: RGT0LYX
url: https://semgrep.dev/playground/r/RGT0LYX/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default
origin: community
languages:
- python
severity: ERROR
patterns:
- pattern-either:
- pattern: |
$VAR = request.$W.get($X, $EMPTY)
...
$MODEL.set_password($VAR)
...
$MODEL.save(...)
- pattern: |
def $F(..., $VAR=$EMPTY, ...):
...
$MODEL.set_password($VAR)
- metavariable-pattern:
metavariable: $EMPTY
pattern: '""'
- focus-metavariable: $EMPTY
fix: |
None
- id: python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run
patterns:
- pattern-either:
- pattern-inside: |
$CLIENT = docker.from_env()
...
- pattern-inside: |
$CLIENT = docker.DockerClient(...)
...
- pattern-either:
- pattern: |
$CLIENT.containers.run(...)
- pattern: |
$CLIENT.containers.create(...)
- pattern-not: |
$CLIENT.containers.run("...",...)
- pattern-not: |
$CLIENT.containers.create("...",...)
message: If unverified user data can reach the `run` or `create` method it can result
in running arbitrary container.
languages:
- python
severity: WARNING
metadata:
cwe:
- 'CWE-250: Execution with Unnecessary Privileges'
category: security
technology:
- docker
references:
- https://cwe.mitre.org/data/definitions/250.html
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run
shortlink: https://sg.run/pxEL
semgrep.dev:
rule:
r_id: 9518
rv_id: 946196
rule_id: r6Ur5A
version_id: xyTqnk3
url: https://semgrep.dev/playground/r/xyTqnk3/python.docker.security.audit.docker-arbitrary-container-run.docker-arbitrary-container-run
origin: community
- id: python.flask.caching.query-string.flask-cache-query-string
patterns:
- pattern-either:
- pattern: |
@app.route("...")
@cache.cached(...)
def $HANDLER(...):
...
request.args.get(...)
- pattern: |
@app.route("...", methods=[..., "POST", ...])
@cache.cached(...)
def $HANDLER(...):
...
- pattern: |
@app.route("...", methods=[..., "PUT", ...])
@cache.cached(...)
def $HANDLER(...):
...
- pattern: |
@app.route("...", methods=[..., "DELETE", ...])
@cache.cached(...)
def $HANDLER(...):
...
- pattern: |
@app.route("...", methods=[..., "PATCH", ...])
@cache.cached(...)
def $HANDLER(...):
...
- pattern-not: |
@app.route("...")
@cache.cached(..., query_string=True)
def $HANDLER(...):
...
request.args.get(...)
message: Flask-caching doesn't cache query strings by default. You have to use `query_string=True`.
Also you shouldn't cache verbs that can mutate state.
severity: WARNING
languages:
- python
metadata:
category: caching
technology:
- flask
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.flask.caching.query-string.flask-cache-query-string
shortlink: https://sg.run/jROJ
semgrep.dev:
rule:
r_id: 9521
rv_id: 946200
rule_id: kxUko3
version_id: d6TPjJN
url: https://semgrep.dev/playground/r/d6TPjJN/python.flask.caching.query-string.flask-cache-query-string
origin: community
- id: python.flask.security.dangerous-template-string.dangerous-template-string
message: Found a template created with string formatting. This is susceptible to
server-side template injection and cross-site scripting attacks.
metadata:
cwe:
- 'CWE-96: Improper Neutralization of Directives in Statically Saved Code (''Static
Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html
- https://pequalsnp-team.github.io/cheatsheet/flask-jinja2-ssti
category: security
technology:
- flask
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/python.flask.security.dangerous-template-string.dangerous-template-string
shortlink: https://sg.run/b79E
semgrep.dev:
rule:
r_id: 9526
rv_id: 1263427
rule_id: v8UnZJ
version_id: X0Tzy0L
url: https://semgrep.dev/playground/r/X0Tzy0L/python.flask.security.dangerous-template-string.dangerous-template-string
origin: community
languages:
- python
severity: ERROR
pattern-either:
- pattern: |
$V = "...".format(...)
...
flask.render_template_string($V, ...)
- pattern: |
$V = "...".format(...)
...
return flask.render_template_string($V, ...), $MORE
- pattern: |
$V = "..." % $S
...
flask.render_template_string($V, ...)
- pattern: |
$V = "..." % $S
...
return flask.render_template_string($V, ...), $MORE
- pattern: |
$V = "..."
...
$V += $O
...
flask.render_template_string($V, ...)
- pattern: |
$V = "..."
...
$V += $O
...
return flask.render_template_string($V, ...), $MORE
- pattern: |
$V = f"...{$X}..."
...
flask.render_template_string($V, ...)
- pattern: |
$V = f"...{$X}..."
...
return flask.render_template_string($V, ...), $CODE
- id: python.flask.security.insecure-deserialization.insecure-deserialization
metadata:
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
references:
- https://docs.python.org/3/library/pickle.html
category: security
technology:
- flask
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/python.flask.security.insecure-deserialization.insecure-deserialization
shortlink: https://sg.run/N45z
semgrep.dev:
rule:
r_id: 9527
rv_id: 1263438
rule_id: d8UjBO
version_id: O9Tpx2r
url: https://semgrep.dev/playground/r/O9Tpx2r/python.flask.security.insecure-deserialization.insecure-deserialization
origin: community
message: Detected the use of an insecure deserialization library in a Flask route.
These libraries are prone to code execution vulnerabilities. Ensure user data
does not enter this function. To fix this, try to avoid serializing whole objects.
Consider instead using a serializer such as JSON.
languages:
- python
severity: ERROR
patterns:
- pattern-inside: |
@app.route(...)
def $X(...):
...
- pattern-not: $MODULE.$FUNC("...")
- pattern-not: $MODULE.$FUNC(open("...", ...))
- pattern-either:
- pattern: pickle.$FUNC(...)
- pattern: _pickle.$FUNC(...)
- pattern: cPickle.$FUNC(...)
- pattern: dill.$FUNC(...)
- pattern: shelve.$FUNC(...)
- pattern: yaml.load(...)
- id: python.flask.security.open-redirect.open-redirect
patterns:
- pattern-inside: |
@$APP.route(...)
def $X(...):
...
- pattern-not-inside: |
@$APP.route(...)
def $X(...):
...
if <... werkzeug.urls.url_parse($V) ...>:
...
- pattern-either:
- pattern: flask.redirect(<... flask.request.$W.get(...) ...>, ...)
- pattern: flask.redirect(<... flask.request.$W[...] ...>, ...)
- pattern: flask.redirect(<... flask.request.$W(...) ...>, ...)
- pattern: flask.redirect(<... flask.request.$W ...>, ...)
- pattern: |
$V = flask.request.$W.get(...)
...
flask.redirect(<... $V ...>, ...)
- pattern: |
$V = flask.request.$W[...]
...
flask.redirect(<... $V ...>, ...)
- pattern: |
$V = flask.request.$W(...)
...
flask.redirect(<... $V ...>, ...)
- pattern: |
$V = flask.request.$W
...
flask.redirect(<... $V ...>, ...)
- pattern-not: flask.redirect(flask.request.path)
- pattern-not: flask.redirect(flask.request.path + ...)
- pattern-not: flask.redirect(f"{flask.request.path}...")
message: Data from request is passed to redirect(). This is an open redirect and
could be exploited. Consider using 'url_for()' to generate links to known locations.
If you must use a URL to unknown pages, consider using 'urlparse()' or similar
and checking if the 'netloc' property is the same as your site's host name. See
the references for more information.
metadata:
cwe:
- 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://flask-login.readthedocs.io/en/latest/#login-example
- https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html#dangerous-url-redirect-example-1
- https://docs.python.org/3/library/urllib.parse.html#url-parsing
category: security
technology:
- flask
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Open Redirect
source: https://semgrep.dev/r/python.flask.security.open-redirect.open-redirect
shortlink: https://sg.run/kXe2
semgrep.dev:
rule:
r_id: 9528
rv_id: 1263439
rule_id: ZqU5LR
version_id: e1Tyj2Y
url: https://semgrep.dev/playground/r/e1Tyj2Y/python.flask.security.open-redirect.open-redirect
origin: community
languages:
- python
severity: ERROR
- id: python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization
patterns:
- pattern-inside: |
@app.route(...)
def $X(filename):
...
- pattern: flask.send_file(filename, ...)
message: Detected a user-controlled `filename` that could flow to `flask.send_file()`
function. This could lead to an attacker reading arbitrary file from the system,
leaking private information. Make sure to properly sanitize filename or use `flask.send_from_directory`
metadata:
cwe:
- 'CWE-73: External Control of File Name or Path'
owasp:
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
category: security
technology:
- flask
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization
shortlink: https://sg.run/weGP
semgrep.dev:
rule:
r_id: 9529
rv_id: 1263440
rule_id: nJUz6A
version_id: vdT06Ab
url: https://semgrep.dev/playground/r/vdT06Ab/python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization
origin: community
languages:
- python
severity: WARNING
- id: python.flask.security.unescaped-template-extension.unescaped-template-extension
message: Flask does not automatically escape Jinja templates unless they have .html,
.htm, .xml, or .xhtml extensions. This could lead to XSS attacks. Use .html, .htm,
.xml, or .xhtml for your template extensions. See https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup
for more information.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
source-rule-url: https://pypi.org/project/flake8-flask/
references:
- https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup
- https://semgrep.dev/blog/2020/bento-check-unescaped-template-extensions-in-flask/
- https://bento.dev/checks/flask/unescaped-file-extension/
category: security
technology:
- flask
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.flask.security.unescaped-template-extension.unescaped-template-extension
shortlink: https://sg.run/x1Rg
semgrep.dev:
rule:
r_id: 9530
rv_id: 1263441
rule_id: EwU293
version_id: d6Tyx52
url: https://semgrep.dev/playground/r/d6Tyx52/python.flask.security.unescaped-template-extension.unescaped-template-extension
origin: community
patterns:
- pattern-not: flask.render_template("=~/.+\.html$/", ...)
- pattern-not: flask.render_template("=~/.+\.xml$/", ...)
- pattern-not: flask.render_template("=~/.+\.htm$/", ...)
- pattern-not: flask.render_template("=~/.+\.xhtml$/", ...)
- pattern-not: flask.render_template($X + "=~/\.html$/", ...)
- pattern-not: flask.render_template($X + "=~/\.xml$/", ...)
- pattern-not: flask.render_template($X + "=~/\.htm$/", ...)
- pattern-not: flask.render_template($X + "=~/\.xhtml$/", ...)
- pattern-not: flask.render_template("=~/.+\.html$/" % $X, ...)
- pattern-not: flask.render_template("=~/.+\.xml$/" % $X, ...)
- pattern-not: flask.render_template("=~/.+\.htm$/" % $X, ...)
- pattern-not: flask.render_template("=~/.+\.xhtml$/" % $X, ...)
- pattern-not: flask.render_template("=~/.+\.html$/".format(...), ...)
- pattern-not: flask.render_template("=~/.+\.xml$/".format(...), ...)
- pattern-not: flask.render_template("=~/.+\.htm$/".format(...), ...)
- pattern-not: flask.render_template("=~/.+\.xhtml$/".format(...), ...)
- pattern-not: flask.render_template($TEMPLATE)
- pattern-either:
- pattern: flask.render_template("...", ...)
- pattern: flask.render_template($X + "...", ...)
- pattern: flask.render_template("..." % $Y, ...)
- pattern: flask.render_template("...".format(...), ...)
languages:
- python
severity: WARNING
- id: python.flask.security.unsanitized-input.response-contains-unsanitized-input
message: Flask response reflects unsanitized user input. This could lead to a cross-site
scripting vulnerability (https://owasp.org/www-community/attacks/xss/) in which
an attacker causes arbitrary code to be executed in the user's browser. To prevent,
please sanitize the user input, e.g. by rendering the response in a Jinja2 template
(see considerations in https://flask.palletsprojects.com/en/1.0.x/security/).
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://flask.palletsprojects.com/en/1.0.x/security/
- https://owasp.org/www-community/attacks/xss/
category: security
technology:
- flask
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.flask.security.unsanitized-input.response-contains-unsanitized-input
shortlink: https://sg.run/OPGn
semgrep.dev:
rule:
r_id: 9531
rv_id: 1263442
rule_id: 7KUQLl
version_id: ZRTKAvv
url: https://semgrep.dev/playground/r/ZRTKAvv/python.flask.security.unsanitized-input.response-contains-unsanitized-input
origin: community
languages:
- python
severity: WARNING
pattern-either:
- pattern: |
$X = flask.request.args.get(...)
...
flask.make_response("...".format($X))
- pattern: |
$X = flask.request.args.get(...)
...
flask.make_response(f"...{$X}...")
- pattern: |
$X = flask.request.args.get(...)
...
flask.make_response(f"...{$X}")
- pattern: |
$X = flask.request.args.get(...)
...
flask.make_response(f"{$X}...")
- id: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host
message: Running flask app with host 0.0.0.0 could expose the server publicly.
metadata:
cwe:
- 'CWE-668: Exposure of Resource to Wrong Sphere'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
category: security
technology:
- flask
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host
shortlink: https://sg.run/eLby
semgrep.dev:
rule:
r_id: 9532
rv_id: 1263414
rule_id: L1Uy1n
version_id: BjTkZOY
url: https://semgrep.dev/playground/r/BjTkZOY/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host
origin: community
languages:
- python
severity: WARNING
pattern-either:
- pattern: app.run(..., host="0.0.0.0", ...)
- pattern: app.run(..., "0.0.0.0", ...)
- id: python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly
patterns:
- pattern-not-inside: |
if __name__ == '__main__':
...
- pattern-not-inside: |
def $X(...):
...
- pattern: app.run(...)
message: top-level app.run(...) is ignored by flask. Consider putting app.run(...)
behind a guard, like inside a function
metadata:
cwe:
- 'CWE-668: Exposure of Resource to Wrong Sphere'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
category: security
technology:
- flask
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly
shortlink: https://sg.run/vz5b
semgrep.dev:
rule:
r_id: 9533
rv_id: 1263415
rule_id: 8GUjdX
version_id: DkTRb4z
url: https://semgrep.dev/playground/r/DkTRb4z/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly
origin: community
languages:
- python
severity: WARNING
- id: python.flask.security.audit.debug-enabled.debug-enabled
patterns:
- pattern-inside: |
import flask
...
- pattern: $APP.run(..., debug=True, ...)
message: Detected Flask app with debug=True. Do not deploy to production with this
flag enabled as it will leak sensitive information. Instead, consider using Flask
configuration variables or setting 'debug' using system environment variables.
metadata:
cwe:
- 'CWE-489: Active Debug Code'
owasp: A06:2017 - Security Misconfiguration
references:
- https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/
category: security
technology:
- flask
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Active Debug Code
source: https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled
shortlink: https://sg.run/dKrd
semgrep.dev:
rule:
r_id: 9534
rv_id: 946206
rule_id: gxU1bd
version_id: 8KTKjwR
url: https://semgrep.dev/playground/r/8KTKjwR/python.flask.security.audit.debug-enabled.debug-enabled
origin: community
severity: WARNING
languages:
- python
- id: python.flask.security.audit.directly-returned-format-string.directly-returned-format-string
message: Detected Flask route directly returning a formatted string. This is subject
to cross-site scripting if user input can reach the string. Consider using the
template engine instead and rendering pages with 'render_template()'.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- flask
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string
shortlink: https://sg.run/Zv6o
semgrep.dev:
rule:
r_id: 9535
rv_id: 1263416
rule_id: QrUz49
version_id: WrTqKAz
url: https://semgrep.dev/playground/r/WrTqKAz/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string
origin: community
languages:
- python
severity: WARNING
mode: taint
pattern-sources:
- pattern-either:
- patterns:
- pattern-inside: |
@$APP.route(...)
def $FUNC(..., $PARAM, ...):
...
- pattern: $PARAM
- pattern: |
request.$FUNC.get(...)
- pattern: |
request.$FUNC(...)
- pattern: request.$FUNC[...]
pattern-sinks:
- patterns:
- pattern-not-inside: return "..."
- pattern-either:
- pattern: return "...".format(...)
- pattern: return "..." % ...
- pattern: return "..." + ...
- pattern: return ... + "..."
- pattern: return f"...{...}..."
- patterns:
- pattern: return $X
- pattern-either:
- pattern-inside: |
$X = "...".format(...)
...
- pattern-inside: |
$X = "..." % ...
...
- pattern-inside: |
$X = "..." + ...
...
- pattern-inside: |
$X = ... + "..."
...
- pattern-inside: |
$X = f"...{...}..."
...
- pattern-not-inside: |
$X = "..."
...
- id: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING
message: Hardcoded variable `TESTING` detected. Use environment variables or config
files instead
severity: WARNING
metadata:
likelihood: LOW
impact: LOW
confidence: LOW
category: security
cwe:
- 'CWE-489: Active Debug Code'
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
references:
- https://bento.dev/checks/flask/avoid-hardcoded-config/
- https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values
- https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features
subcategory:
- audit
technology:
- flask
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Active Debug Code
source: https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING
shortlink: https://sg.run/ndZ2
semgrep.dev:
rule:
r_id: 9536
rv_id: 1263419
rule_id: 3qUPoy
version_id: qkTR7P1
url: https://semgrep.dev/playground/r/qkTR7P1/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING
origin: community
languages:
- python
pattern-either:
- pattern: $M.config['TESTING'] = True
- pattern: $M.config['TESTING'] = False
- pattern: $M.update(TESTING=True, ...)
- pattern: $M.update(TESTING=False, ...)
- id: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY
message: Hardcoded variable `SECRET_KEY` detected. Use environment variables or
config files instead
severity: ERROR
metadata:
likelihood: LOW
impact: LOW
confidence: LOW
category: security
cwe:
- 'CWE-489: Active Debug Code'
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
references:
- https://bento.dev/checks/flask/avoid-hardcoded-config/
- https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values
- https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features
subcategory:
- audit
technology:
- flask
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Active Debug Code
source: https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY
shortlink: https://sg.run/Ekde
semgrep.dev:
rule:
r_id: 9537
rv_id: 1263420
rule_id: 4bUkX0
version_id: l4TJRA9
url: https://semgrep.dev/playground/r/l4TJRA9/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY
origin: community
languages:
- python
pattern-either:
- pattern: $M.update(SECRET_KEY="=~/.*/")
- pattern: $M.config['SECRET_KEY'] = "=~/.*/"
- id: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV
message: Hardcoded variable `ENV` detected. Set this by using FLASK_ENV environment
variable
severity: WARNING
metadata:
likelihood: LOW
impact: LOW
confidence: LOW
category: security
cwe:
- 'CWE-489: Active Debug Code'
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
references:
- https://bento.dev/checks/flask/avoid-hardcoded-config/
- https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values
- https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features
subcategory:
- audit
technology:
- flask
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Active Debug Code
source: https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV
shortlink: https://sg.run/7oXW
semgrep.dev:
rule:
r_id: 9538
rv_id: 1263421
rule_id: PeUZpr
version_id: YDTZeKr
url: https://semgrep.dev/playground/r/YDTZeKr/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV
origin: community
languages:
- python
pattern-either:
- pattern: $M.update(ENV="=~/^development|production$/")
- pattern: $M.config['ENV'] = "=~/^development|production$/"
- id: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG
message: Hardcoded variable `DEBUG` detected. Set this by using FLASK_DEBUG environment
variable
severity: WARNING
metadata:
likelihood: LOW
impact: LOW
confidence: LOW
category: security
cwe:
- 'CWE-489: Active Debug Code'
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
references:
- https://bento.dev/checks/flask/avoid-hardcoded-config/
- https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values
- https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features
subcategory:
- audit
technology:
- flask
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Active Debug Code
source: https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG
shortlink: https://sg.run/LwPo
semgrep.dev:
rule:
r_id: 9539
rv_id: 1263422
rule_id: JDUyJR
version_id: 6xT29w6
url: https://semgrep.dev/playground/r/6xT29w6/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG
origin: community
languages:
- python
pattern-either:
- pattern: $M.update(DEBUG=True)
- pattern: $M.update(DEBUG=False)
- pattern: $M.config['DEBUG'] = True
- pattern: $M.config['DEBUG'] = False
- id: python.flask.security.audit.render-template-string.render-template-string
pattern: flask.render_template_string(...)
metadata:
cwe:
- 'CWE-96: Improper Neutralization of Directives in Statically Saved Code (''Static
Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html
category: security
technology:
- flask
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/python.flask.security.audit.render-template-string.render-template-string
shortlink: https://sg.run/8yjE
semgrep.dev:
rule:
r_id: 9540
rv_id: 1263423
rule_id: 5rUOv1
version_id: o5TbDp4
url: https://semgrep.dev/playground/r/o5TbDp4/python.flask.security.audit.render-template-string.render-template-string
origin: community
message: Found a template created with string formatting. This is susceptible to
server-side template injection and cross-site scripting attacks.
languages:
- python
severity: WARNING
- id: python.flask.security.audit.secure-set-cookie.secure-set-cookie
patterns:
- pattern-either:
- pattern-inside: |
$RESP = flask.make_response(...)
...
- pattern-inside: |
$RESP = flask.Response(...)
...
- pattern-not: $RESP.set_cookie(..., secure=$A, httponly=$B, samesite=$C, ...)
- pattern-not: $RESP.set_cookie(..., **$A)
- pattern: $RESP.set_cookie(...)
message: Found a Flask cookie with insecurely configured properties. By default
the secure, httponly and samesite ar configured insecurely. cookies should be
handled securely by setting `secure=True`, `httponly=True`, and `samesite='Lax'`
in response.set_cookie(...). If these parameters are not properly set, your cookies
are not properly protected and are at risk of being stolen by an attacker. Include
the `secure=True`, `httponly=True`, `samesite='Lax'` arguments or set these to
be true in the Flask configuration.
metadata:
cwe:
- 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute'
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
references:
- https://flask.palletsprojects.com/en/3.0.x/api/#flask.Response.set_cookie
- https://flask.palletsprojects.com/en/3.0.x/security/#set-cookie-options
category: security
technology:
- python
- flask
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
functional-categories:
- web::search::cookie-config::flask
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cookie Security
source: https://semgrep.dev/r/python.flask.security.audit.secure-set-cookie.secure-set-cookie
shortlink: https://sg.run/gLkZ
semgrep.dev:
rule:
r_id: 9541
rv_id: 1263424
rule_id: GdU7GR
version_id: zyTb20n
url: https://semgrep.dev/playground/r/zyTb20n/python.flask.security.audit.secure-set-cookie.secure-set-cookie
origin: community
languages:
- python
severity: WARNING
- id: python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled
message: Setting 'WTF_CSRF_ENABLED' to 'False' explicitly disables CSRF protection.
options:
symbolic_propagation: true
metadata:
cwe:
- 'CWE-352: Cross-Site Request Forgery (CSRF)'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://flask-wtf.readthedocs.io/en/1.2.x/csrf/
category: security
technology:
- flask
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
functional-categories:
- web::search::csrf-config::flask
- web::search::csrf-config::flask-wtf
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site Request Forgery (CSRF)
source: https://semgrep.dev/r/python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled
shortlink: https://sg.run/Q5AQ
semgrep.dev:
rule:
r_id: 9542
rv_id: 1263425
rule_id: ReUgXz
version_id: pZT034X
url: https://semgrep.dev/playground/r/pZT034X/python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled
origin: community
severity: WARNING
languages:
- python
patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: $APP.config["WTF_CSRF_ENABLED"] = $FALSE
- pattern: $APP.config.WTF_CSRF_ENABLED = $FALSE
- patterns:
- pattern: |
$APP.config.$UPDATE(
...,
WTF_CSRF_ENABLED = $FALSE,
...
)
- pattern-not-inside: |
$APP.config.$UPDATE(
...,
TESTING=True,
...
)
- pattern-not-inside: |
$APP.config.$UPDATE(
...,
DEBUG=True,
...
)
- metavariable-regex:
metavariable: $UPDATE
regex: ^(update|from_mapping)$
- pattern: |
$OBJ = $CLASS()
...
$OBJ.WTF_CSRF_ENABLED = $FALSE
...
$APP.config.from_object($OBJ, ...)
- pattern: |
WTF_CSRF_ENABLED = $FALSE
...
$APP.config.from_object(__name__)
- metavariable-regex:
metavariable: $FALSE
regex: ^(False)$
- focus-metavariable: $FALSE
fix: 'True'
- id: python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content
patterns:
- pattern: flask.make_response(...)
- pattern-not-inside: flask.make_response()
- pattern-not-inside: flask.make_response("...", ...)
- pattern-not-inside: 'flask.make_response({"...": "..."}, ...)'
- pattern-not-inside: flask.make_response(flask.redirect(...), ...)
- pattern-not-inside: flask.make_response(flask.render_template(...), ...)
- pattern-not-inside: flask.make_response(flask.jsonify(...), ...)
- pattern-not-inside: flask.make_response(json.dumps(...), ...)
- pattern-not-inside: |
$X = flask.render_template(...)
...
flask.make_response($X, ...)
- pattern-not-inside: |
$X = flask.jsonify(...)
...
flask.make_response($X, ...)
- pattern-not-inside: |
$X = json.dumps(...)
...
flask.make_response($X, ...)
message: Be careful with `flask.make_response()`. If this response is rendered onto
a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()`
will not autoescape HTML. If you are rendering HTML, write your HTML in a template
file and use `flask.render_template()` which will take care of escaping. If you
are returning data from an API, consider using `flask.jsonify()`.
severity: WARNING
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://github.com/python-security/pyt//blob/093a077bcf12d1f58ddeb2d73ddc096623985fb0/examples/vulnerable_code/XSS_assign_to_other_var.py#L11
- https://flask.palletsprojects.com/en/1.1.x/api/#flask.Flask.make_response
- https://flask.palletsprojects.com/en/1.1.x/api/#response-objects
category: security
technology:
- flask
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content
shortlink: https://sg.run/3x3p
semgrep.dev:
rule:
r_id: 9543
rv_id: 1263426
rule_id: AbUz6A
version_id: 2KTv2od
url: https://semgrep.dev/playground/r/2KTv2od/python.flask.security.audit.xss.make-response-with-unknown-content.make-response-with-unknown-content
origin: community
languages:
- python
- id: python.flask.security.injection.os-system-injection.os-system-injection
languages:
- python
severity: ERROR
message: User data detected in os.system. This could be vulnerable to a command
injection and should be avoided. If this must be done, use the 'subprocess' module
instead and pass the arguments as a list.
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/www-community/attacks/Command_Injection
category: security
technology:
- flask
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.flask.security.injection.os-system-injection.os-system-injection
shortlink: https://sg.run/4xzz
semgrep.dev:
rule:
r_id: 9544
rv_id: 1263429
rule_id: BYUN99
version_id: 1QTypw7
url: https://semgrep.dev/playground/r/1QTypw7/python.flask.security.injection.os-system-injection.os-system-injection
origin: community
pattern-either:
- patterns:
- pattern: os.system(...)
- pattern-either:
- pattern-inside: |
@$APP.route($ROUTE, ...)
def $FUNC(..., $ROUTEVAR, ...):
...
os.system(..., <... $ROUTEVAR ...>, ...)
- pattern-inside: |
@$APP.route($ROUTE, ...)
def $FUNC(..., $ROUTEVAR, ...):
...
$INTERM = <... $ROUTEVAR ...>
...
os.system(..., <... $INTERM ...>, ...)
- pattern: os.system(..., <... flask.request.$W.get(...) ...>, ...)
- pattern: os.system(..., <... flask.request.$W[...] ...>, ...)
- pattern: os.system(..., <... flask.request.$W(...) ...>, ...)
- pattern: os.system(..., <... flask.request.$W ...>, ...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W.get(...) ...>
...
os.system(<... $INTERM ...>)
- pattern: os.system(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W[...] ...>
...
os.system(<... $INTERM ...>)
- pattern: os.system(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W(...) ...>
...
os.system(<... $INTERM ...>)
- pattern: os.system(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W ...>
...
os.system(<... $INTERM ...>)
- pattern: os.system(...)
- id: python.flask.security.injection.path-traversal-open.path-traversal-open
languages:
- python
severity: ERROR
message: Found request data in a call to 'open'. Ensure the request data is validated
or sanitized, otherwise it could result in path traversal attacks.
metadata:
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://owasp.org/www-community/attacks/Path_Traversal
category: security
technology:
- flask
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/python.flask.security.injection.path-traversal-open.path-traversal-open
shortlink: https://sg.run/PJRW
semgrep.dev:
rule:
r_id: 9545
rv_id: 1263430
rule_id: DbUpOQ
version_id: 9lT4b94
url: https://semgrep.dev/playground/r/9lT4b94/python.flask.security.injection.path-traversal-open.path-traversal-open
origin: community
pattern-either:
- patterns:
- pattern: open(...)
- pattern-either:
- pattern-inside: |
@$APP.route($ROUTE, ...)
def $FUNC(..., $ROUTEVAR, ...):
...
open(..., <... $ROUTEVAR ...>, ...)
- pattern-inside: |
@$APP.route($ROUTE, ...)
def $FUNC(..., $ROUTEVAR, ...):
...
with open(..., <... $ROUTEVAR ...>, ...) as $FD:
...
- pattern-inside: |
@$APP.route($ROUTE, ...)
def $FUNC(..., $ROUTEVAR, ...):
...
$INTERM = <... $ROUTEVAR ...>
...
open(..., <... $INTERM ...>, ...)
- pattern: open(..., <... flask.request.$W.get(...) ...>, ...)
- pattern: open(..., <... flask.request.$W[...] ...>, ...)
- pattern: open(..., <... flask.request.$W(...) ...>, ...)
- pattern: open(..., <... flask.request.$W ...>, ...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W.get(...) ...>
...
open(<... $INTERM ...>, ...)
- pattern: open(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W[...] ...>
...
open(<... $INTERM ...>, ...)
- pattern: open(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W(...) ...>
...
open(<... $INTERM ...>, ...)
- pattern: open(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W ...>
...
open(<... $INTERM ...>, ...)
- pattern: open(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W.get(...) ...>
...
with open(<... $INTERM ...>, ...) as $F:
...
- pattern: open(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W[...] ...>
...
with open(<... $INTERM ...>, ...) as $F:
...
- pattern: open(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W(...) ...>
...
with open(<... $INTERM ...>, ...) as $F:
...
- pattern: open(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W ...>
...
with open(<... $INTERM ...>, ...) as $F:
...
- pattern: open(...)
- id: python.flask.security.injection.ssrf-requests.ssrf-requests
languages:
- python
severity: ERROR
message: Data from request object is passed to a new server-side request. This could
lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes
and hosts are validated against an allowlist, do not forward the response to the
user, and ensure proper authentication and transport-layer security in the proxied
request.
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
category: security
technology:
- flask
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests
shortlink: https://sg.run/J9LW
semgrep.dev:
rule:
r_id: 9546
rv_id: 1263432
rule_id: WAUoRx
version_id: rxTAKJn
url: https://semgrep.dev/playground/r/rxTAKJn/python.flask.security.injection.ssrf-requests.ssrf-requests
origin: community
pattern-either:
- patterns:
- pattern: requests.$FUNC(...)
- pattern-either:
- pattern-inside: |
@$APP.$ROUTE_METHOD($ROUTE, ...)
def $ROUTE_FUNC(..., $ROUTEVAR, ...):
...
requests.$FUNC(..., <... $ROUTEVAR ...>, ...)
- pattern-inside: |
@$APP.$ROUTE_METHOD($ROUTE, ...)
def $ROUTE_FUNC(..., $ROUTEVAR, ...):
...
$INTERM = <... $ROUTEVAR ...>
...
requests.$FUNC(..., <... $INTERM ...>, ...)
- metavariable-regex:
metavariable: $ROUTE_METHOD
regex: ^(route|get|post|put|delete|patch)$
- pattern: requests.$FUNC(..., <... flask.request.$W.get(...) ...>, ...)
- pattern: requests.$FUNC(..., <... flask.request.$W[...] ...>, ...)
- pattern: requests.$FUNC(..., <... flask.request.$W(...) ...>, ...)
- pattern: requests.$FUNC(..., <... flask.request.$W ...>, ...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W.get(...) ...>
...
requests.$FUNC(<... $INTERM ...>, ...)
- pattern: requests.$FUNC(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W[...] ...>
...
requests.$FUNC(<... $INTERM ...>, ...)
- pattern: requests.$FUNC(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W(...) ...>
...
requests.$FUNC(<... $INTERM ...>, ...)
- pattern: requests.$FUNC(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W ...>
...
requests.$FUNC(<... $INTERM ...>, ...)
- pattern: requests.$FUNC(...)
- id: python.flask.security.injection.user-eval.eval-injection
languages:
- python
severity: ERROR
message: Detected user data flowing into eval. This is code injection and should
be avoided.
metadata:
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html
category: security
technology:
- flask
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/python.flask.security.injection.user-eval.eval-injection
shortlink: https://sg.run/5QpX
semgrep.dev:
rule:
r_id: 9547
rv_id: 1263436
rule_id: 0oU54W
version_id: w8TRoB0
url: https://semgrep.dev/playground/r/w8TRoB0/python.flask.security.injection.user-eval.eval-injection
origin: community
pattern-either:
- patterns:
- pattern: eval(...)
- pattern-either:
- pattern-inside: |
@$APP.route($ROUTE, ...)
def $FUNC(..., $ROUTEVAR, ...):
...
eval(..., <... $ROUTEVAR ...>, ...)
- pattern-inside: |
@$APP.route($ROUTE, ...)
def $FUNC(..., $ROUTEVAR, ...):
...
$INTERM = <... $ROUTEVAR ...>
...
eval(..., <... $INTERM ...>, ...)
- pattern: eval(..., <... flask.request.$W.get(...) ...>, ...)
- pattern: eval(..., <... flask.request.$W[...] ...>, ...)
- pattern: eval(..., <... flask.request.$W(...) ...>, ...)
- pattern: eval(..., <... flask.request.$W ...>, ...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W.get(...) ...>
...
eval(..., <... $INTERM ...>, ...)
- pattern: eval(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W[...] ...>
...
eval(..., <... $INTERM ...>, ...)
- pattern: eval(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W(...) ...>
...
eval(..., <... $INTERM ...>, ...)
- pattern: eval(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W ...>
...
eval(..., <... $INTERM ...>, ...)
- pattern: eval(...)
- id: python.flask.security.injection.user-exec.exec-injection
languages:
- python
severity: ERROR
message: Detected user data flowing into exec. This is code injection and should
be avoided.
metadata:
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://nedbatchelder.com/blog/201206/exec_really_is_dangerous.html
category: security
technology:
- flask
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/python.flask.security.injection.user-exec.exec-injection
shortlink: https://sg.run/Ge42
semgrep.dev:
rule:
r_id: 9548
rv_id: 1263437
rule_id: KxUbl2
version_id: xyTjzD9
url: https://semgrep.dev/playground/r/xyTjzD9/python.flask.security.injection.user-exec.exec-injection
origin: community
pattern-either:
- patterns:
- pattern: exec(...)
- pattern-either:
- pattern-inside: |
@$APP.route($ROUTE, ...)
def $FUNC(..., $ROUTEVAR, ...):
...
exec(..., <... $ROUTEVAR ...>, ...)
- pattern-inside: |
@$APP.route($ROUTE, ...)
def $FUNC(..., $ROUTEVAR, ...):
...
$INTERM = <... $ROUTEVAR ...>
...
exec(..., <... $INTERM ...>, ...)
- pattern: exec(..., <... flask.request.$W.get(...) ...>, ...)
- pattern: exec(..., <... flask.request.$W[...] ...>, ...)
- pattern: exec(..., <... flask.request.$W(...) ...>, ...)
- pattern: exec(..., <... flask.request.$W ...>, ...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W.get(...) ...>
...
exec(..., <... $INTERM ...>, ...)
- pattern: exec(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W[...] ...>
...
exec(..., <... $INTERM ...>, ...)
- pattern: exec(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W(...) ...>
...
exec(..., <... $INTERM ...>, ...)
- pattern: exec(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W ...>
...
exec(..., <... $INTERM ...>, ...)
- pattern: exec(...)
- id: python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2
message: Detected direct use of jinja2. If not done properly, this may bypass HTML
escaping which opens up the application to cross-site scripting (XSS) vulnerabilities.
Prefer using the Flask method 'render_template()' and templates with a '.html'
extension in order to prevent XSS.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://jinja.palletsprojects.com/en/2.11.x/api/#basics
category: security
technology:
- flask
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2
shortlink: https://sg.run/RoKe
semgrep.dev:
rule:
r_id: 9549
rv_id: 1263443
rule_id: qNUjN2
version_id: nWT2L1b
url: https://semgrep.dev/playground/r/nWT2L1b/python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2
origin: community
languages:
- python
severity: WARNING
pattern-either:
- pattern: jinja2.Environment(...)
- pattern: jinja2.Template.render(...)
- patterns:
- pattern-inside: |
$TEMPLATE = $ENV.get_template(...)
...
- pattern: $TEMPLATE.render(...)
- patterns:
- pattern-inside: |
$TEMPLATE = jinja2.Template(...)
...
- pattern: $TEMPLATE.render(...)
- id: python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup
message: Detected explicitly unescaped content using 'Markup()'. This permits the
unescaped data to include unescaped HTML which could result in cross-site scripting.
Ensure this data is not externally controlled, or consider rewriting to not use
'Markup()'.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://tedboy.github.io/flask/generated/generated/flask.Markup.html
category: security
technology:
- flask
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup
shortlink: https://sg.run/AvZ8
semgrep.dev:
rule:
r_id: 9550
rv_id: 1263444
rule_id: lBU95l
version_id: ExTEx3l
url: https://semgrep.dev/playground/r/ExTEx3l/python.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markup
origin: community
languages:
- python
severity: WARNING
pattern-either:
- pattern: flask.Markup.unescape(...)
- pattern: $MARKUPOBJ.unescape()
- patterns:
- pattern-either:
- pattern: flask.Markup($Q)
- pattern: markupsafe.Markup($Q)
- metavariable-pattern:
metavariable: $Q
patterns:
- pattern-not: '"..."'
- id: python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off
message: Detected a segment of a Flask template where autoescaping is explicitly
disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this
segment. Ensure no user data is rendered here, otherwise this is a cross-site
scripting (XSS) vulnerability, or turn autoescape on.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://flask.palletsprojects.com/en/1.1.x/templating/#controlling-autoescaping
- https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup
category: security
technology:
- flask
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off
shortlink: https://sg.run/Bkn2
semgrep.dev:
rule:
r_id: 9551
rv_id: 1263445
rule_id: YGURo6
version_id: 7ZTE3jd
url: https://semgrep.dev/playground/r/7ZTE3jd/python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off
origin: community
languages:
- regex
paths:
include:
- '*.html'
severity: WARNING
pattern-regex: '{%\s*autoescape\s+false\s*%}'
- id: python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials
languages:
- python
metadata:
cwe:
- 'CWE-522: Insufficiently Protected Credentials'
owasp:
- A02:2017 - Broken Authentication
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
references:
- https://cwe.mitre.org/data/definitions/522.html
category: security
technology:
- jwt
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials
shortlink: https://sg.run/qxPy
semgrep.dev:
rule:
r_id: 9556
rv_id: 1263451
rule_id: 2ZUb1L
version_id: 44TEjwq
url: https://semgrep.dev/playground/r/44TEjwq/python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials
origin: community
message: Password is exposed through JWT token payload. This is not encrypted and
the password could be compromised. Do not store passwords in JWT tokens.
pattern-either:
- pattern: |
jwt.encode({...,"password":$P,...},...)
- pattern: |
$PAYLOAD = {...,"password":$P,...}
...
jwt.encode($PAYLOAD,...)
severity: ERROR
- id: python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret
message: 'Hardcoded JWT secret or private key is used. This is a Insufficiently
Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html
Consider using an appropriate security mechanism to protect the credentials (e.g.
keeping secrets in environment variables)'
metadata:
cwe:
- 'CWE-522: Insufficiently Protected Credentials'
owasp:
- A02:2017 - Broken Authentication
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
references:
- https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
category: security
technology:
- jwt
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret
shortlink: https://sg.run/l2E9
semgrep.dev:
rule:
r_id: 9557
rv_id: 1263452
rule_id: X5U8P5
version_id: PkTR3X3
url: https://semgrep.dev/playground/r/PkTR3X3/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret
origin: community
patterns:
- pattern: |
jwt.encode($_, "...", ...)
languages:
- python
severity: ERROR
- id: python.jwt.security.jwt-none-alg.jwt-python-none-alg
message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm
assumes the integrity of the token has already been verified. This would allow
a malicious actor to forge a JWT token that will automatically be verified. Do
not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
category: security
technology:
- jwt
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.jwt.security.jwt-none-alg.jwt-python-none-alg
shortlink: https://sg.run/Yvp4
semgrep.dev:
rule:
r_id: 9558
rv_id: 1263453
rule_id: j2UvKw
version_id: JdTzxYj
url: https://semgrep.dev/playground/r/JdTzxYj/python.jwt.security.jwt-none-alg.jwt-python-none-alg
origin: community
languages:
- python
severity: ERROR
pattern-either:
- pattern: |
jwt.encode(...,algorithm="none",...)
- pattern: jwt.decode(...,algorithms=[...,"none",...],...)
- id: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode
patterns:
- pattern-either:
- patterns:
- pattern: |
jwt.decode(..., options={..., "verify_signature": $BOOL, ...}, ...)
- metavariable-pattern:
metavariable: $BOOL
pattern: |
False
- focus-metavariable: $BOOL
- patterns:
- pattern: |
$OPTS = {..., "verify_signature": $BOOL, ...}
...
jwt.decode(..., options=$OPTS, ...)
- metavariable-pattern:
metavariable: $BOOL
pattern: |
False
- focus-metavariable: $BOOL
message: Detected JWT token decoded with 'verify=False'. This bypasses any integrity
checks for the token which means the token could be tampered with by malicious
actors. Ensure that the JWT token is verified.
metadata:
owasp:
- A02:2017 - Broken Authentication
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe:
- 'CWE-287: Improper Authentication'
references:
- https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96
category: security
technology:
- jwt
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode
shortlink: https://sg.run/6nyB
semgrep.dev:
rule:
r_id: 9559
rv_id: 1263454
rule_id: 10UKjo
version_id: 5PTo12w
url: https://semgrep.dev/playground/r/5PTo12w/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode
origin: community
fix: |
True
severity: ERROR
languages:
- python
- id: python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data
message: The object is passed strictly to jwt.encode(...) Make sure that sensitive
information is not exposed through JWT token payload.
severity: WARNING
metadata:
owasp:
- A02:2017 - Broken Authentication
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
cwe:
- 'CWE-522: Insufficiently Protected Credentials'
source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
category: security
technology:
- jwt
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data
shortlink: https://sg.run/ox8R
semgrep.dev:
rule:
r_id: 9560
rv_id: 1263450
rule_id: 9AU1zW
version_id: 3ZT4XzA
url: https://semgrep.dev/playground/r/3ZT4XzA/python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data
origin: community
languages:
- python
patterns:
- pattern-inside: |
def $FUNC(...,$INPUT,...):
...
- pattern: jwt.encode($INPUT,...)
- id: python.lang.compatibility.python36.python36-compatibility-ssl
pattern: ssl.get_ciphers()
message: this function is only available on Python 3.6+
languages:
- python
severity: ERROR
metadata:
category: compatibility
technology:
- python
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-ssl
shortlink: https://sg.run/kXn2
semgrep.dev:
rule:
r_id: 9572
rv_id: 946262
rule_id: ZqU5wR
version_id: DkTNpr8
url: https://semgrep.dev/playground/r/DkTNpr8/python.lang.compatibility.python36.python36-compatibility-ssl
origin: community
- id: python.lang.compatibility.python36.python36-compatibility-Popen1
pattern: subprocess.Popen(errors=$X, ...)
message: the `errors` argument to Popen is only available on Python 3.6+
languages:
- python
severity: ERROR
metadata:
category: compatibility
technology:
- python
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen1
shortlink: https://sg.run/weBP
semgrep.dev:
rule:
r_id: 9573
rv_id: 946263
rule_id: nJUz7A
version_id: WrTEo4r
url: https://semgrep.dev/playground/r/WrTEo4r/python.lang.compatibility.python36.python36-compatibility-Popen1
origin: community
- id: python.lang.compatibility.python36.python36-compatibility-Popen2
pattern: subprocess.Popen(encoding=$X, ...)
message: the `encoding` argument to Popen is only available on Python 3.6+
languages:
- python
severity: ERROR
metadata:
category: compatibility
technology:
- python
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen2
shortlink: https://sg.run/x1Dg
semgrep.dev:
rule:
r_id: 9574
rv_id: 946264
rule_id: EwU2n3
version_id: 0bT15bx
url: https://semgrep.dev/playground/r/0bT15bx/python.lang.compatibility.python36.python36-compatibility-Popen2
origin: community
- id: python.lang.compatibility.python37.python37-compatibility-importlib
pattern: importlib.source_hash()
message: source_hash' is only available on Python 3.7+. This does not work in lower
versions, and therefore is not backwards compatible. Instead, use another hash
function.
languages:
- python
severity: ERROR
metadata:
category: compatibility
technology:
- python
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib
shortlink: https://sg.run/OPDn
semgrep.dev:
rule:
r_id: 9575
rv_id: 946265
rule_id: 7KUQOl
version_id: K3TJbqv
url: https://semgrep.dev/playground/r/K3TJbqv/python.lang.compatibility.python37.python37-compatibility-importlib
origin: community
- id: python.lang.compatibility.python37.python37-compatibility-importlib2
pattern: import importlib.resources
message: Found 'importlib.resources', which is a module only available on Python
3.7+. This does not work in lower versions, and therefore is not backwards compatible.
Use importlib_resources instead for older Python versions.
languages:
- python
severity: ERROR
metadata:
category: compatibility
technology:
- python
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib2
shortlink: https://sg.run/eL3y
semgrep.dev:
rule:
r_id: 9576
rv_id: 946266
rule_id: L1Uy0n
version_id: qkT4jn5
url: https://semgrep.dev/playground/r/qkT4jn5/python.lang.compatibility.python37.python37-compatibility-importlib2
origin: community
- id: python.lang.compatibility.python37.python37-compatibility-httpconn
pattern: http.client.HTTPConnection(blocksize=$X,...)
message: Found usage of the 'blocksize' argument in a HTTPConnection call. This
is only available on Python 3.7+ and is therefore not backwards compatible. Remove
this in order for this code to work in Python 3.6 and below.
languages:
- python
severity: ERROR
metadata:
category: compatibility
technology:
- python
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpconn
shortlink: https://sg.run/vzAb
semgrep.dev:
rule:
r_id: 9577
rv_id: 946267
rule_id: 8GUjbX
version_id: l4Tx9Or
url: https://semgrep.dev/playground/r/l4Tx9Or/python.lang.compatibility.python37.python37-compatibility-httpconn
origin: community
- id: python.lang.compatibility.python37.python37-compatibility-httpsconn
pattern: http.client.HTTPSConnection(blocksize=$X,...)
message: Found usage of the 'blocksize' argument in a HTTPSConnection call. This
is only available on Python 3.7+ and is therefore not backwards compatible. Remove
this in order for this code to work in Python 3.6 and below.
languages:
- python
severity: ERROR
metadata:
category: compatibility
technology:
- python
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpsconn
shortlink: https://sg.run/dKwd
semgrep.dev:
rule:
r_id: 9578
rv_id: 946268
rule_id: gxU1qd
version_id: YDTvR0R
url: https://semgrep.dev/playground/r/YDTvR0R/python.lang.compatibility.python37.python37-compatibility-httpsconn
origin: community
- id: python.lang.compatibility.python37.python37-compatibility-importlib3
pattern: import importlib.abc.ResourceReader
message: Found usage of 'importlib.abc.ResourceReader'. This module is only available
on Python 3.7+ and is therefore not backwards compatible. Instead, use another
loader.
languages:
- python
severity: ERROR
metadata:
category: compatibility
technology:
- python
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib3
shortlink: https://sg.run/Zv2o
semgrep.dev:
rule:
r_id: 9579
rv_id: 946269
rule_id: QrUzJ9
version_id: JdTDyrP
url: https://semgrep.dev/playground/r/JdTDyrP/python.lang.compatibility.python37.python37-compatibility-importlib3
origin: community
- id: python.lang.compatibility.python37.python37-compatibility-textiowrapper
pattern: TextIOWrapper.reconfigure(...)
message: Found usage of 'importlib.abc.ResourceReader'. This module is only available
on Python 3.7+ and is therefore not backwards compatible. Instead, use another
loader.
languages:
- python
severity: ERROR
metadata:
category: compatibility
technology:
- python
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-textiowrapper
shortlink: https://sg.run/ndL2
semgrep.dev:
rule:
r_id: 9580
rv_id: 946270
rule_id: 3qUPdy
version_id: 5PT9OD8
url: https://semgrep.dev/playground/r/5PT9OD8/python.lang.compatibility.python37.python37-compatibility-textiowrapper
origin: community
- id: python.lang.compatibility.python37.python37-compatibility-ipv6network1
pattern: ipaddress.IPv6Network.subnet_of($X)
message: IPv6Network.subnet_of is only available on Python 3.7+ and is therefore
not backwards compatible. Instead, check if the subnet is in 'subnets'.
languages:
- python
severity: ERROR
metadata:
category: compatibility
technology:
- python
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network1
shortlink: https://sg.run/EkLe
semgrep.dev:
rule:
r_id: 9581
rv_id: 946271
rule_id: 4bUko0
version_id: GxTP7Er
url: https://semgrep.dev/playground/r/GxTP7Er/python.lang.compatibility.python37.python37-compatibility-ipv6network1
origin: community
- id: python.lang.compatibility.python37.python37-compatibility-ipv6network2
pattern: ipaddress.IPv6Network.supernet_of($X)
message: IPv6Network.supernet_of is only available on Python 3.7+ and is therefore
not backwards compatible. Instead, check if the supernet is in 'supernet'.
languages:
- python
severity: ERROR
metadata:
category: compatibility
technology:
- python
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network2
shortlink: https://sg.run/7orW
semgrep.dev:
rule:
r_id: 9582
rv_id: 946272
rule_id: PeUZYr
version_id: RGTAgGq
url: https://semgrep.dev/playground/r/RGTAgGq/python.lang.compatibility.python37.python37-compatibility-ipv6network2
origin: community
- id: python.lang.compatibility.python37.python37-compatibility-ipv4network1
pattern: ipaddress.IPv4Network.subnet_of($X)
message: IPv4Network.subnet_of is only available on Python 3.7+ and is therefore
not backwards compatible. Instead, check if the subnet is in 'subnets'.
languages:
- python
severity: ERROR
metadata:
category: compatibility
technology:
- python
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network1
shortlink: https://sg.run/LwRo
semgrep.dev:
rule:
r_id: 9583
rv_id: 946273
rule_id: JDUyqR
version_id: A8TJz73
url: https://semgrep.dev/playground/r/A8TJz73/python.lang.compatibility.python37.python37-compatibility-ipv4network1
origin: community
- id: python.lang.compatibility.python37.python37-compatibility-ipv4network2
pattern: ipaddress.IPv4Network.supernet_of($X)
message: IPv4Network.supernet_of is only available on Python 3.7+ and is therefore
not backwards compatible. Instead, check if the supernet is in 'supernet'.
languages:
- python
severity: ERROR
metadata:
category: compatibility
technology:
- python
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network2
shortlink: https://sg.run/8y3E
semgrep.dev:
rule:
r_id: 9584
rv_id: 946274
rule_id: 5rUO61
version_id: BjT1N0K
url: https://semgrep.dev/playground/r/BjT1N0K/python.lang.compatibility.python37.python37-compatibility-ipv4network2
origin: community
- id: python.lang.compatibility.python37.python37-compatibility-locale1
pattern: locale.format_string(monetary=$X, ...)
message: Found usage of the 'monetary' argument in a function call of 'locale.format_string'.
This is only available on Python 3.7+ and is therefore not backwards compatible.
Instead, remove the 'monetary' argument.
languages:
- python
severity: ERROR
metadata:
category: compatibility
technology:
- python
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-locale1
shortlink: https://sg.run/gLeZ
semgrep.dev:
rule:
r_id: 9585
rv_id: 946275
rule_id: GdU72R
version_id: DkTNp0N
url: https://semgrep.dev/playground/r/DkTNp0N/python.lang.compatibility.python37.python37-compatibility-locale1
origin: community
- id: python.lang.compatibility.python37.python37-compatibility-math1
pattern: math.remainder($X, $Y)
message: math.remainder is only available on Python 3.7+ and is therefore not backwards
compatible. Instead, use math.fmod() or calculate $X - n* $Y.
languages:
- python
severity: ERROR
metadata:
category: compatibility
technology:
- python
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-math1
shortlink: https://sg.run/Q50Q
semgrep.dev:
rule:
r_id: 9586
rv_id: 946276
rule_id: ReUgbz
version_id: WrTEopQ
url: https://semgrep.dev/playground/r/WrTEopQ/python.lang.compatibility.python37.python37-compatibility-math1
origin: community
- id: python.lang.compatibility.python37.python37-compatibility-multiprocess1
pattern: multiprocessing.Process.close()
message: multiprocessing.Process.close() is only available on Python 3.7+ and is
therefore not backwards compatible. Instead, use join().
languages:
- python
severity: ERROR
metadata:
category: compatibility
technology:
- python
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess1
shortlink: https://sg.run/3xjp
semgrep.dev:
rule:
r_id: 9587
rv_id: 946277
rule_id: AbUzRA
version_id: 0bT15be
url: https://semgrep.dev/playground/r/0bT15be/python.lang.compatibility.python37.python37-compatibility-multiprocess1
origin: community
- id: python.lang.compatibility.python37.python37-compatibility-multiprocess2
pattern: multiprocessing.Process.kill()
message: multiprocessing.Process.kill() is only available on Python 3.7+ and is
therefore not backwards compatible. Instead, use terminate().
languages:
- python
severity: ERROR
metadata:
category: compatibility
technology:
- python
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess2
shortlink: https://sg.run/4x1z
semgrep.dev:
rule:
r_id: 9588
rv_id: 946278
rule_id: BYUNE9
version_id: K3TJbqK
url: https://semgrep.dev/playground/r/K3TJbqK/python.lang.compatibility.python37.python37-compatibility-multiprocess2
origin: community
- id: python.lang.compatibility.python37.python37-compatibility-os1
pattern: os.preadv(...)
message: os.preadv() is only available on Python 3.7+ and is therefore not backwards
compatible. Instead, use a combination of os.readv() and os.pread().
languages:
- python
severity: ERROR
metadata:
category: compatibility
technology:
- python
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os1
shortlink: https://sg.run/PJWW
semgrep.dev:
rule:
r_id: 9589
rv_id: 946279
rule_id: DbUpQQ
version_id: qkT4jnO
url: https://semgrep.dev/playground/r/qkT4jnO/python.lang.compatibility.python37.python37-compatibility-os1
origin: community
- id: python.lang.compatibility.python37.python37-compatibility-os2-ok2
patterns:
- pattern-not-inside: |
if hasattr(os, 'pwritev'):
...
- pattern: os.pwritev(...)
message: os.pwritev() is only available on Python 3.3+ and is therefore not backwards
compatible. Instead, use a combination of pwrite() and writev().
languages:
- python
severity: ERROR
metadata:
category: compatibility
technology:
- python
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os2-ok2
shortlink: https://sg.run/5Q9X
semgrep.dev:
rule:
r_id: 9591
rv_id: 946280
rule_id: 0oU5vW
version_id: l4Tx9Op
url: https://semgrep.dev/playground/r/l4Tx9Op/python.lang.compatibility.python37.python37-compatibility-os2-ok2
origin: community
- id: python.lang.compatibility.python37.python37-compatibility-pdb
pattern: pdb.set_trace(header=$X, ...)
message: pdb.set_trace() with the header argument is only available on Python 3.7+
and is therefore not backwards compatible. Instead, use set_trace() without the
header argument.
languages:
- python
severity: ERROR
metadata:
category: compatibility
technology:
- python
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-pdb
shortlink: https://sg.run/GeA2
semgrep.dev:
rule:
r_id: 9592
rv_id: 946281
rule_id: KxUby2
version_id: YDTvR0k
url: https://semgrep.dev/playground/r/YDTvR0k/python.lang.compatibility.python37.python37-compatibility-pdb
origin: community
- id: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1
pattern: hashlib.sha1(...)
fix-regex:
regex: sha1
replacement: sha256
message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not
collision resistant and is therefore not suitable as a cryptographic signature.
Use SHA256 or SHA3 instead.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
bandit-code: B303
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.2 Insecure Custom Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
references:
- https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html
- https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability
- http://2012.sharcs.org/slides/stevens.pdf
- https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
category: security
technology:
- python
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1
shortlink: https://sg.run/ydYx
semgrep.dev:
rule:
r_id: 9624
rv_id: 1263537
rule_id: x8UnBk
version_id: w8TRoE7
url: https://semgrep.dev/playground/r/w8TRoE7/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1
origin: community
severity: WARNING
languages:
- python
- id: python.lang.security.insecure-hash-function.insecure-hash-function
message: Detected use of an insecure MD4 or MD5 hash function. These functions have
known vulnerabilities and are considered deprecated. Consider using 'SHA256' or
a similar function instead.
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/hashlib_new_insecure_functions.py
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.2 Insecure Custom Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
references:
- https://tools.ietf.org/html/rfc6151
- https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision
- https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
category: security
technology:
- python
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.lang.security.insecure-hash-function.insecure-hash-function
shortlink: https://sg.run/rdBn
semgrep.dev:
rule:
r_id: 9625
rv_id: 1263538
rule_id: OrU30g
version_id: xyTjzEe
url: https://semgrep.dev/playground/r/xyTjzEe/python.lang.security.insecure-hash-function.insecure-hash-function
origin: community
languages:
- python
severity: WARNING
pattern-either:
- pattern: hashlib.new("=~/[M|m][D|d][4|5]/", ...)
- pattern: hashlib.new(..., name="=~/[M|m][D|d][4|5]/", ...)
- id: python.lang.security.unverified-ssl-context.unverified-ssl-context
patterns:
- pattern-either:
- pattern: ssl._create_unverified_context(...)
- pattern: ssl._create_default_https_context = ssl._create_unverified_context
fix-regex:
regex: _create_unverified_context
replacement: create_default_context
message: Unverified SSL context detected. This will permit insecure connections
without verifying SSL certificates. Use 'ssl.create_default_context' instead.
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe:
- 'CWE-295: Improper Certificate Validation'
references:
- https://docs.python.org/3/library/ssl.html#ssl-security
- https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection
category: security
technology:
- python
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/python.lang.security.unverified-ssl-context.unverified-ssl-context
shortlink: https://sg.run/N4lp
semgrep.dev:
rule:
r_id: 9627
rv_id: 1263540
rule_id: v8UnkQ
version_id: e1Tyjlj
url: https://semgrep.dev/playground/r/e1Tyjlj/python.lang.security.unverified-ssl-context.unverified-ssl-context
origin: community
severity: ERROR
languages:
- python
- id: python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc
pattern-either:
- pattern: import xmlrpclib
- pattern: import SimpleXMLRPCServer
- pattern: import xmlrpc
message: Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities.
Use defusedxml.xmlrpc instead.
metadata:
cwe:
- 'CWE-776: Improper Restriction of Recursive Entity References in DTDs (''XML
Entity Expansion'')'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
source-rule-url: https://github.com/PyCQA/bandit/blob/07f84cb5f5e7c1055e6feaa0fe93afa471de0ac3/bandit/blacklists/imports.py#L160
references:
- https://pypi.org/project/defusedxml/
- https://docs.python.org/3/library/xml.html#xml-vulnerabilities
category: security
technology:
- python
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc
shortlink: https://sg.run/weqY
semgrep.dev:
rule:
r_id: 9629
rv_id: 1263543
rule_id: ZqU5EZ
version_id: ZRTKA8z
url: https://semgrep.dev/playground/r/ZRTKA8z/python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc
origin: community
severity: ERROR
languages:
- python
- id: python.lang.security.audit.conn_recv.multiprocessing-recv
languages:
- python
message: 'The Connection.recv() method automatically unpickles the data it receives,
which can be a security risk unless you can trust the process which sent the message.
Therefore, unless the connection object was produced using Pipe() you should only
use the recv() and send() methods after performing some sort of authentication.
See more dettails: https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection'
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
references:
- https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection
category: security
technology:
- python
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/python.lang.security.audit.conn_recv.multiprocessing-recv
shortlink: https://sg.run/x1lz
semgrep.dev:
rule:
r_id: 9630
rv_id: 1263455
rule_id: nJUzeK
version_id: GxTkeKQ
url: https://semgrep.dev/playground/r/GxTkeKQ/python.lang.security.audit.conn_recv.multiprocessing-recv
origin: community
pattern-either:
- pattern: multiprocessing.connection.Connection.recv(...)
- pattern: multiprocessing.connection.Client.recv(...)
- pattern: |
$C = multiprocessing.connection.Client(...)
...
$C.recv(...)
severity: WARNING
- id: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected
patterns:
- pattern-not: urllib.$W("...")
- pattern-not: urllib.request.$W("...")
- pattern-not: $OPENER.$W("...")
- pattern-either:
- pattern: urllib.urlopen(...)
- pattern: urllib.request.urlopen(...)
- pattern: urllib.urlretrieve(...)
- pattern: urllib.request.urlretrieve(...)
- patterns:
- pattern-either:
- pattern-inside: |
$OPENER = urllib.URLopener(...)
...
- pattern-inside: |
$OPENER = urllib.request.URLopener(...)
...
- pattern-inside: |
$OPENER = urllib.FancyURLopener(...)
...
- pattern-inside: |
$OPENER = urllib.request.FancyURLopener(...)
...
- pattern-either:
- pattern: $OPENER.open(...)
- pattern: $OPENER.retrieve(...)
message: Detected a dynamic value being used with urllib. urllib supports 'file://'
schemes, so a dynamic value controlled by a malicious actor may allow them to
read arbitrary files. Audit uses of urllib calls to ensure user data cannot control
the URLs, or consider using the 'requests' library instead.
metadata:
cwe:
- 'CWE-939: Improper Authorization in Handler for Custom URL Scheme'
owasp: A01:2017 - Injection
source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/blacklists/calls.py#L163
bandit-code: B310
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.2.4 Dynamic Code Execution Features
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements
version: '4'
category: security
technology:
- python
references:
- https://cwe.mitre.org/data/definitions/939.html
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected
shortlink: https://sg.run/dKZZ
semgrep.dev:
rule:
r_id: 9634
rv_id: 946340
rule_id: 8GUj22
version_id: w8TKJbO
url: https://semgrep.dev/playground/r/w8TKJbO/python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected
origin: community
languages:
- python
severity: WARNING
- id: python.lang.security.audit.eval-detected.eval-detected
patterns:
- pattern-not: eval(f"")
- pattern-not: eval("...")
- pattern: eval(...)
message: Detected the use of eval(). eval() can be dangerous if used to evaluate
dynamic content. If this content can be input from outside the program, this may
be a code injection vulnerability. Ensure evaluated content is not definable by
external sources.
metadata:
source-rule-url: https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b307-eval
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.2.4 Dyanmic Code Execution Features
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements
version: '4'
category: security
technology:
- python
references:
- https://owasp.org/Top10/A03_2021-Injection
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/python.lang.security.audit.eval-detected.eval-detected
shortlink: https://sg.run/ZvrD
semgrep.dev:
rule:
r_id: 9635
rv_id: 1263477
rule_id: gxU149
version_id: bZT537Q
url: https://semgrep.dev/playground/r/bZT537Q/python.lang.security.audit.eval-detected.eval-detected
origin: community
languages:
- python
severity: WARNING
- id: python.lang.security.audit.exec-detected.exec-detected
patterns:
- pattern-not: exec("...")
- pattern: exec(...)
message: Detected the use of exec(). exec() can be dangerous if used to evaluate
dynamic content. If this content can be input from outside the program, this may
be a code injection vulnerability. Ensure evaluated content is not definable by
external sources.
metadata:
source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b102_exec_used.html
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.2.4 Dyanmic Code Execution Features
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements
version: '4'
category: security
technology:
- python
references:
- https://owasp.org/Top10/A03_2021-Injection
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/python.lang.security.audit.exec-detected.exec-detected
shortlink: https://sg.run/ndRX
semgrep.dev:
rule:
r_id: 9636
rv_id: 1263478
rule_id: QrUzKv
version_id: NdTzyKJ
url: https://semgrep.dev/playground/r/NdTzyKJ/python.lang.security.audit.exec-detected.exec-detected
origin: community
languages:
- python
severity: WARNING
- id: python.lang.security.audit.formatted-sql-query.formatted-sql-query
message: Detected possible formatted SQL query. Use parameterized queries instead.
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
references:
- https://stackoverflow.com/questions/775296/mysql-parameterized-queries
category: security
technology:
- python
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.lang.security.audit.formatted-sql-query.formatted-sql-query
shortlink: https://sg.run/EkWw
semgrep.dev:
rule:
r_id: 9637
rv_id: 1263479
rule_id: 3qUP9k
version_id: kbTzGBe
url: https://semgrep.dev/playground/r/kbTzGBe/python.lang.security.audit.formatted-sql-query.formatted-sql-query
origin: community
severity: WARNING
languages:
- python
pattern-either:
- pattern: $DB.execute("..." % ...)
- pattern: $DB.execute("...".format(...))
- pattern: $DB.execute(f"...")
- patterns:
- pattern-either:
- pattern-inside: |
$SQL = "..." % ...
...
- pattern-inside: |
$SQL = "...".format(...)
...
- pattern-inside: |
$SQL = f"...{$X}..."
...
- pattern: $DB.execute($SQL)
- id: python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument
message: Hardcoded password is used as a default argument to '$FUNC'. This could
be dangerous if a real password is not supplied.
languages:
- python
severity: WARNING
patterns:
- pattern: |
def $FUNC(..., password="...", ...):
...
- pattern-not: |
def $FUNC(..., password="", ...):
...
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
category: security
technology:
- python
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument
shortlink: https://sg.run/Lw9r
semgrep.dev:
rule:
r_id: 9639
rv_id: 1263480
rule_id: PeUZAW
version_id: w8TRoP0
url: https://semgrep.dev/playground/r/w8TRoP0/python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument
origin: community
- id: python.lang.security.audit.httpsconnection-detected.httpsconnection-detected
message: The HTTPSConnection API has changed frequently with minor releases of Python.
Ensure you are using the API for your version of Python securely. For example,
Python 3 versions prior to 3.4.3 will not verify SSL certificates by default.
See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection
for more information.
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe:
- 'CWE-295: Improper Certificate Validation'
references:
- https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection
category: security
technology:
- python
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/python.lang.security.audit.httpsconnection-detected.httpsconnection-detected
shortlink: https://sg.run/8yby
semgrep.dev:
rule:
r_id: 9640
rv_id: 1263481
rule_id: JDUy7y
version_id: xyTjzg9
url: https://semgrep.dev/playground/r/xyTjzg9/python.lang.security.audit.httpsconnection-detected.httpsconnection-detected
origin: community
severity: WARNING
languages:
- python
pattern-either:
- pattern: httplib.HTTPSConnection(...)
- pattern: http.client.HTTPSConnection(...)
- pattern: six.moves.http_client.HTTPSConnection(...)
- id: python.lang.security.audit.mako-templates-detected.mako-templates-detected
pattern: mako.template.Template(...)
message: Mako templates do not provide a global HTML escaping mechanism. This means
you must escape all sensitive data in your templates using '| u' for URL escaping
or '| h' for HTML escaping. If you are using Mako to serve web content, consider
using a system such as Jinja2 which enables global escaping.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/mako_templates.py
references:
- https://docs.makotemplates.org/en/latest/syntax.html#expression-escaping
- https://jinja.palletsprojects.com/en/2.11.x/intro/#
category: security
technology:
- mako
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.lang.security.audit.mako-templates-detected.mako-templates-detected
shortlink: https://sg.run/Q5v4
semgrep.dev:
rule:
r_id: 9642
rv_id: 1263502
rule_id: GdU79Z
version_id: BjTkZgY
url: https://semgrep.dev/playground/r/BjTkZgY/python.lang.security.audit.mako-templates-detected.mako-templates-detected
origin: community
languages:
- python
severity: INFO
- id: python.lang.security.audit.marshal.marshal-usage
languages:
- python
message: 'The marshal module is not intended to be secure against erroneous or maliciously
constructed data. Never unmarshal data received from an untrusted or unauthenticated
source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security'
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
references:
- https://docs.python.org/3/library/marshal.html?highlight=security
category: security
technology:
- python
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/python.lang.security.audit.marshal.marshal-usage
shortlink: https://sg.run/3xor
semgrep.dev:
rule:
r_id: 9643
rv_id: 1263503
rule_id: ReUg13
version_id: DkTRbPz
url: https://semgrep.dev/playground/r/DkTRbPz/python.lang.security.audit.marshal.marshal-usage
origin: community
pattern-either:
- pattern: marshal.dump(...)
- pattern: marshal.dumps(...)
- pattern: marshal.load(...)
- pattern: marshal.loads(...)
severity: WARNING
- id: python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key
patterns:
- pattern-inside: |
$CLIENT = paramiko.client.SSHClient(...)
...
$CLIENT.set_missing_host_key_policy(...)
- pattern-either:
- pattern: paramiko.client.AutoAddPolicy
- pattern: paramiko.client.WarningPolicy
message: Detected a paramiko host key policy that implicitly trusts a server's host
key. Host keys should be verified to ensure the connection is not to a malicious
server. Use RejectPolicy or a custom subclass instead.
metadata:
cwe:
- 'CWE-322: Key Exchange without Entity Authentication'
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/ssh_no_host_key_verification.py
references:
- http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.AutoAddPolicy
category: security
technology:
- paramiko
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key
shortlink: https://sg.run/4xpl
semgrep.dev:
rule:
r_id: 9644
rv_id: 1263510
rule_id: AbUzbe
version_id: JdTzxEQ
url: https://semgrep.dev/playground/r/JdTzxEQ/python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key
origin: community
languages:
- python
severity: WARNING
- id: python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated
pattern: ssl.wrap_socket(...)
message: '''ssl.wrap_socket()'' is deprecated. This function creates an insecure
socket without server name indication or hostname matching. Instead, create an
SSL context using ''ssl.SSLContext()'' and use that to wrap a socket.'
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://docs.python.org/3/library/ssl.html#ssl.wrap_socket
- https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket
category: security
technology:
- python
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated
shortlink: https://sg.run/PJOY
semgrep.dev:
rule:
r_id: 9645
rv_id: 1263516
rule_id: BYUN2e
version_id: DkTRbgn
url: https://semgrep.dev/playground/r/DkTRbgn/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated
origin: community
languages:
- python
severity: WARNING
- id: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true
patterns:
- pattern: subprocess.$FUNC(..., shell=$TRUE, ...)
- metavariable-pattern:
metavariable: $TRUE
pattern: "True \n"
- pattern-not: subprocess.$FUNC("...", shell=True, ...)
- focus-metavariable: $TRUE
message: Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous
because this call will spawn the command using a shell process. Doing so propagates
current shell settings and variables, which makes it much easier for a malicious
actor to execute commands. Use 'shell=False' instead.
fix: |
False
metadata:
source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
references:
- https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess
- https://docs.python.org/3/library/subprocess.html
category: security
technology:
- python
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- secure default
likelihood: HIGH
impact: LOW
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true
shortlink: https://sg.run/J92w
semgrep.dev:
rule:
r_id: 9646
rv_id: 1263518
rule_id: DbUpz2
version_id: 0bTKzDK
url: https://semgrep.dev/playground/r/0bTKzDK/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true
origin: community
languages:
- python
severity: ERROR
- id: python.lang.security.audit.system-wildcard-detected.system-wildcard-detected
patterns:
- pattern-either:
- pattern-inside: os.system("...")
- pattern-inside: os.popen("...")
- pattern-inside: os.popen2("...")
- pattern-inside: os.popen3("...")
- pattern-inside: os.popen4("...")
- pattern-inside: subprocess.$W(..., shell=True, ...)
- pattern-regex: (tar|chmod|chown|rsync)(.*?)\*
message: Detected use of the wildcard character in a system call that spawns a shell.
This subjects the wildcard to normal shell expansion, which can have unintended
consequences if there exist any non-standard file names. Consider a file named
'-e sh script.sh' -- this will execute a script when 'rsync' is called. See https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt
for more information.
metadata:
cwe:
- 'CWE-155: Improper Neutralization of Wildcards or Matching Symbols'
owasp: A01:2017 - Injection
source-url-open: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/injection_wildcard.py
references:
- https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt
category: security
technology:
- python
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/python.lang.security.audit.system-wildcard-detected.system-wildcard-detected
shortlink: https://sg.run/5QXA
semgrep.dev:
rule:
r_id: 9647
rv_id: 946383
rule_id: WAUorE
version_id: 6xTxj9B
url: https://semgrep.dev/playground/r/6xTxj9B/python.lang.security.audit.system-wildcard-detected.system-wildcard-detected
origin: community
languages:
- python
severity: WARNING
- id: python.lang.security.audit.telnetlib.telnetlib
pattern: telnetlib.$ANYTHING(...)
message: Telnet does not encrypt communications. Use SSH instead.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L208
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
bandit-code: B312
references:
- https://docs.python.org/3/library/telnetlib.html
category: security
technology:
- python
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/python.lang.security.audit.telnetlib.telnetlib
shortlink: https://sg.run/Gelp
semgrep.dev:
rule:
r_id: 9648
rv_id: 1263519
rule_id: 0oU5Wl
version_id: K3TKkZo
url: https://semgrep.dev/playground/r/K3TKkZo/python.lang.security.audit.telnetlib.telnetlib
origin: community
severity: WARNING
languages:
- python
- id: python.lang.security.audit.weak-ssl-version.weak-ssl-version
message: An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL
versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2'
or higher.
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/insecure_ssl_tls.py#L30
asvs:
section: V9 Communications Verification Requirements
control_id: 9.1.3 Weak TLS
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v91-client-communications-security-requirements
version: '4'
references:
- https://tools.ietf.org/html/rfc7568
- https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html
- https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLSv1_2
category: security
technology:
- python
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.lang.security.audit.weak-ssl-version.weak-ssl-version
shortlink: https://sg.run/RoZO
semgrep.dev:
rule:
r_id: 9649
rv_id: 1263520
rule_id: KxUbNG
version_id: qkTR7Ev
url: https://semgrep.dev/playground/r/qkTR7Ev/python.lang.security.audit.weak-ssl-version.weak-ssl-version
origin: community
languages:
- python
severity: WARNING
pattern-either:
- pattern: ssl.PROTOCOL_SSLv2
- pattern: ssl.PROTOCOL_SSLv3
- pattern: ssl.PROTOCOL_TLSv1
- pattern: ssl.PROTOCOL_TLSv1_1
- pattern: pyOpenSSL.SSL.SSLv2_METHOD
- pattern: pyOpenSSL.SSL.SSLv23_METHOD
- pattern: pyOpenSSL.SSL.SSLv3_METHOD
- pattern: pyOpenSSL.SSL.TLSv1_METHOD
- pattern: pyOpenSSL.SSL.TLSv1_1_METHOD
- id: python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls
patterns:
- pattern: ftplib.FTP(...)
- pattern-not: ftplib.FTP_TLS(...)
fix-regex:
regex: FTP(.*)\)
replacement: FTP_TLS\1, context=ssl.create_default_context())
message: The 'FTP' class sends information unencrypted. Consider using the 'FTP_TLS'
class instead.
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
references:
- https://docs.python.org/3/library/ftplib.html#ftplib.FTP_TLS
category: security
technology:
- ftplib
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls
shortlink: https://sg.run/AvPp
semgrep.dev:
rule:
r_id: 9650
rv_id: 1263483
rule_id: qNUjlR
version_id: e1TyjoY
url: https://semgrep.dev/playground/r/e1TyjoY/python.lang.security.audit.insecure-transport.ftplib.use-ftp-tls.use-ftp-tls
origin: community
severity: INFO
languages:
- python
- id: python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context
options:
symbolic_propagation: true
mode: taint
pattern-sources:
- patterns:
- pattern: |
"$URL"
- metavariable-pattern:
metavariable: $URL
language: regex
patterns:
- pattern-regex: http://
- pattern-not-regex: .*://localhost
- pattern-not-regex: .*://127\.0\.0\.1
pattern-sinks:
- patterns:
- pattern-inside: |
with requests.Session(...) as $SESSION:
...
- pattern-either:
- pattern: $SESSION.$W($SINK, ...)
- pattern: $SESSION.request($METHOD, $SINK, ...)
- focus-metavariable: $SINK
fix-regex:
regex: '[Hh][Tt][Tt][Pp]://'
replacement: https://
count: 1
message: Detected a request using 'http://'. This request will be unencrypted. Use
'https://' instead.
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
asvs:
section: V9 Communications Verification Requirements
control_id: 9.2.1 Weak TLS
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements
version: '4'
category: security
technology:
- requests
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context
shortlink: https://sg.run/Bk5W
semgrep.dev:
rule:
r_id: 9651
rv_id: 1263484
rule_id: lBU9BZ
version_id: vdT06wb
url: https://semgrep.dev/playground/r/vdT06wb/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context
origin: community
languages:
- python
severity: INFO
- id: python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http
options:
symbolic_propagation: true
mode: taint
pattern-sources:
- patterns:
- pattern: |
"$URL"
- metavariable-pattern:
metavariable: $URL
language: regex
patterns:
- pattern-regex: http://
- pattern-not-regex: .*://localhost
- pattern-not-regex: .*://127\.0\.0\.1
pattern-sinks:
- patterns:
- pattern-either:
- pattern: requests.Session(...).$W($SINK, ...)
- pattern: requests.Session(...).request($METHOD, $SINK, ...)
- focus-metavariable: $SINK
fix-regex:
regex: '[Hh][Tt][Tt][Pp]://'
replacement: https://
count: 1
message: Detected a request using 'http://'. This request will be unencrypted. Use
'https://' instead.
languages:
- python
severity: INFO
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
asvs:
section: V9 Communications Verification Requirements
control_id: 9.1.1 Weak TLS
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements
version: '4'
category: security
technology:
- requests
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http
shortlink: https://sg.run/DoBY
semgrep.dev:
rule:
r_id: 9652
rv_id: 1263485
rule_id: YGURXw
version_id: d6Tyx02
url: https://semgrep.dev/playground/r/d6Tyx02/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http
origin: community
- id: python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http
fix-regex:
regex: '[Hh][Tt][Tt][Pp]://'
replacement: https://
count: 1
message: Detected a request using 'http://'. This request will be unencrypted, and
attackers could listen into traffic on the network and be able to obtain sensitive
information. Use 'https://' instead.
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
asvs:
section: V9 Communications Verification Requirements
control_id: 9.1.1 Weak TLS
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements
version: '4'
category: security
technology:
- requests
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http
shortlink: https://sg.run/W8J4
semgrep.dev:
rule:
r_id: 9653
rv_id: 1263486
rule_id: 6JUjpG
version_id: ZRTKA9v
url: https://semgrep.dev/playground/r/ZRTKA9v/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http
origin: community
languages:
- python
severity: INFO
options:
symbolic_propagation: true
mode: taint
pattern-sources:
- patterns:
- pattern: |
"$URL"
- metavariable-pattern:
metavariable: $URL
language: regex
patterns:
- pattern-regex: http://
- pattern-not-regex: .*://localhost
- pattern-not-regex: .*://127\.0\.0\.1
pattern-sinks:
- patterns:
- pattern-either:
- pattern: requests.$W($SINK, ...)
- pattern: requests.request($METHOD, $SINK, ...)
- pattern: requests.Request($METHOD, $SINK, ...)
- focus-metavariable: $SINK
- id: python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers
pattern: $CONTEXT.set_ciphers(...)
message: The 'ssl' module disables insecure cipher suites by default. Therefore,
use of 'set_ciphers()' should only be used when you have very specialized requirements.
Otherwise, you risk lowering the security of the SSL channel.
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-326: Inadequate Encryption Strength'
asvs:
section: V9 Communications Verification Requirements
control_id: 9.1.3 Weak TLS
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v91-client-communications-security-requirements
version: '4'
references:
- https://docs.python.org/3/library/ssl.html#cipher-selection
- https://docs.python.org/3/library/ssl.html#ssl.SSLContext.set_ciphers
category: security
technology:
- ssl
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers
shortlink: https://sg.run/0Q0v
semgrep.dev:
rule:
r_id: 9654
rv_id: 1263487
rule_id: oqUeYJ
version_id: nWT2Lbb
url: https://semgrep.dev/playground/r/nWT2Lbb/python.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphers
origin: community
languages:
- python
severity: WARNING
- id: python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp
message: Detected an unsecured transmission channel. 'OpenerDirector.open(...)'
is being used with 'ftp://'. Information sent over this connection will be unencrypted.
Consider using SFTP instead. urllib does not support SFTP, so consider a library
which supports SFTP.
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
references:
- https://docs.python.org/3/library/urllib.request.html#urllib.request.OpenerDirector.open
category: security
technology:
- urllib
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp
shortlink: https://sg.run/Klj7
semgrep.dev:
rule:
r_id: 9655
rv_id: 1263488
rule_id: zdUkPQ
version_id: ExTExLl
url: https://semgrep.dev/playground/r/ExTExLl/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp
origin: community
severity: WARNING
languages:
- python
pattern-either:
- pattern: urllib.request.OpenerDirector(...).open("=~/^[Ff][Tt][Pp]://.*/", ...)
- patterns:
- pattern-inside: |
$OPENERDIRECTOR = urllib.request.OpenerDirector(...)
...
- pattern: $OPENERDIRECTOR.open("=~/^[Ff][Tt][Pp]://.*/", ...)
- patterns:
- pattern-inside: |
$OPENERDIRECTOR = urllib.request.OpenerDirector(...)
...
- pattern: |
$URL = "=~/^[Ff][Tt][Pp]://.*/"
...
$OPENERDIRECTOR.open($URL, ...)
- pattern: |
$URL = "=~/^[Ff][Tt][Pp]://.*/"
...
urllib.request.OpenerDirector(...).open($URL, ...)
- patterns:
- pattern-inside: |
def $FUNC(..., $URL = "=~/^[Ff][Tt][Pp]://.*/", ...):
...
- pattern-either:
- pattern: urllib.request.OpenerDirector(...).open($URL, ...)
- patterns:
- pattern-inside: |
$OPENERDIRECTOR = urllib.request.OpenerDirector(...)
...
- pattern: $OPENERDIRECTOR.open($URL, ...)
- id: python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open
message: Detected an unsecured transmission channel. 'OpenerDirector.open(...)'
is being used with 'http://'. Use 'https://' instead to secure the channel.
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
references:
- https://docs.python.org/3/library/urllib.request.html#urllib.request.OpenerDirector.open
category: security
technology:
- urllib
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open
shortlink: https://sg.run/qxKz
semgrep.dev:
rule:
r_id: 9656
rv_id: 1263489
rule_id: pKUO9Q
version_id: 7ZTE3ld
url: https://semgrep.dev/playground/r/7ZTE3ld/python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open.insecure-openerdirector-open
origin: community
severity: WARNING
languages:
- python
fix-regex:
regex: '[Hh][Tt][Tt][Pp]://'
replacement: https://
count: 1
pattern-either:
- pattern: urllib.request.OpenerDirector(...).open("=~/[Hh][Tt][Tt][Pp]://.*/",
...)
- patterns:
- pattern-inside: |
$OPENERDIRECTOR = urllib.request.OpenerDirector(...)
...
- pattern: $OPENERDIRECTOR.open("=~/[Hh][Tt][Tt][Pp]://.*/", ...)
- patterns:
- pattern-inside: |
$OPENERDIRECTOR = urllib.request.OpenerDirector(...)
...
- pattern: |
$URL = "=~/[Hh][Tt][Tt][Pp]://.*/"
...
$OPENERDIRECTOR.open($URL, ...)
- pattern: |
$URL = "=~/[Hh][Tt][Tt][Pp]://.*/"
...
urllib.request.OpenerDirector(...).open($URL, ...)
- patterns:
- pattern-inside: |
def $FUNC(..., $URL = "=~/[Hh][Tt][Tt][Pp]://.*/", ...):
...
- pattern-either:
- pattern: urllib.request.OpenerDirector(...).open($URL, ...)
- patterns:
- pattern-inside: |
$OPENERDIRECTOR = urllib.request.OpenerDirector(...)
...
- pattern: $OPENERDIRECTOR.open($URL, ...)
- id: python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp
message: Detected a 'urllib.request.Request()' object using an insecure transport
protocol, 'ftp://'. This connection will not be encrypted. Consider using SFTP
instead. urllib does not support SFTP natively, so consider using a library which
supports SFTP.
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
references:
- https://docs.python.org/3/library/urllib.request.html#urllib.request.Request
category: security
technology:
- urllib
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp
shortlink: https://sg.run/l2Py
semgrep.dev:
rule:
r_id: 9657
rv_id: 1263490
rule_id: 2ZUbWA
version_id: LjTkgWZ
url: https://semgrep.dev/playground/r/LjTkgWZ/python.lang.security.audit.insecure-transport.urllib.insecure-request-object-ftp.insecure-request-object-ftp
origin: community
severity: WARNING
languages:
- python
pattern-either:
- pattern: urllib.request.Request("=~/^[Ff][Tt][Pp]://.*/", ...)
- pattern: |
$URL = "=~/^[Ff][Tt][Pp]://.*/"
...
urllib.request.Request($URL, ...)
- pattern: |-
def $FUNC(..., $URL = "=~/^[Ff][Tt][Pp]://.*/", ...):
...
urllib.request.Request($URL, ...)
- id: python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object
message: Detected a 'urllib.request.Request()' object using an insecure transport
protocol, 'http://'. This connection will not be encrypted. Use 'https://' instead.
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
references:
- https://docs.python.org/3/library/urllib.request.html#urllib.request.Request
category: security
technology:
- urllib
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object
shortlink: https://sg.run/YvAe
semgrep.dev:
rule:
r_id: 9658
rv_id: 1263491
rule_id: X5U8Bp
version_id: 8KT5rJD
url: https://semgrep.dev/playground/r/8KT5rJD/python.lang.security.audit.insecure-transport.urllib.insecure-request-object.insecure-request-object
origin: community
severity: WARNING
languages:
- python
fix-regex:
regex: '[Hh][Tt][Tt][Pp]://'
replacement: https://
count: 1
pattern-either:
- pattern: urllib.request.Request("=~/[Hh][Tt][Tt][Pp]://.*/", ...)
- pattern: |
$URL = "=~/[Hh][Tt][Tt][Pp]://.*/"
...
urllib.request.Request($URL, ...)
- pattern: |
def $FUNC(..., $URL = "=~/[Hh][Tt][Tt][Pp]://.*/", ...):
...
urllib.request.Request($URL, ...)
- id: python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp
message: Detected 'urllib.urlopen()' using 'ftp://'. This request will not be encrypted.
Consider using SFTP instead. urllib does not support SFTP, so consider switching
to a library which supports SFTP.
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
references:
- https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen
category: security
technology:
- urllib
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp
shortlink: https://sg.run/6n1o
semgrep.dev:
rule:
r_id: 9659
rv_id: 1263492
rule_id: j2UvOG
version_id: gETB7RN
url: https://semgrep.dev/playground/r/gETB7RN/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp
origin: community
severity: WARNING
languages:
- python
pattern-either:
- pattern: urllib.request.urlopen("=~/^[Ff][Tt][Pp]://.*/", ...)
- pattern: |
$URL = "=~/^[Ff][Tt][Pp]://.*/"
...
urllib.request.urlopen($URL, ...)
- pattern: |-
def $FUNC(..., $URL = "=~/^[Ff][Tt][Pp]://.*/", ...):
...
urllib.request.urlopen($URL, ...)
- id: python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen
message: Detected 'urllib.urlopen()' using 'http://'. This request will not be encrypted.
Use 'https://' instead.
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
references:
- https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen
category: security
technology:
- urllib
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen
shortlink: https://sg.run/oxB9
semgrep.dev:
rule:
r_id: 9660
rv_id: 1263493
rule_id: 10UKgW
version_id: QkTGqYe
url: https://semgrep.dev/playground/r/QkTGqYe/python.lang.security.audit.insecure-transport.urllib.insecure-urlopen.insecure-urlopen
origin: community
severity: WARNING
languages:
- python
fix-regex:
regex: '[Hh][Tt][Tt][Pp]://'
replacement: https://
pattern-either:
- pattern: urllib.request.urlopen("=~/[Hh][Tt][Tt][Pp]://.*/", ...)
- pattern: |
$URL = "=~/[Hh][Tt][Tt][Pp]://.*/"
...
urllib.request.urlopen($URL, ...)
- pattern: |
def $FUNC(..., $URL = "=~/[Hh][Tt][Tt][Pp]://.*/", ...):
...
urllib.request.urlopen($URL, ...)
- id: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp
message: Detected an insecure transmission channel. 'URLopener.open(...)' is being
used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider
using a library which supports SFTP.
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
references:
- https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.open
category: security
technology:
- urllib
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp
shortlink: https://sg.run/zvwG
semgrep.dev:
rule:
r_id: 9661
rv_id: 1263494
rule_id: 9AU1DY
version_id: 3ZT4XGA
url: https://semgrep.dev/playground/r/3ZT4XGA/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp
origin: community
severity: WARNING
languages:
- python
pattern-either:
- pattern: urllib.request.URLopener(...).open("=~/[Ff][Tt][Pp]://.*/", ...)
- patterns:
- pattern-inside: |
$OPENERDIRECTOR = urllib.request.URLopener(...)
...
- pattern: $OPENERDIRECTOR.open("=~/[Ff][Tt][Pp]://.*/", ...)
- patterns:
- pattern-inside: |
$OPENERDIRECTOR = urllib.request.URLopener(...)
...
- pattern: |
$URL = "=~/[Ff][Tt][Pp]://.*/"
...
$OPENERDIRECTOR.open($URL, ...)
- pattern: |
$URL = "=~/[Ff][Tt][Pp]://.*/"
...
urllib.request.URLopener(...).open($URL, ...)
- patterns:
- pattern-inside: |
def $FUNC(..., $URL = "=~/[Ff][Tt][Pp]://.*/", ...):
...
- pattern-either:
- pattern: urllib.request.URLopener(...).open($URL, ...)
- patterns:
- pattern-inside: |
$OPENERDIRECTOR = urllib.request.URLopener(...)
...
- pattern: $OPENERDIRECTOR.open($URL, ...)
- id: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open
message: Detected an unsecured transmission channel. 'URLopener.open(...)' is being
used with 'http://'. Use 'https://' instead to secure the channel.
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
references:
- https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.open
category: security
technology:
- urllib
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open
shortlink: https://sg.run/pxWg
semgrep.dev:
rule:
r_id: 9662
rv_id: 1263495
rule_id: yyUnwW
version_id: 44TEjLq
url: https://semgrep.dev/playground/r/44TEjLq/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open.insecure-urlopener-open
origin: community
severity: WARNING
languages:
- python
fix-regex:
regex: '[Hh][Tt][Tt][Pp]://'
replacement: https://
count: 1
pattern-either:
- pattern: urllib.request.URLopener(...).open("=~/[Hh][Tt][Tt][Pp]://.*/", ...)
- patterns:
- pattern-inside: |
$OPENERDIRECTOR = urllib.request.URLopener(...)
...
- pattern: $OPENERDIRECTOR.open("=~/[Hh][Tt][Tt][Pp]://.*/", ...)
- patterns:
- pattern-inside: |
$OPENERDIRECTOR = urllib.request.URLopener(...)
...
- pattern: |
$URL = "=~/[Hh][Tt][Tt][Pp]://.*/"
...
$OPENERDIRECTOR.open($URL, ...)
- pattern: |
$URL = "=~/[Hh][Tt][Tt][Pp]://.*/"
...
urllib.request.URLopener(...).open($URL, ...)
- patterns:
- pattern-inside: |
def $FUNC(..., $URL = "=~/[Hh][Tt][Tt][Pp]://.*/", ...):
...
- pattern-either:
- pattern: urllib.request.URLopener(...).open($URL, ...)
- patterns:
- pattern-inside: |
$OPENERDIRECTOR = urllib.request.URLopener(...)
...
- pattern: $OPENERDIRECTOR.open($URL, ...)
- id: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp
message: Detected an insecure transmission channel. 'URLopener.retrieve(...)' is
being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider
using a library which supports SFTP.
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
references:
- https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.retrieve
category: security
technology:
- urllib
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp
shortlink: https://sg.run/2xY0
semgrep.dev:
rule:
r_id: 9663
rv_id: 1263496
rule_id: r6UrPp
version_id: PkTR3l3
url: https://semgrep.dev/playground/r/PkTR3l3/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve-ftp.insecure-urlopener-retrieve-ftp
origin: community
severity: WARNING
languages:
- python
pattern-either:
- pattern: urllib.request.URLopener(...).retrieve("=~/[Ff][Tt][Pp]://.*/", ...)
- patterns:
- pattern-inside: |
$OPENERDIRECTOR = urllib.request.URLopener(...)
...
- pattern: $OPENERDIRECTOR.retrieve("=~/[Ff][Tt][Pp]://.*/", ...)
- patterns:
- pattern-inside: |
$OPENERDIRECTOR = urllib.request.URLopener(...)
...
- pattern: |
$URL = "=~/[Ff][Tt][Pp]://.*/"
...
$OPENERDIRECTOR.retrieve($URL, ...)
- pattern: |
$URL = "=~/[Ff][Tt][Pp]://.*/"
...
urllib.request.URLopener(...).retrieve($URL, ...)
- patterns:
- pattern-inside: |
def $FUNC(..., $URL = "=~/[Ff][Tt][Pp]://.*/", ...):
...
- pattern-either:
- pattern: urllib.request.URLopener(...).retrieve($URL, ...)
- patterns:
- pattern-inside: |
$OPENERDIRECTOR = urllib.request.URLopener(...)
...
- pattern: $OPENERDIRECTOR.retrieve($URL, ...)
- id: python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve
message: Detected an unsecured transmission channel. 'URLopener.retrieve(...)' is
being used with 'http://'. Use 'https://' instead to secure the channel.
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
references:
- https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.retrieve
category: security
technology:
- urllib
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve
shortlink: https://sg.run/XBGK
semgrep.dev:
rule:
r_id: 9664
rv_id: 1263497
rule_id: bwUw0n
version_id: JdTzxBj
url: https://semgrep.dev/playground/r/JdTzxBj/python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-retrieve.insecure-urlopener-retrieve
origin: community
severity: WARNING
languages:
- python
fix-regex:
regex: '[Hh][Tt][Tt][Pp]://'
replacement: https://
count: 1
pattern-either:
- pattern: urllib.request.URLopener(...).retrieve("=~/[Hh][Tt][Tt][Pp]://.*/", ...)
- patterns:
- pattern-inside: |
$OPENERDIRECTOR = urllib.request.URLopener(...)
...
- pattern: $OPENERDIRECTOR.retrieve("=~/[Hh][Tt][Tt][Pp]://.*/", ...)
- patterns:
- pattern-inside: |
$OPENERDIRECTOR = urllib.request.URLopener(...)
...
- pattern: |
$URL = "=~/[Hh][Tt][Tt][Pp]://.*/"
...
$OPENERDIRECTOR.retrieve($URL, ...)
- pattern: |
$URL = "=~/[Hh][Tt][Tt][Pp]://.*/"
...
urllib.request.URLopener(...).retrieve($URL, ...)
- patterns:
- pattern-inside: |
def $FUNC(..., $URL = "=~/[Hh][Tt][Tt][Pp]://.*/", ...):
...
- pattern-either:
- pattern: urllib.request.URLopener(...).retrieve($URL, ...)
- patterns:
- pattern-inside: |
$OPENERDIRECTOR = urllib.request.URLopener(...)
...
- pattern: $OPENERDIRECTOR.retrieve($URL, ...)
- id: python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp
message: Detected 'urllib.urlretrieve()' using 'ftp://'. This request will not be
encrypted. Use SFTP instead. urllib does not support SFTP, so consider switching
to a library which supports SFTP.
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
references:
- https://docs.python.org/3/library/urllib.request.html#urllib.request.urlretrieve
category: security
technology:
- urllib
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp
shortlink: https://sg.run/jR8Y
semgrep.dev:
rule:
r_id: 9665
rv_id: 1263498
rule_id: NbUknL
version_id: 5PTo1Rw
url: https://semgrep.dev/playground/r/5PTo1Rw/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve-ftp.insecure-urlretrieve-ftp
origin: community
severity: WARNING
languages:
- python
pattern-either:
- pattern: urllib.request.urlretrieve("=~/^[Ff][Tt][Pp]://.*/", ...)
- pattern: |
$URL = "=~/^[Ff][Tt][Pp]://.*/"
...
urllib.request.urlretrieve($URL, ...)
- pattern: |-
def $FUNC(..., $URL = "=~/^[Ff][Tt][Pp]://.*/", ...):
...
urllib.request.urlretrieve($URL, ...)
- id: python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve
message: Detected 'urllib.urlretrieve()' using 'http://'. This request will not
be encrypted. Use 'https://' instead.
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
references:
- https://docs.python.org/3/library/urllib.request.html#urllib.request.urlretrieve
category: security
technology:
- urllib
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve
shortlink: https://sg.run/1Zqw
semgrep.dev:
rule:
r_id: 9666
rv_id: 1263499
rule_id: kxUk4N
version_id: GxTkenQ
url: https://semgrep.dev/playground/r/GxTkenQ/python.lang.security.audit.insecure-transport.urllib.insecure-urlretrieve.insecure-urlretrieve
origin: community
severity: WARNING
languages:
- python
fix-regex:
regex: '[Hh][Tt][Tt][Pp]://'
replacement: https://
pattern-either:
- pattern: urllib.request.urlretrieve("=~/[Hh][Tt][Tt][Pp]://.*/", ...)
- pattern: |
$URL = "=~/[Hh][Tt][Tt][Pp]://.*/"
...
urllib.request.urlretrieve($URL, ...)
- pattern: |
def $FUNC(..., $URL = "=~/[Hh][Tt][Tt][Pp]://.*/", ...):
...
urllib.request.urlretrieve($URL, ...)
- id: python.lang.security.audit.logging.listeneval.listen-eval
languages:
- python
message: Because portions of the logging configuration are passed through eval(),
use of this function may open its users to a security risk. While the function
only binds to a socket on localhost, and so does not accept connections from remote
machines, there are scenarios where untrusted code could be run under the account
of the process which calls listen(). To avoid this happening, use the `verify()`
argument to `listen()` to prevent unrecognized configurations.
metadata:
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.python.org/3/library/logging.config.html?highlight=security#logging.config.listen
category: security
technology:
- python
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/python.lang.security.audit.logging.listeneval.listen-eval
shortlink: https://sg.run/9okY
semgrep.dev:
rule:
r_id: 9667
rv_id: 1263500
rule_id: wdUJQY
version_id: RGT0L6X
url: https://semgrep.dev/playground/r/RGT0L6X/python.lang.security.audit.logging.listeneval.listen-eval
origin: community
severity: WARNING
pattern: logging.config.listen(...)
- id: python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure
patterns:
- pattern: |
$LOGGER_OBJ.$LOGGER_CALL($FORMAT_STRING,...)
- metavariable-regex:
metavariable: $LOGGER_OBJ
regex: (?i)(_logger|logger|self.logger|log)
- metavariable-regex:
metavariable: $LOGGER_CALL
regex: (debug|info|warn|warning|error|exception|critical)
- metavariable-regex:
metavariable: $FORMAT_STRING
regex: (?i).*(api.key|secret|credential|token|password).*\%s.*
message: Detected a python logger call with a potential hardcoded secret $FORMAT_STRING
being logged. This may lead to secret credentials being exposed. Make sure that
the logger is not logging sensitive information.
severity: WARNING
languages:
- python
metadata:
cwe:
- 'CWE-532: Insertion of Sensitive Information into Log File'
category: security
technology:
- python
owasp:
- A09:2021 - Security Logging and Monitoring Failures
- A09:2025 - Security Logging & Alerting Failures
references:
- https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure
shortlink: https://sg.run/ydNx
semgrep.dev:
rule:
r_id: 9668
rv_id: 1263501
rule_id: x8UnJk
version_id: A8TgdOR
url: https://semgrep.dev/playground/r/A8TgdOR/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure
origin: community
- id: python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces
message: Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose
the server publicly as it binds to all available interfaces. Consider instead
getting correct address from an environment variable or configuration file.
metadata:
cwe:
- 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
category: security
technology:
- python
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces
shortlink: https://sg.run/rdln
semgrep.dev:
rule:
r_id: 9669
rv_id: 1263505
rule_id: OrU3og
version_id: 0bTKzDL
url: https://semgrep.dev/playground/r/0bTKzDL/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces
origin: community
languages:
- python
severity: INFO
pattern-either:
- pattern: |
$S = socket.socket(...)
...
$S.bind(("0.0.0.0", ...))
- pattern: |
$S = socket.socket(...)
...
$S.bind(("::", ...))
- pattern: |
$S = socket.socket(...)
...
$S.bind(("", ...))
- id: python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation
patterns:
- pattern-either:
- pattern: urllib3.PoolManager(..., cert_reqs=$REQS, ...)
- pattern: urllib3.ProxyManager(..., cert_reqs=$REQS, ...)
- pattern: urllib3.HTTPSConnectionPool(..., cert_reqs=$REQS, ...)
- pattern: urllib3.connectionpool.HTTPSConnectionPool(..., cert_reqs=$REQS, ...)
- pattern: urllib3.connection_from_url(..., cert_reqs=$REQS, ...)
- pattern: urllib3.proxy_from_url(..., cert_reqs=$REQS, ...)
- pattern: $CONTEXT.wrap_socket(..., cert_reqs=$REQS, ...)
- pattern: ssl.wrap_socket(..., cert_reqs=$REQS, ...)
- metavariable-regex:
metavariable: $REQS
regex: (NONE|CERT_NONE|CERT_OPTIONAL|ssl\.CERT_NONE|ssl\.CERT_OPTIONAL|\'NONE\'|\"NONE\"|\'OPTIONAL\'|\"OPTIONAL\")
message: certificate verification explicitly disabled, insecure connections possible
metadata:
cwe:
- 'CWE-295: Improper Certificate Validation'
owasp:
- A03:2017 - Sensitive Data Exposure
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
category: security
technology:
- python
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation
shortlink: https://sg.run/b7yp
semgrep.dev:
rule:
r_id: 9670
rv_id: 1263506
rule_id: eqU87k
version_id: K3TKkZn
url: https://semgrep.dev/playground/r/K3TKkZn/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation
origin: community
languages:
- python
severity: ERROR
- id: python.lang.security.audit.network.http-not-https-connection.http-not-https-connection
message: Detected HTTPConnectionPool. This will transmit data in cleartext. It is
recommended to use HTTPSConnectionPool instead for to encrypt communications.
metadata:
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://urllib3.readthedocs.io/en/1.2.1/pools.html#urllib3.connectionpool.HTTPSConnectionPool
category: security
technology:
- python
subcategory:
- audit
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection
shortlink: https://sg.run/N4Np
semgrep.dev:
rule:
r_id: 9671
rv_id: 1263507
rule_id: v8UnWQ
version_id: qkTR7E1
url: https://semgrep.dev/playground/r/qkTR7E1/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection
origin: community
languages:
- python
severity: ERROR
pattern-either:
- pattern: urllib3.HTTPConnectionPool(...)
- pattern: urllib3.connectionpool.HTTPConnectionPool(...)
- id: python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command
patterns:
- pattern-inside: |
$CLIENT = paramiko.client.SSHClient(...)
...
- pattern: $CLIENT.exec_command(...)
- pattern-not: $CLIENT.exec_command("...", ...)
message: Unverified SSL context detected. This will permit insecure connections
without verifying SSL certificates. Use 'ssl.create_default_context()' instead.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/plugins/injection_paramiko.py
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
references:
- http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.SSHClient.exec_command
- https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/plugins/injection_paramiko.py
category: security
technology:
- paramiko
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command
shortlink: https://sg.run/kXQ7
semgrep.dev:
rule:
r_id: 9672
rv_id: 1263509
rule_id: d8Uj9x
version_id: YDTZeBr
url: https://semgrep.dev/playground/r/YDTZeBr/python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command
origin: community
severity: ERROR
languages:
- python
- id: python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load
metadata:
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
references:
- https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation
- https://nvd.nist.gov/vuln/detail/CVE-2017-18342
category: security
technology:
- pyyaml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load
shortlink: https://sg.run/we9Y
semgrep.dev:
rule:
r_id: 9673
rv_id: 1263530
rule_id: ZqU5jZ
version_id: 1QTyprw
url: https://semgrep.dev/playground/r/1QTyprw/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load
origin: community
languages:
- python
message: Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`,
`yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe
methods of deserializing YAML. An attacker with control over the YAML input could
create special YAML input that allows the attacker to run arbitrary Python code.
This would allow the attacker to steal files, download and install malware, or
otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead.
fix-regex:
regex: unsafe_load
replacement: safe_load
count: 1
severity: ERROR
patterns:
- pattern-inside: |
import yaml
...
- pattern-not-inside: |
$YAML = ruamel.yaml.YAML(...)
...
- pattern-either:
- pattern: yaml.unsafe_load(...)
- pattern: yaml.load(..., Loader=yaml.Loader, ...)
- pattern: yaml.load(..., Loader=yaml.UnsafeLoader, ...)
- pattern: yaml.load(..., Loader=yaml.CLoader, ...)
- pattern: yaml.load_all(..., Loader=yaml.Loader, ...)
- pattern: yaml.load_all(..., Loader=yaml.UnsafeLoader, ...)
- pattern: yaml.load_all(..., Loader=yaml.CLoader, ...)
- id: python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel
metadata:
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
references:
- https://yaml.readthedocs.io/en/latest/basicuse.html?highlight=typ
category: security
technology:
- ruamel.yaml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel
shortlink: https://sg.run/x1rz
semgrep.dev:
rule:
r_id: 9674
rv_id: 1263531
rule_id: nJUzqK
version_id: 9lT4bvG
url: https://semgrep.dev/playground/r/9lT4bvG/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel
origin: community
languages:
- python
message: Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create
arbitrary Python objects. A malicious actor could exploit this to run arbitrary
code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead.
severity: ERROR
pattern-either:
- pattern: ruamel.yaml.YAML(..., typ='unsafe', ...)
- pattern: ruamel.yaml.YAML(..., typ='base', ...)
- id: python.lang.security.deserialization.pickle.avoid-pickle
metadata:
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
references:
- https://docs.python.org/3/library/pickle.html
category: security
technology:
- python
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-pickle
shortlink: https://sg.run/OPwB
semgrep.dev:
rule:
r_id: 9675
rv_id: 1263532
rule_id: EwU2BJ
version_id: yeTxpEE
url: https://semgrep.dev/playground/r/yeTxpEE/python.lang.security.deserialization.pickle.avoid-pickle
origin: community
languages:
- python
message: Avoid using `pickle`, which is known to lead to code execution vulnerabilities.
When unpickling, the serialized data could be manipulated to run arbitrary code.
Instead, consider serializing the relevant data as JSON or a similar text-based
serialization format.
severity: WARNING
patterns:
- pattern-either:
- pattern: pickle.$FUNC(...)
- pattern: _pickle.$FUNC(...)
- pattern-not: pickle.$FUNC("...")
- pattern-not: _pickle.$FUNC("...")
- id: python.lang.security.deserialization.pickle.avoid-cPickle
metadata:
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
references:
- https://docs.python.org/3/library/pickle.html
category: security
technology:
- python
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-cPickle
shortlink: https://sg.run/eLxb
semgrep.dev:
rule:
r_id: 9676
rv_id: 1263533
rule_id: 7KUQNL
version_id: rxTAKEq
url: https://semgrep.dev/playground/r/rxTAKEq/python.lang.security.deserialization.pickle.avoid-cPickle
origin: community
languages:
- python
message: Avoid using `cPickle`, which is known to lead to code execution vulnerabilities.
When unpickling, the serialized data could be manipulated to run arbitrary code.
Instead, consider serializing the relevant data as JSON or a similar text-based
serialization format.
severity: WARNING
patterns:
- pattern: cPickle.$FUNC(...)
- pattern-not: cPickle.$FUNC("...")
- id: python.lang.security.deserialization.pickle.avoid-dill
metadata:
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
references:
- https://docs.python.org/3/library/pickle.html
category: security
technology:
- python
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-dill
shortlink: https://sg.run/vzjA
semgrep.dev:
rule:
r_id: 9677
rv_id: 1263534
rule_id: L1Uy60
version_id: bZT53np
url: https://semgrep.dev/playground/r/bZT53np/python.lang.security.deserialization.pickle.avoid-dill
origin: community
languages:
- python
message: Avoid using `dill`, which uses `pickle`, which is known to lead to code
execution vulnerabilities. When unpickling, the serialized data could be manipulated
to run arbitrary code. Instead, consider serializing the relevant data as JSON
or a similar text-based serialization format.
severity: WARNING
patterns:
- pattern: dill.$FUNC(...)
- pattern-not: dill.$FUNC("...")
- id: python.lang.security.deserialization.pickle.avoid-shelve
metadata:
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
references:
- https://docs.python.org/3/library/pickle.html
category: security
technology:
- python
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve
shortlink: https://sg.run/dKkZ
semgrep.dev:
rule:
r_id: 9678
rv_id: 1263535
rule_id: 8GUje2
version_id: NdTzyb4
url: https://semgrep.dev/playground/r/NdTzyb4/python.lang.security.deserialization.pickle.avoid-shelve
origin: community
languages:
- python
message: Avoid using `shelve`, which uses `pickle`, which is known to lead to code
execution vulnerabilities. When unpickling, the serialized data could be manipulated
to run arbitrary code. Instead, consider serializing the relevant data as JSON
or a similar text-based serialization format.
severity: WARNING
pattern: shelve.$FUNC(...)
- id: python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor
message: Detected XOR cipher algorithm which is considered insecure. This algorithm
is not cryptographically secure and can be reversed easily. Use AES instead.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
bandit-code: B304
references:
- https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption
category: security
technology:
- pycryptodome
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor
shortlink: https://sg.run/L0yr
semgrep.dev:
rule:
r_id: 9683
rv_id: 1263549
rule_id: PeUk5W
version_id: gETB7j3
url: https://semgrep.dev/playground/r/gETB7j3/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor
origin: community
severity: WARNING
languages:
- python
pattern-either:
- pattern: Cryptodome.Cipher.XOR.new(...)
- pattern: Crypto.Cipher.XOR.new(...)
- id: python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1
message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not
collision resistant and is therefore not suitable as a cryptographic signature.
Use SHA256 or SHA3 instead.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html
- https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability
- http://2012.sharcs.org/slides/stevens.pdf
- https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
category: security
technology:
- pycryptodome
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1
shortlink: https://sg.run/3ALr
semgrep.dev:
rule:
r_id: 9687
rv_id: 1263553
rule_id: ReUPO3
version_id: PkTR3vk
url: https://semgrep.dev/playground/r/PkTR3vk/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1
origin: community
severity: WARNING
languages:
- python
pattern-either:
- pattern: Crypto.Hash.SHA.new(...)
- pattern: Cryptodome.Hash.SHA.new (...)
- id: python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size
message: Detected an insufficient key size for DSA. NIST recommends a key size of
2048 or higher.
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py
references:
- https://www.pycryptodome.org/src/public_key/dsa
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf
category: security
technology:
- pycryptodome
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
functional-categories:
- crypto::search::key-length::pycryptodome
- crypto::search::key-length::pycryptodomex
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size
shortlink: https://sg.run/4y8l
semgrep.dev:
rule:
r_id: 9688
rv_id: 1263554
rule_id: AbUWje
version_id: JdTzxbQ
url: https://semgrep.dev/playground/r/JdTzxbQ/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size
origin: community
options:
symbolic_propagation: true
languages:
- python
severity: WARNING
patterns:
- pattern-either:
- pattern: Crypto.PublicKey.DSA.generate(..., bits=$SIZE, ...)
- pattern: Crypto.PublicKey.DSA.generate($SIZE, ...)
- pattern: Cryptodome.PublicKey.DSA.generate(..., bits=$SIZE, ...)
- pattern: Cryptodome.PublicKey.DSA.generate($SIZE, ...)
- metavariable-comparison:
metavariable: $SIZE
comparison: $SIZE < 2048
- id: python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size
message: Detected an insufficient key size for RSA. NIST recommends a key size of
3072 or higher.
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py
references:
- https://www.pycryptodome.org/src/public_key/rsa#rsa
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf
category: security
technology:
- pycryptodome
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
functional-categories:
- crypto::search::key-length::pycryptodome
- crypto::search::key-length::pycryptodomex
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size
shortlink: https://sg.run/PprY
semgrep.dev:
rule:
r_id: 9689
rv_id: 1263555
rule_id: BYUBWe
version_id: 5PTo1jL
url: https://semgrep.dev/playground/r/5PTo1jL/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size
origin: community
options:
symbolic_propagation: true
languages:
- python
severity: WARNING
patterns:
- pattern-either:
- pattern: Crypto.PublicKey.RSA.generate(..., bits=$SIZE, ...)
- pattern: Crypto.PublicKey.RSA.generate($SIZE, ...)
- pattern: Cryptodome.PublicKey.RSA.generate(..., bits=$SIZE, ...)
- pattern: Cryptodome.PublicKey.RSA.generate($SIZE, ...)
- metavariable-comparison:
metavariable: $SIZE
comparison: $SIZE < 3072
- id: python.requests.security.disabled-cert-validation.disabled-cert-validation
message: Certificate verification has been explicitly disabled. This permits insecure
connections to insecure servers. Re-enable certification validation.
metadata:
cwe:
- 'CWE-295: Improper Certificate Validation'
owasp:
- A03:2017 - Sensitive Data Exposure
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://stackoverflow.com/questions/41740361/is-it-safe-to-disable-ssl-certificate-verification-in-pythonss-requests-lib
category: security
technology:
- requests
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/python.requests.security.disabled-cert-validation.disabled-cert-validation
shortlink: https://sg.run/AlYp
semgrep.dev:
rule:
r_id: 9694
rv_id: 1263574
rule_id: qNUoYR
version_id: 1QTypBw
url: https://semgrep.dev/playground/r/1QTypBw/python.requests.security.disabled-cert-validation.disabled-cert-validation
origin: community
languages:
- python
severity: ERROR
pattern-either:
- pattern: requests.put(..., verify=False, ...)
- pattern: requests.patch(..., verify=False, ...)
- pattern: requests.delete(..., verify=False, ...)
- pattern: requests.head(..., verify=False, ...)
- pattern: requests.options(..., verify=False, ...)
- pattern: requests.request(..., verify=False, ...)
- pattern: requests.get(..., verify=False, ...)
- pattern: requests.post(..., verify=False, ...)
fix-regex:
regex: verify(\s)*=(\s)*False
replacement: verify=True
- id: python.requests.security.no-auth-over-http.no-auth-over-http
fix-regex:
regex: http:\/\/
replacement: https://
count: 1
message: Authentication detected over HTTP. HTTP does not provide any encryption
or protection for these authentication credentials. This may expose these credentials
to unauthorized parties. Use 'https://' instead.
metadata:
cwe:
- 'CWE-523: Unprotected Transport of Credentials'
owasp:
- A02:2017 - Broken Authentication
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://pypi.org/project/flake8-flask/
references:
- https://semgrep.dev/blog/2020/bento-check-no-auth-over-http/
- https://bento.dev/checks/requests/no-auth-over-http/
category: security
technology:
- requests
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/python.requests.security.no-auth-over-http.no-auth-over-http
shortlink: https://sg.run/B4NW
semgrep.dev:
rule:
r_id: 9695
rv_id: 1263575
rule_id: lBUdQZ
version_id: 9lT4b2G
url: https://semgrep.dev/playground/r/9lT4b2G/python.requests.security.no-auth-over-http.no-auth-over-http
origin: community
languages:
- python
severity: ERROR
pattern-either:
- pattern: requests.$W("=~/http:\/\/.*/", ..., auth=$X, ...)
- pattern: |
$URL = "=~/http:\/\/.../"
...
requests.$W($URL, ..., auth=$X, ...)
- id: python.sh.security.string-concat.string-concat
languages:
- python
severity: ERROR
message: Detected string concatenation or formatting in a call to a command via
'sh'. This could be a command injection vulnerability if the data is user-controlled.
Instead, use a list and append the argument.
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- sh
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.sh.security.string-concat.string-concat
shortlink: https://sg.run/Wg34
semgrep.dev:
rule:
r_id: 9697
rv_id: 1263576
rule_id: JDUP1G
version_id: yeTxp8E
url: https://semgrep.dev/playground/r/yeTxp8E/python.sh.security.string-concat.string-concat
origin: community
pattern-either:
- pattern: sh.$BIN($X + $Y)
- pattern: sh.$BIN($X.format(...))
- pattern: sh.$BIN(f"...{...}...")
- id: python.sqlalchemy.performance.performance-improvements.len-all-count
pattern: len($X.all())
message: Using QUERY.count() instead of len(QUERY.all()) sends less data to the
client since the SQLAlchemy method is performed server-side.
languages:
- python
severity: WARNING
metadata:
category: performance
technology:
- sqlalchemy
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.len-all-count
shortlink: https://sg.run/4y8g
semgrep.dev:
rule:
r_id: 9700
rv_id: 946449
rule_id: ReUPOw
version_id: ExTg2Gr
url: https://semgrep.dev/playground/r/ExTg2Gr/python.sqlalchemy.performance.performance-improvements.len-all-count
origin: community
- id: python.sqlalchemy.performance.performance-improvements.batch-import
pattern: |
for $X in $Y:
db.session.add($Z)
message: Rather than adding one element at a time, consider batch loading to improve
performance.
languages:
- python
severity: WARNING
metadata:
category: performance
technology:
- sqlalchemy
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.batch-import
shortlink: https://sg.run/PprN
semgrep.dev:
rule:
r_id: 9701
rv_id: 946450
rule_id: AbUWjy
version_id: 7ZTrQAb
url: https://semgrep.dev/playground/r/7ZTrQAb/python.sqlalchemy.performance.performance-improvements.batch-import
origin: community
- id: python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection
patterns:
- pattern-either:
- pattern: |
def $FUNC(...,$VAR,...):
...
$SESSION.query(...).$SQLFUNC("...".$FORMATFUNC(...,$VAR,...))
- pattern: |
def $FUNC(...,$VAR,...):
...
$SESSION.query.join(...).$SQLFUNC("...".$FORMATFUNC(...,$VAR,...))
- pattern: |
def $FUNC(...,$VAR,...):
...
$SESSION.query.$SQLFUNC("...".$FORMATFUNC(...,$VAR,...))
- pattern: |
def $FUNC(...,$VAR,...):
...
query.$SQLFUNC("...".$FORMATFUNC(...,$VAR,...))
- metavariable-regex:
metavariable: $SQLFUNC
regex: (group_by|order_by|distinct|having|filter)
- metavariable-regex:
metavariable: $FORMATFUNC
regex: (?!bindparams)
message: Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause
sql injections if the developer inputs raw SQL into the before-mentioned clauses.
This pattern captures relevant cases in which the developer inputs raw SQL into
the distinct, having, group_by, order_by or filter clauses and injects user-input
into the raw SQL with any function besides "bindparams". Use bindParams to securely
bind user-input to SQL statements.
fix-regex:
regex: format
replacement: bindparams
languages:
- python
severity: WARNING
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
category: security
technology:
- sqlalchemy
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection
shortlink: https://sg.run/J3Xo
semgrep.dev:
rule:
r_id: 9702
rv_id: 1263579
rule_id: BYUBWo
version_id: NdTzyL4
url: https://semgrep.dev/playground/r/NdTzyL4/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection
origin: community
- id: ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials
languages:
- ruby
metadata:
cwe:
- 'CWE-522: Insufficiently Protected Credentials'
owasp:
- A02:2017 - Broken Authentication
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
references:
- https://cwe.mitre.org/data/definitions/522.html
category: security
technology:
- jwt
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials
shortlink: https://sg.run/58Y6
semgrep.dev:
rule:
r_id: 9703
rv_id: 1263589
rule_id: DbUWdB
version_id: ExTExOn
url: https://semgrep.dev/playground/r/ExTExOn/ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials
origin: community
message: Password is exposed through JWT token payload. This is not encrypted and
the password could be compromised. Do not store passwords in JWT tokens.
patterns:
- pattern-inside: |
require 'jwt'
...
- pattern: |
$PAYLOAD = {...,password:...,...}
...
JWT.encode($PAYLOAD,...)
severity: ERROR
- id: ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret
message: 'Hardcoded JWT secret or private key is used. This is a Insufficiently
Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html
Consider using an appropriate security mechanism to protect the credentials (e.g.
keeping secrets in environment variables)'
metadata:
cwe:
- 'CWE-522: Insufficiently Protected Credentials'
owasp:
- A02:2017 - Broken Authentication
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
category: security
technology:
- jwt
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret
shortlink: https://sg.run/GW2B
semgrep.dev:
rule:
r_id: 9704
rv_id: 1263590
rule_id: WAUZz5
version_id: 7ZTE3d7
url: https://semgrep.dev/playground/r/7ZTE3d7/ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret
origin: community
patterns:
- pattern-inside: |
require 'jwt'
...
- pattern-either:
- pattern: |
JWT.encode($PAYLOAD,"...",...)
- pattern: |
JWT.decode($PAYLOAD,"...",...)
- pattern: |
JWT.encode($PAYLOAD,nil,...)
- pattern: |
JWT.decode($PAYLOAD,nil,...)
- pattern: |
$SECRET = "..."
...
JWT.encode($PAYLOAD,$SECRET,...)
- pattern: |
$SECRET = "..."
...
JWT.decode($PAYLOAD,$SECRET,...)
- pattern-not: |
JWT.encode($PAYLOAD, nil, ... , jwks: ..., ...)
- pattern-not: |
JWT.decode($PAYLOAD, nil, ..., jwks: ..., ...)
languages:
- ruby
severity: ERROR
- id: ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg
message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm
assumes the integrity of the token has already been verified. This would allow
a malicious actor to forge a JWT token that will automatically be verified. Do
not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
category: security
technology:
- jwt
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg
shortlink: https://sg.run/R8kE
semgrep.dev:
rule:
r_id: 9705
rv_id: 1263591
rule_id: 0oUExR
version_id: LjTkgO6
url: https://semgrep.dev/playground/r/LjTkgO6/ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg
origin: community
languages:
- ruby
severity: ERROR
patterns:
- pattern-inside: |
require 'jwt'
...
- pattern: |
JWT.encode($PAYLOAD, $SECRET, 'none', ...)
- id: ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify
message: Detected the decoding of a JWT token without a verify step. JWT tokens
must be verified before use, otherwise the token's integrity is unknown. This
means a malicious actor could forge a JWT token with any claims.
metadata:
cwe:
- 'CWE-345: Insufficient Verification of Data Authenticity'
owasp:
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
category: security
technology:
- jwt
references:
- https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify
shortlink: https://sg.run/AlYg
semgrep.dev:
rule:
r_id: 9706
rv_id: 1263587
rule_id: KxU426
version_id: ZRTKAnz
url: https://semgrep.dev/playground/r/ZRTKAnz/ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify
origin: community
languages:
- ruby
severity: WARNING
patterns:
- pattern-inside: |
require 'jwt'
...
- pattern: JWT.decode($PAYLOAD,$SECRET,false,...)
- id: ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data
message: The object is passed strictly to jsonwebtoken.sign(...) Make sure that
sensitive information is not exposed through JWT token payload.
severity: WARNING
metadata:
owasp:
- A02:2017 - Broken Authentication
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
cwe:
- 'CWE-522: Insufficiently Protected Credentials'
source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
category: security
technology:
- jwt
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data
shortlink: https://sg.run/B4Nb
semgrep.dev:
rule:
r_id: 9707
rv_id: 1263588
rule_id: qNUoYd
version_id: nWT2Lj6
url: https://semgrep.dev/playground/r/nWT2Lj6/ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data
origin: community
languages:
- ruby
patterns:
- pattern-inside: |
require 'jwt'
...
- pattern-inside: |
def $FUNC(...,$INPUT,...)
...
end
- pattern: |
JWT.encode($INPUT,...)
- id: ruby.lang.security.bad-deserialization.bad-deserialization
mode: taint
pattern-sources:
- pattern-either:
- pattern: params
- pattern: cookies
pattern-sinks:
- pattern-either:
- pattern: |
CSV.load(...)
- pattern: |
Marshal.load(...)
- pattern: |
Marshal.restore(...)
- pattern: |
Oj.object_load(...)
- pattern: |
Oj.load($X)
message: Checks for unsafe deserialization. Objects in Ruby can be serialized into
strings, then later loaded from strings. However, uses of load and object_load
can cause remote code execution. Loading user input with MARSHAL or CSV can potentially
be dangerous. Use JSON in a secure fashion instead.
metadata:
references:
- https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ
- https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb
category: security
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
technology:
- ruby
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/ruby.lang.security.bad-deserialization.bad-deserialization
shortlink: https://sg.run/DJj2
semgrep.dev:
rule:
r_id: 9708
rv_id: 1263595
rule_id: lBUdQg
version_id: 3ZT4Xqp
url: https://semgrep.dev/playground/r/3ZT4Xqp/ruby.lang.security.bad-deserialization.bad-deserialization
origin: community
languages:
- ruby
severity: ERROR
- id: ruby.lang.security.cookie-serialization.cookie-serialization
message: Checks if code allows cookies to be deserialized using Marshal. If the
attacker can craft a valid cookie, this could lead to remote code execution. The
hybrid check is just to warn users to migrate to :json for best practice.
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
references:
- https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_cookie_serialization.rb
- https://robertheaton.com/2013/07/22/how-to-hack-a-rails-app-using-its-secret-token/
category: security
technology:
- ruby
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/ruby.lang.security.cookie-serialization.cookie-serialization
shortlink: https://sg.run/Wg3y
semgrep.dev:
rule:
r_id: 9709
rv_id: 1263596
rule_id: YGUrq5
version_id: 44TEj4k
url: https://semgrep.dev/playground/r/44TEj4k/ruby.lang.security.cookie-serialization.cookie-serialization
origin: community
languages:
- ruby
severity: ERROR
pattern-either:
- pattern: |
Rails.application.config.action_dispatch.cookies_serializer = :marshal
- pattern: |
Rails.application.config.action_dispatch.cookies_serializer = :hybrid
- id: ruby.lang.security.create-with.create-with
patterns:
- pattern-not: |
$FUNC.create_with($PARAMSB.permit(...))
- pattern: |
$FUNC.create_with($PARAMSA)
message: Checks for strong parameter bypass through usage of create_with. Create_with
bypasses strong parameter protection, which could allow attackers to set arbitrary
attributes on models. To fix this vulnerability, either remove all create_with
calls or use the permit function to specify tags that are allowed to be set.
metadata:
cwe:
- 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object
Attributes'
references:
- https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_create_with.rb
- https://groups.google.com/g/rubyonrails-security/c/M4chq5Sb540/m/CC1Fh0Y_NWwJ
category: security
technology:
- ruby
owasp:
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mass Assignment
source: https://semgrep.dev/r/ruby.lang.security.create-with.create-with
shortlink: https://sg.run/0nLk
semgrep.dev:
rule:
r_id: 9710
rv_id: 1263597
rule_id: 6JUqbn
version_id: PkTR34k
url: https://semgrep.dev/playground/r/PkTR34k/ruby.lang.security.create-with.create-with
origin: community
languages:
- ruby
severity: ERROR
- id: ruby.lang.security.divide-by-zero.divide-by-zero
message: Detected a possible ZeroDivisionError.
metadata:
cwe:
- 'CWE-369: Divide By Zero'
references:
- https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_divide_by_zero.rb
category: security
technology:
- ruby
confidence: MEDIUM
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/ruby.lang.security.divide-by-zero.divide-by-zero
shortlink: https://sg.run/KWpP
semgrep.dev:
rule:
r_id: 9711
rv_id: 946476
rule_id: oqUzXA
version_id: BjT1NPZ
url: https://semgrep.dev/playground/r/BjT1NPZ/ruby.lang.security.divide-by-zero.divide-by-zero
origin: community
languages:
- ruby
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern: $VAR
- metavariable-regex:
metavariable: $VAR
regex: ^\d*(?!\.)$
pattern-sinks:
- patterns:
- pattern-inside: $NUMER / 0
- pattern: $NUMER
- id: ruby.lang.security.file-disclosure.file-disclosure
message: Special requests can determine whether a file exists on a filesystem that's
outside the Rails app's root directory. To fix this, set config.serve_static_assets
= false.
metadata:
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
references:
- https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_file_disclosure.rb
- https://groups.google.com/g/rubyonrails-security/c/23fiuwb1NBA/m/MQVM1-5GkPMJ
category: security
technology:
- ruby
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/ruby.lang.security.file-disclosure.file-disclosure
shortlink: https://sg.run/qrR1
semgrep.dev:
rule:
r_id: 9712
rv_id: 1263603
rule_id: zdUyqE
version_id: BjTkZq1
url: https://semgrep.dev/playground/r/BjTkZq1/ruby.lang.security.file-disclosure.file-disclosure
origin: community
languages:
- ruby
severity: ERROR
pattern: config.serve_static_assets = true
fix-regex:
regex: =(\s)*true
replacement: = false
- id: ruby.lang.security.force-ssl-false.force-ssl-false
message: Checks for configuration setting of force_ssl to false. Force_ssl forces
usage of HTTPS, which could lead to network interception of unencrypted application
traffic. To fix, set config.force_ssl = true.
metadata:
cwe:
- 'CWE-311: Missing Encryption of Sensitive Data'
references:
- https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_force_ssl.rb
category: security
technology:
- ruby
owasp:
- A03:2017 - Sensitive Data Exposure
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/ruby.lang.security.force-ssl-false.force-ssl-false
shortlink: https://sg.run/YgkW
semgrep.dev:
rule:
r_id: 9714
rv_id: 1263605
rule_id: 2ZU4lx
version_id: WrTqKB3
url: https://semgrep.dev/playground/r/WrTqKB3/ruby.lang.security.force-ssl-false.force-ssl-false
origin: community
languages:
- ruby
severity: WARNING
pattern: config.force_ssl = false
fix-regex:
regex: =\s*false
replacement: = true
- id: ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller
patterns:
- pattern-inside: |
class $CONTROLLER < ApplicationController
...
http_basic_authenticate_with ..., :password => "$SECRET", ...
end
- focus-metavariable: $SECRET
message: Detected hardcoded password used in basic authentication in a controller
class. Including this password in version control could expose this credential.
Consider refactoring to use environment variables or configuration files.
severity: WARNING
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/basic_auth/index.markdown
category: security
technology:
- ruby
- secrets
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller
shortlink: https://sg.run/6r0w
semgrep.dev:
rule:
r_id: 9715
rv_id: 1263606
rule_id: X5UZWK
version_id: 0bTKzNK
url: https://semgrep.dev/playground/r/0bTKzNK/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller
origin: community
languages:
- ruby
- id: ruby.lang.security.json-entity-escape.json-entity-escape
pattern-either:
- pattern: |
ActiveSupport.escape_html_entities_in_json = false
- pattern: |
config.active_support.escape_html_entities_in_json = false
message: Checks if HTML escaping is globally disabled for JSON output. This could
lead to XSS.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_json_entity_escape.rb
category: security
technology:
- ruby
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/ruby.lang.security.json-entity-escape.json-entity-escape
shortlink: https://sg.run/plr3
semgrep.dev:
rule:
r_id: 9718
rv_id: 1263609
rule_id: 9AUOQB
version_id: l4TJRko
url: https://semgrep.dev/playground/r/l4TJRko/ruby.lang.security.json-entity-escape.json-entity-escape
origin: community
languages:
- ruby
severity: WARNING
- id: ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled
pattern: $MODEL.new(params[...], ..., :without_protection => true, ...)
message: Mass assignment protection disabled for '$MODEL'. This could permit assignment
to sensitive model fields without intention. Instead, use 'attr_accessible' for
the model or disable mass assigment using 'config.active_record.whitelist_attributes
= true'. ':without_protection => true' must be removed for this to take effect.
metadata:
cwe:
- 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object
Attributes'
owasp:
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/mass_assignment/index.markdown
category: security
technology:
- ruby
references:
- https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mass Assignment
source: https://semgrep.dev/r/ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled
shortlink: https://sg.run/2byz
semgrep.dev:
rule:
r_id: 9719
rv_id: 1263610
rule_id: yyUvkJ
version_id: YDTZeW4
url: https://semgrep.dev/playground/r/YDTZeW4/ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled
origin: community
severity: WARNING
languages:
- ruby
- id: ruby.lang.security.missing-csrf-protection.missing-csrf-protection
patterns:
- pattern: |
class $CONTROLLER < ActionController::Base
...
end
- pattern-not: |
class $CONTROLLER < ActionController::Base
...
protect_from_forgery :with => :exception
end
- pattern-not: |
class $CONTROLLER < ActionController::Base
...
protect_from_forgery prepend: true, with: :exception
end
message: Detected controller which does not enable cross-site request forgery protections
using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to
your controller class.
severity: ERROR
metadata:
cwe:
- 'CWE-352: Cross-Site Request Forgery (CSRF)'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/cross-site_request_forgery/index.markdown
category: security
technology:
- ruby
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site Request Forgery (CSRF)
source: https://semgrep.dev/r/ruby.lang.security.missing-csrf-protection.missing-csrf-protection
shortlink: https://sg.run/XLel
semgrep.dev:
rule:
r_id: 9720
rv_id: 1263612
rule_id: r6UkO5
version_id: 5PTo1WY
url: https://semgrep.dev/playground/r/5PTo1WY/ruby.lang.security.missing-csrf-protection.missing-csrf-protection
origin: community
languages:
- ruby
- id: ruby.lang.security.model-attr-accessible.model-attr-accessible
message: 'Checks for dangerous permitted attributes that can lead to mass assignment
vulnerabilities. Query parameters allowed using permit and attr_accessible are
checked for allowance of dangerous attributes admin, banned, role, and account_id.
Also checks for usages of params.permit!, which allows everything. Fix: don''t
allow admin, banned, role, and account_id using permit or attr_accessible.'
metadata:
cwe:
- 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object
Attributes'
references:
- https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attr_accessible.rb
category: security
technology:
- ruby
owasp:
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mass Assignment
source: https://semgrep.dev/r/ruby.lang.security.model-attr-accessible.model-attr-accessible
shortlink: https://sg.run/jNrZ
semgrep.dev:
rule:
r_id: 9721
rv_id: 1263613
rule_id: bwUOAG
version_id: GxTkeN4
url: https://semgrep.dev/playground/r/GxTkeN4/ruby.lang.security.model-attr-accessible.model-attr-accessible
origin: community
languages:
- ruby
severity: ERROR
pattern-either:
- pattern: |
....permit(..., :admin, ...)
- pattern: |
....permit(..., :role, ...)
- pattern: |
....permit(..., :banned, ...)
- pattern: |
....permit(..., :account_id, ...)
- pattern: |
attr_accessible ..., :admin, ...
- pattern: |
attr_accessible ..., :role, ...
- pattern: |
attr_accessible ..., :banned, ...
- pattern: |
attr_accessible ..., :account_id, ...
- pattern: |
params.permit!
- id: ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible
patterns:
- pattern-not: |
class $CLASS < $TYPE
...
attr_accessible :$XXX
...
end
...
$CLASS.$FUNC(...)
- pattern: |
class $CLASS < $TYPE
...
end
...
$CLASS.$FUNC(...)
- metavariable-pattern:
metavariable: $TYPE
patterns:
- pattern-not-regex: (?i)(Error|Exception)
- focus-metavariable: $CLASS
message: Checks for models that do not use attr_accessible. This means there is
no limiting of which variables can be manipulated through mass assignment. For
newer Rails applications, parameters should be allowlisted using strong parameters.
For older Rails versions, they should be allowlisted using strong_attributes.
metadata:
references:
- https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attributes.rb
category: security
owasp:
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object
Attributes'
technology:
- rails
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mass Assignment
source: https://semgrep.dev/r/ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible
shortlink: https://sg.run/1nrb
semgrep.dev:
rule:
r_id: 9722
rv_id: 1263614
rule_id: NbUADO
version_id: RGT0LJd
url: https://semgrep.dev/playground/r/RGT0LJd/ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible
origin: community
languages:
- ruby
severity: ERROR
- id: ruby.lang.security.no-eval.ruby-eval
message: Use of eval with user-controllable input detected. This can lead to attackers
running arbitrary code. Ensure external data does not reach here, otherwise this
is a security vulnerability. Consider other ways to do this without eval.
severity: WARNING
metadata:
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
category: security
cwe2022-top25: true
cwe2021-top25: true
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_evaluation.rb
subcategory:
- vuln
technology:
- ruby
- rails
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/ruby.lang.security.no-eval.ruby-eval
shortlink: https://sg.run/bDwZ
semgrep.dev:
rule:
r_id: 9726
rv_id: 1263615
rule_id: OrUGNk
version_id: A8TgdDv
url: https://semgrep.dev/playground/r/A8TgdDv/ruby.lang.security.no-eval.ruby-eval
origin: community
languages:
- ruby
mode: taint
pattern-sources:
- pattern-either:
- pattern: params
- pattern: cookies
- patterns:
- pattern: |
RubyVM::InstructionSequence.compile(...)
- pattern-not: |
RubyVM::InstructionSequence.compile("...")
pattern-sinks:
- patterns:
- pattern-either:
- pattern: $X.eval
- pattern: $X.class_eval
- pattern: $X.instance_eval
- pattern: $X.module_eval
- pattern: $X.eval(...)
- pattern: $X.class_eval(...)
- pattern: $X.instance_eval(...)
- pattern: $X.module_eval(...)
- pattern: eval(...)
- pattern: class_eval(...)
- pattern: module_eval(...)
- pattern: instance_eval(...)
- pattern-not: $M("...",...)
- id: ruby.lang.security.no-send.bad-send
message: Checks for unsafe use of Object#send, try, __send__, and public_send. These
only account for unsafe use of a method, not target. This can lead to arbitrary
calling of exit, along with arbitrary code execution. Please be sure to sanitize
input in order to avoid this.
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
references:
- https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_send.rb
- https://the.igreque.info/posts/2016/01-object-send-considered-harmful-en.html
category: security
technology:
- ruby
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/ruby.lang.security.no-send.bad-send
shortlink: https://sg.run/Nrbx
semgrep.dev:
rule:
r_id: 9727
rv_id: 1263616
rule_id: eqUv0L
version_id: BjTkZqj
url: https://semgrep.dev/playground/r/BjTkZqj/ruby.lang.security.no-send.bad-send
origin: community
languages:
- ruby
severity: ERROR
pattern-either:
- pattern: |
$PARAM = params[...]
...
$RES = $MOD.send($PARAM.$FUNC)
- pattern: |
$PARAM = params[...]
...
$RES = $MOD.try($PARAM.$FUNC)
- pattern: |
$PARAM = params[...]
...
$RES = $MOD.__send__($PARAM.$FUNC)
- pattern: |-
$PARAM = params[...]
...
$RES = $MOD.public_send($PARAM.$FUNC)
- id: ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify
pattern: OpenSSL::SSL::VERIFY_NONE
message: Detected SSL that will accept an unverified connection. This makes the
connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER'
instead.
fix-regex:
regex: VERIFY_NONE
replacement: VERIFY_PEER
severity: WARNING
languages:
- ruby
metadata:
cwe:
- 'CWE-295: Improper Certificate Validation'
category: security
technology:
- ruby
owasp:
- A03:2017 - Sensitive Data Exposure
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify
shortlink: https://sg.run/kLxX
semgrep.dev:
rule:
r_id: 9728
rv_id: 1263617
rule_id: v8U5Yn
version_id: DkTRbl4
url: https://semgrep.dev/playground/r/DkTRbl4/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify
origin: community
- id: ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln
patterns:
- pattern-either:
- pattern: |
$MOD.new(params[$CODE])
- pattern: |
$MOD.new(..., params[$CODE], :without_protection => true, ...)
- pattern-not-inside: |
attr_accessible $VAR
...
$MOD.new(params[$CODE])
message: 'Checks for calls to without_protection during mass assignment (which allows
record creation from hash values). This can lead to users bypassing permissions
protections. For Rails 4 and higher, mass protection is on by default. Fix: Don''t
use :without_protection => true. Instead, configure attr_accessible to control
attribute access.'
metadata:
owasp:
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object
Attributes'
references:
- https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_without_protection.rb
- https://www.acunetix.com/vulnerabilities/web/rails-mass-assignment/
category: security
technology:
- ruby
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mass Assignment
source: https://semgrep.dev/r/ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln
shortlink: https://sg.run/xY8e
semgrep.dev:
rule:
r_id: 9730
rv_id: 1263618
rule_id: ZqUqQg
version_id: WrTqKBA
url: https://semgrep.dev/playground/r/WrTqKBA/ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln
origin: community
languages:
- ruby
severity: WARNING
- id: ruby.lang.security.weak-hashes-md5.weak-hashes-md5
message: Should not use md5 to generate hashes. md5 is proven to be vulnerable through
the use of brute-force attacks. Could also result in collisions, leading to potential
collision attacks. Use SHA256 or other hashing functions instead.
metadata:
cwe:
- 'CWE-328: Use of Weak Hash'
references:
- https://www.ibm.com/support/pages/security-bulletin-vulnerability-md5-signature-and-hash-algorithm-affects-sterling-integrator-and-sterling-file-gateway-cve-2015-7575
category: security
technology:
- ruby
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/ruby.lang.security.weak-hashes-md5.weak-hashes-md5
shortlink: https://sg.run/O1re
semgrep.dev:
rule:
r_id: 9731
rv_id: 1263619
rule_id: nJUYxZ
version_id: 0bTKzN8
url: https://semgrep.dev/playground/r/0bTKzN8/ruby.lang.security.weak-hashes-md5.weak-hashes-md5
origin: community
languages:
- ruby
severity: WARNING
pattern-either:
- pattern: Digest::MD5.base64digest $X
- pattern: Digest::MD5.hexdigest $X
- pattern: Digest::MD5.digest $X
- pattern: Digest::MD5.new
- pattern: OpenSSL::Digest::MD5.base64digest $X
- pattern: OpenSSL::Digest::MD5.hexdigest $X
- pattern: OpenSSL::Digest::MD5.digest $X
- pattern: OpenSSL::Digest::MD5.new
- id: ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1
message: Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision
by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing
functions instead.
metadata:
cwe:
- 'CWE-328: Use of Weak Hash'
references:
- https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html
- https://shattered.io/
category: security
technology:
- ruby
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1
shortlink: https://sg.run/e4qX
semgrep.dev:
rule:
r_id: 9732
rv_id: 1263620
rule_id: EwU4jq
version_id: K3TKkEZ
url: https://semgrep.dev/playground/r/K3TKkEZ/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1
origin: community
languages:
- ruby
severity: WARNING
pattern-either:
- pattern: Digest::SHA1.$FUNC
- pattern: OpenSSL::Digest::SHA1.$FUNC
- pattern: OpenSSL::HMAC.$FUNC("sha1",...)
- id: ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag
metadata:
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_content_tag.rb
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/template_injection/index.markdown
- https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/
category: security
technology:
- rails
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag
shortlink: https://sg.run/dg8P
semgrep.dev:
rule:
r_id: 9734
rv_id: 1263629
rule_id: L1U4qz
version_id: X0TzyDq
url: https://semgrep.dev/playground/r/X0TzyDq/ruby.rails.security.audit.xss.avoid-content-tag.avoid-content-tag
origin: community
message: '''content_tag()'' bypasses HTML escaping for some portion of the content.
If external data can reach here, this exposes your application to cross-site scripting
(XSS) attacks. Ensure no external data reaches here. If you must do this, create
your HTML manually and use ''html_safe''. Ensure no external data enters the HTML-safe
string!'
languages:
- ruby
severity: WARNING
pattern: content_tag(...)
- id: ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe
metadata:
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_cross_site_scripting.rb
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/cross_site_scripting/index.markdown
- https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/
category: security
technology:
- rails
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe
shortlink: https://sg.run/Zeq7
semgrep.dev:
rule:
r_id: 9735
rv_id: 1263631
rule_id: 8GUEQK
version_id: 1QTyp69
url: https://semgrep.dev/playground/r/1QTyp69/ruby.rails.security.audit.xss.avoid-html-safe.avoid-html-safe
origin: community
message: '''html_safe()'' does not make the supplied string safe. ''html_safe()''
bypasses HTML escaping. If external data can reach here, this exposes your application
to cross-site scripting (XSS) attacks. Ensure no external data reaches here.'
languages:
- ruby
severity: WARNING
pattern-either:
- pattern: $STR.html_safe
- pattern: $STR.html_safe.$MORE
- id: ruby.rails.security.audit.xss.avoid-raw.avoid-raw
metadata:
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_cross_site_scripting.rb
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://api.rubyonrails.org/classes/ActionView/Helpers/OutputSafetyHelper.html#method-i-raw
- https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/
category: security
technology:
- rails
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-raw.avoid-raw
shortlink: https://sg.run/nqJG
semgrep.dev:
rule:
r_id: 9736
rv_id: 1263633
rule_id: gxUW3x
version_id: yeTxplX
url: https://semgrep.dev/playground/r/yeTxplX/ruby.rails.security.audit.xss.avoid-raw.avoid-raw
origin: community
message: '''raw()'' bypasses HTML escaping. If external data can reach here, this
exposes your application to cross-site scripting (XSS) attacks. If you must do
this, construct individual strings and mark them as safe for HTML rendering with
`html_safe()`.'
languages:
- ruby
severity: WARNING
pattern: raw(...)
- id: ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline
metadata:
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_render_inline.rb
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#inline-renders---even-worse-than-xss
category: security
technology:
- rails
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline
shortlink: https://sg.run/E5w8
semgrep.dev:
rule:
r_id: 9737
rv_id: 1263636
rule_id: QrU6Ww
version_id: NdTzy4D
url: https://semgrep.dev/playground/r/NdTzy4D/ruby.rails.security.audit.xss.avoid-render-inline.avoid-render-inline
origin: community
message: '''render inline: ...'' renders an entire ERB template inline and is dangerous.
If external data can reach here, this exposes your application to server-side
template injection (SSTI) or cross-site scripting (XSS) attacks. Instead, consider
using a partial or another safe rendering method.'
languages:
- ruby
severity: WARNING
pattern: 'render inline: ...'
- id: ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text
metadata:
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_render_inline.rb
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#inline-renders---even-worse-than-xss
category: security
technology:
- rails
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text
shortlink: https://sg.run/70Kv
semgrep.dev:
rule:
r_id: 9738
rv_id: 1263637
rule_id: 3qUBk4
version_id: kbTzGJd
url: https://semgrep.dev/playground/r/kbTzGJd/ruby.rails.security.audit.xss.avoid-render-text.avoid-render-text
origin: community
message: '''render text: ...'' actually sets the content-type to ''text/html''.
If external data can reach here, this exposes your application to cross-site scripting
(XSS) attacks. Instead, use ''render plain: ...'' to render non-HTML text.'
languages:
- ruby
severity: WARNING
pattern: 'render text: ...'
fix-regex:
regex: 'text:'
replacement: 'plain:'
- id: ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation
metadata:
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_template_injection.rb
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/template_injection/index.markdown
category: security
technology:
- rails
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation
shortlink: https://sg.run/L01L
semgrep.dev:
rule:
r_id: 9739
rv_id: 1263638
rule_id: 4bUzR9
version_id: w8TRoY6
url: https://semgrep.dev/playground/r/w8TRoY6/ruby.rails.security.audit.xss.manual-template-creation.manual-template-creation
origin: community
message: Detected manual creation of an ERB template. Manual creation of templates
may expose your application to server-side template injection (SSTI) or cross-site
scripting (XSS) attacks if user input is used to create the template. Instead,
create a '.erb' template file and use 'render'.
languages:
- ruby
severity: WARNING
pattern: ERB.new(...)
- id: ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe
message: The syntax `<%== ... %>` is an alias for `html_safe`. This means the content
inside these tags will be rendered as raw HTML. This may expose your application
to cross-site scripting. If you need raw HTML, prefer using the more explicit
`html_safe` and be sure to correctly sanitize variables using a library such as
DOMPurify.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027
- https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===
category: security
technology:
- rails
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe
shortlink: https://sg.run/8nGJ
semgrep.dev:
rule:
r_id: 9740
rv_id: 1263639
rule_id: PeUkJe
version_id: xyTjz6A
url: https://semgrep.dev/playground/r/xyTjz6A/ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe
origin: community
languages:
- generic
paths:
include:
- '*.erb'
severity: WARNING
patterns:
- pattern: <%== ... %>
- pattern-not: <%== $...A.to_json %>
- id: ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag
message: '''content_tag'' exhibits unintuitive escaping behavior and may accidentally
expose your application to cross-site scripting. If using Rails 2, only attribute
values are escaped. If using Rails 3, content and attribute values are escaped.
Tag and attribute names are never escaped. Because of this, it is recommended
to use ''html_safe'' if you must render raw HTML data.'
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
source-rule-url: https://brakemanscanner.org/docs/warning_types/content_tag/
references:
- https://brakemanscanner.org/docs/warning_types/content_tag/
category: security
technology:
- rails
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag
shortlink: https://sg.run/gJxo
semgrep.dev:
rule:
r_id: 9741
rv_id: 1263640
rule_id: JDUPNG
version_id: O9Tpx13
url: https://semgrep.dev/playground/r/O9Tpx13/ruby.rails.security.audit.xss.templates.avoid-content-tag.avoid-content-tag
origin: community
languages:
- generic
paths:
include:
- '*.erb'
severity: WARNING
patterns:
- pattern-inside: <%= ... %>
- pattern: content_tag
- id: ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe
message: '''html_safe'' renders raw HTML. This means that normal HTML escaping is
bypassed. If user data can be controlled here, this exposes your application to
cross-site scripting (XSS). If you need to do this, be sure to correctly sanitize
the data using a library such as DOMPurify.'
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_cross_site_scripting.rb
references:
- https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===
- https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027
category: security
technology:
- rails
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe
shortlink: https://sg.run/Q8rD
semgrep.dev:
rule:
r_id: 9742
rv_id: 1263641
rule_id: 5rU4dE
version_id: e1TyjBv
url: https://semgrep.dev/playground/r/e1TyjBv/ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe
origin: community
languages:
- generic
paths:
include:
- '*.erb'
severity: WARNING
patterns:
- pattern-inside: <%= ... %>
- pattern: $SOMETHING.html_safe
- id: ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw
message: '''raw'' renders raw HTML, as the name implies. This means that normal
HTML escaping is bypassed. If user data can be controlled here, this exposes your
application to cross-site scripting (XSS). If you need to do this, be sure to
correctly sanitize the data using a library such as DOMPurify.'
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_cross_site_scripting.rb
references:
- https://stackoverflow.com/questions/4251284/raw-vs-html-safe-vs-h-to-unescape-html#:~:text===
- https://medium.com/sumone-technical-blog/a-pretty-way-to-unescape-html-in-a-ruby-on-rails-application-efc22b850027
category: security
technology:
- rails
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw
shortlink: https://sg.run/3Aqg
semgrep.dev:
rule:
r_id: 9743
rv_id: 1263642
rule_id: GdU0vJ
version_id: vdT06lj
url: https://semgrep.dev/playground/r/vdT06lj/ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw
origin: community
languages:
- generic
paths:
include:
- '*.erb'
severity: WARNING
patterns:
- pattern-inside: <%= ... %>
- pattern: raw
- id: ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute
message: 'Detected a unquoted template variable as an attribute. If unquoted, a
malicious actor could inject custom JavaScript handlers. To fix this, add quotes
around the template expression, like this: "<%= expr %>".'
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://brakemanpro.com/2017/09/08/cross-site-scripting-in-rails#unquoted-attributes
- https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss
category: security
technology:
- rails
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute
shortlink: https://sg.run/PpeN
semgrep.dev:
rule:
r_id: 9745
rv_id: 1263644
rule_id: AbUW9y
version_id: ZRTKAbG
url: https://semgrep.dev/playground/r/ZRTKAbG/ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute
origin: community
languages:
- generic
paths:
include:
- '*.erb'
severity: WARNING
patterns:
- pattern-inside: <$TAG ...>
- pattern-not-inside: ="..."
- pattern-not-inside: ="<%= ... %>"
- pattern-not-inside: ='...'
- pattern-not-inside: ='<%= ... %>'
- pattern: <%= ... %>
fix-regex:
regex: <%=(.*?)%>
replacement: '"<%=\1%>"'
- id: ruby.rails.security.audit.xss.templates.var-in-href.var-in-href
message: 'Detected a template variable used in an anchor tag with the ''href'' attribute.
This allows a malicious actor to input the ''javascript:'' URI and is subject
to cross- site scripting (XSS) attacks. If using a relative URL, start with a
literal forward slash and concatenate the URL, like this: href=''/<%= link =>''.
You may also consider setting the Content Security Policy (CSP) header.'
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI
- https://github.com/pugjs/pug/issues/2952
category: security
technology:
- rails
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.var-in-href.var-in-href
shortlink: https://sg.run/J3Do
semgrep.dev:
rule:
r_id: 9746
rv_id: 1263645
rule_id: BYUBXo
version_id: nWT2L3y
url: https://semgrep.dev/playground/r/nWT2L3y/ruby.rails.security.audit.xss.templates.var-in-href.var-in-href
origin: community
languages:
- generic
paths:
include:
- '*.erb'
severity: WARNING
pattern-either:
- pattern: <a ... href = "<%= ... %>" ... >
- pattern: <a ... href = '<%= ... %>' ... >
- id: ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag
message: Detected a template variable used in a script tag. Although template variables
are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS)
attacks when used directly in JavaScript. If you need to do this, use `escape_javascript`
or its alias, `j`. However, this will not protect from XSS in all circumstances;
see the references for more information. Consider placing this value in the HTML
portion (outside of a script tag).
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/
- https://www.youtube.com/watch?v=yYTkLUEdIyE
- https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough
category: security
technology:
- rails
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag
shortlink: https://sg.run/58r6
semgrep.dev:
rule:
r_id: 9747
rv_id: 1263646
rule_id: DbUW6B
version_id: ExTExZ1
url: https://semgrep.dev/playground/r/ExTExZ1/ruby.rails.security.audit.xss.templates.var-in-script-tag.var-in-script-tag
origin: community
languages:
- generic
paths:
include:
- '*.erb'
severity: WARNING
patterns:
- pattern-inside: <script ...> ... </script>
- pattern-not: <%= j ... >
- pattern-not: <%= escape_javascript ... >
- pattern: <%= ... >
- id: terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push
patterns:
- pattern: resource
- pattern-not-inside: |
resource "aws_ecr_repository" "..." {
...
image_scanning_configuration {
...
scan_on_push=true
...
}
...
}
- pattern-inside: |
resource "aws_ecr_repository" "..." {
...
}
languages:
- hcl
message: The ECR Repository isn't configured to scan images on push
severity: WARNING
metadata:
cwe:
- 'CWE-1104: Use of Unmaintained Third Party Components'
category: security
technology:
- terraform
- aws
owasp:
- A06:2021 - Vulnerable and Outdated Components
- A03:2025 - Software Supply Chain Failures
references:
- https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push
shortlink: https://sg.run/R8eE
semgrep.dev:
rule:
r_id: 9749
rv_id: 1263885
rule_id: 0oUELR
version_id: xyTjzzO
url: https://semgrep.dev/playground/r/xyTjzzO/terraform.lang.security.ecr-image-scan-on-push.ecr-image-scan-on-push
origin: community
- id: terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled
patterns:
- pattern: |
resource
- pattern-inside: |
resource "aws_eks_cluster" "..." {...}
- pattern-not-inside: |
resource "aws_eks_cluster" "..."{
...
vpc_config{
...
endpoint_public_access = false
...
}
...
}
languages:
- hcl
message: The vpc_config resource inside the eks cluster has not explicitly disabled
public endpoint access
severity: WARNING
metadata:
category: security
cwe:
- 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
technology:
- terraform
- aws
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled
shortlink: https://sg.run/Albg
semgrep.dev:
rule:
r_id: 9750
rv_id: 1263887
rule_id: KxU4v6
version_id: e1TyjjB
url: https://semgrep.dev/playground/r/e1TyjjB/terraform.lang.security.eks-public-endpoint-enabled.eks-public-endpoint-enabled
origin: community
- id: terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest
patterns:
- pattern: |
resource
- pattern-not-inside: |
resource "aws_elasticsearch_domain" "..."{
...
encrypt_at_rest{
...
enabled = true
...
}
...
}
- pattern-inside: |
resource "aws_elasticsearch_domain" "..." {...}
languages:
- hcl
message: Encryption at rest is not enabled for the elastic search domain resource
severity: WARNING
metadata:
category: security
cwe:
- 'CWE-311: Missing Encryption of Sensitive Data'
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest
shortlink: https://sg.run/B4Yb
semgrep.dev:
rule:
r_id: 9751
rv_id: 1263888
rule_id: qNUo2d
version_id: vdT066y
url: https://semgrep.dev/playground/r/vdT066y/terraform.lang.security.elastic-search-encryption-at-rest.elastic-search-encryption-at-rest
origin: community
- id: terraform.lang.security.s3-cors-all-origins.all-origins-allowed
patterns:
- pattern-inside: cors_rule { ... }
- pattern: allowed_origins = ["*"]
languages:
- hcl
severity: WARNING
message: CORS rule on bucket permits any origin
metadata:
references:
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#using-cors
cwe:
- 'CWE-942: Permissive Cross-domain Policy with Untrusted Domains'
category: security
technology:
- terraform
- aws
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/terraform.lang.security.s3-cors-all-origins.all-origins-allowed
shortlink: https://sg.run/DJb2
semgrep.dev:
rule:
r_id: 9752
rv_id: 1263898
rule_id: lBUd4g
version_id: 3ZT4XXJ
url: https://semgrep.dev/playground/r/3ZT4XXJ/terraform.lang.security.s3-cors-all-origins.all-origins-allowed
origin: community
- id: terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket
patterns:
- pattern-either:
- pattern: acl = "public-read"
- pattern: acl = "authenticated-read"
- pattern-not-inside: |
resource "aws_s3_bucket" "..." {
...
website { ... }
...
}
languages:
- hcl
severity: WARNING
message: S3 bucket with public read access detected.
metadata:
cwe:
- 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
references:
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl
- https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl
category: security
technology:
- terraform
- aws
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket
shortlink: https://sg.run/WgAy
semgrep.dev:
rule:
r_id: 9753
rv_id: 1263899
rule_id: YGUrp5
version_id: 44TEjjv
url: https://semgrep.dev/playground/r/44TEjjv/terraform.lang.security.s3-public-read-bucket.s3-public-read-bucket
origin: community
- id: terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket
pattern: acl = "public-read-write"
languages:
- hcl
severity: ERROR
message: S3 bucket with public read-write access detected.
metadata:
references:
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#acl
- https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl
cwe:
- 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
category: security
technology:
- terraform
- aws
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket
shortlink: https://sg.run/0nok
semgrep.dev:
rule:
r_id: 9754
rv_id: 1263900
rule_id: 6JUqvn
version_id: PkTR3y5
url: https://semgrep.dev/playground/r/PkTR3y5/terraform.lang.security.s3-public-rw-bucket.s3-public-rw-bucket
origin: community
- id: typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust
message: Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting
(XSS) vulnerability if this comes from user-provided input. If you have to use
`$TRUST`, ensure it does not come from user-input or use the appropriate prevention
mechanism e.g. input validation or sanitization depending on the context.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://angular.io/api/platform-browser/DomSanitizer
- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
confidence: MEDIUM
category: security
technology:
- angular
- browser
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust
shortlink: https://sg.run/KWxP
semgrep.dev:
rule:
r_id: 9755
rv_id: 1263902
rule_id: oqUzgA
version_id: 5PTo1zk
url: https://semgrep.dev/playground/r/5PTo1zk/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust
origin: community
languages:
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
function ...({..., $X: string, ...}) { ... }
- pattern-inside: |
function ...(..., $X: string, ...) { ... }
- focus-metavariable: $X
pattern-sinks:
- patterns:
- pattern-either:
- pattern: $X.$TRUST($Y)
- focus-metavariable: $Y
- pattern-not: |
$X.$TRUST(`...`)
- pattern-not: |
$X.$TRUST("...")
- metavariable-regex:
metavariable: $TRUST
regex: (bypassSecurityTrustHtml|bypassSecurityTrustStyle|bypassSecurityTrustScript|bypassSecurityTrustUrl|bypassSecurityTrustResourceUrl)
pattern-sanitizers:
- patterns:
- pattern-either:
- pattern-inside: |
import $S from "underscore.string"
...
- pattern-inside: |
import * as $S from "underscore.string"
...
- pattern-inside: |
import $S from "underscore.string"
...
- pattern-inside: |
$S = require("underscore.string")
...
- pattern-either:
- pattern: $S.escapeHTML(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from "dompurify"
...
- pattern-inside: |
import { ..., $S,... } from "dompurify"
...
- pattern-inside: |
import * as $S from "dompurify"
...
- pattern-inside: |
$S = require("dompurify")
...
- pattern-inside: |
import $S from "isomorphic-dompurify"
...
- pattern-inside: |
import * as $S from "isomorphic-dompurify"
...
- pattern-inside: |
$S = require("isomorphic-dompurify")
...
- pattern-either:
- patterns:
- pattern-inside: |
$VALUE = $S(...)
...
- pattern: $VALUE.sanitize(...)
- patterns:
- pattern-inside: |
$VALUE = $S.sanitize
...
- pattern: $S(...)
- pattern: $S.sanitize(...)
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'xss';
...
- pattern-inside: |
import * as $S from 'xss';
...
- pattern-inside: |
$S = require("xss")
...
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'sanitize-html';
...
- pattern-inside: |
import * as $S from "sanitize-html";
...
- pattern-inside: |
$S = require("sanitize-html")
...
- pattern: $S(...)
- patterns:
- pattern: sanitizer.sanitize(...)
- pattern-not: sanitizer.sanitize(SecurityContext.NONE, ...);
- id: typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any
message: Access-Control-Allow-Origin response header is set to "*". This will disable
CORS Same Origin Policy restrictions.
metadata:
cwe:
- 'CWE-183: Permissive List of Allowed Inputs'
asvs:
section: 'V14: Configuration Verification Requirements'
control_id: 14.4.8 Permissive CORS
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x22-V14-Config.md#v144-http-security-headers-requirements
version: '4'
category: security
technology:
- nestjs
owasp:
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any
shortlink: https://sg.run/ljBL
semgrep.dev:
rule:
r_id: 9757
rv_id: 1263909
rule_id: pKUG17
version_id: 0bTKzXw
url: https://semgrep.dev/playground/r/0bTKzXw/typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any
origin: community
languages:
- typescript
severity: WARNING
pattern-either:
- pattern: |
class $CN {
@Header("=~/[Aa][Cc][Cc][Ee][Ss][Ss]-[Cc][Oo][Nn][Tt][Rr][Oo][Ll]-[Aa][Ll][Ll][Oo][Ww]-[Oo][Rr][Ii][Gg][Ii][Nn]/", '*')
$FN(...) {
...
}
}
- pattern: |
NestFactory.create($MODULE, {cors: true})
- pattern: |
NestFactory.create($MODULE, {cors: {origin: '*'}})
- pattern: |
$APP.enableCors()
- pattern: |
$APP.enableCors({origin: '*'})
- id: typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled
message: X-XSS-Protection header is set to 0. This will disable the browser's XSS
Filter.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
category: security
technology:
- nestjs
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled
shortlink: https://sg.run/YgGW
semgrep.dev:
rule:
r_id: 9758
rv_id: 1263910
rule_id: 2ZU4zx
version_id: K3TKkXw
url: https://semgrep.dev/playground/r/K3TKkXw/typescript.nestjs.security.audit.nestjs-header-xss-disabled.nestjs-header-xss-disabled
origin: community
languages:
- typescript
severity: WARNING
pattern: |
class $CN {
...
@Header("=~/[Xx]-[Xx][Ss][Ss]-[Pp][Rr][Oo][Tt][Ee][Cc][Tt][Ii][Oo][Nn]/", '0')
$FN(...) {
...
}
...
}
- id: typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect
message: 'Untrusted user input in {url: ...} can result in Open Redirect vulnerability.'
metadata:
cwe:
- 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')'
category: security
technology:
- nestjs
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Open Redirect
source: https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect
shortlink: https://sg.run/6rJw
semgrep.dev:
rule:
r_id: 9759
rv_id: 1263911
rule_id: X5UZQK
version_id: qkTR7y4
url: https://semgrep.dev/playground/r/qkTR7y4/typescript.nestjs.security.audit.nestjs-open-redirect.nestjs-open-redirect
origin: community
languages:
- typescript
severity: WARNING
patterns:
- pattern: |
return {url: $URL}
- pattern-inside: |
class $CN {
@Redirect(...)
$FN(...) {
...
}
}
- pattern-not: |
return {url: "..."}
- id: typescript.react.security.react-insecure-request.react-insecure-request
message: Unencrypted request over HTTP detected.
metadata:
vulnerability: Insecure Transport
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
references:
- https://www.npmjs.com/package/axios
category: security
technology:
- react
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/typescript.react.security.react-insecure-request.react-insecure-request
shortlink: https://sg.run/1n0b
semgrep.dev:
rule:
r_id: 9766
rv_id: 1263918
rule_id: NbUA3O
version_id: A8Tgd2p
url: https://semgrep.dev/playground/r/A8Tgd2p/typescript.react.security.react-insecure-request.react-insecure-request
origin: community
languages:
- typescript
- javascript
severity: ERROR
patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
import $AXIOS from 'axios';
...
$AXIOS.$METHOD(...)
- pattern-inside: |
$AXIOS = require('axios');
...
$AXIOS.$METHOD(...)
- pattern: $AXIOS.$VERB("$URL",...)
- metavariable-regex:
metavariable: $VERB
regex: ^(get|post|delete|head|patch|put|options)
- patterns:
- pattern-either:
- pattern-inside: |
import $AXIOS from 'axios';
...
$AXIOS(...)
- pattern-inside: |
$AXIOS = require('axios');
...
$AXIOS(...)
- pattern-either:
- pattern: '$AXIOS({url: "$URL"}, ...)'
- pattern: |
$OPTS = {url: "$URL"}
...
$AXIOS($OPTS, ...)
- pattern: fetch("$URL", ...)
- metavariable-regex:
metavariable: $URL
regex: ^([Hh][Tt][Tt][Pp]:\/\/(?!localhost).*)
- id: typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html
message: Overwriting `transformLinkUri` or `transformImageUri` to something insecure,
or turning `allowDangerousHtml` on, or turning `escapeHtml` off, will open the
code up to XSS vectors.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://www.npmjs.com/package/react-markdown#security
category: security
technology:
- react
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html
shortlink: https://sg.run/9qAk
semgrep.dev:
rule:
r_id: 9767
rv_id: 1263919
rule_id: kxURd4
version_id: BjTkZA8
url: https://semgrep.dev/playground/r/BjTkZA8/typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html
origin: community
languages:
- typescript
- javascript
severity: WARNING
patterns:
- pattern-either:
- pattern-inside: |
$X = require('react-markdown/with-html');
...
- pattern-inside: |
$X = require('react-markdown');
...
- pattern-inside: |
import 'react-markdown/with-html';
...
- pattern-inside: |
import 'react-markdown';
...
- pattern-either:
- pattern: |
<$EL allowDangerousHtml />
- pattern: |
<$EL escapeHtml={false} />
- pattern: |
<$EL transformLinkUri=... />
- pattern: |
<$EL transformImageUri=... />
- id: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml
message: Detection of dangerouslySetInnerHTML from non-constant definition. This
can inadvertently expose users to cross-site scripting (XSS) attacks if this comes
from user-provided input. If you have to use dangerouslySetInnerHTML, consider
using a sanitization library such as DOMPurify to sanitize your HTML.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html
category: security
confidence: MEDIUM
technology:
- react
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml
shortlink: https://sg.run/rAx6
semgrep.dev:
rule:
r_id: 9769
rv_id: 1263912
rule_id: x8UWvK
version_id: l4TJR0v
url: https://semgrep.dev/playground/r/l4TJR0v/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml
origin: community
languages:
- typescript
- javascript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
function ...({..., $X, ...}) { ... }
- pattern-inside: |
function ...(..., $X, ...) { ... }
- focus-metavariable: $X
- pattern-not-inside: |
$F. ... .$SANITIZEUNC(...)
pattern-sinks:
- patterns:
- focus-metavariable: $X
- pattern-either:
- pattern: |
{...,dangerouslySetInnerHTML: {__html: $X},...}
- pattern: |
<$Y ... dangerouslySetInnerHTML={{__html: $X}} />
- pattern-not: |
<$Y ... dangerouslySetInnerHTML={{__html: "..."}} />
- pattern-not: |
{...,dangerouslySetInnerHTML:{__html: "..."},...}
- metavariable-pattern:
patterns:
- pattern-not: |
{...}
metavariable: $X
- pattern-not: |
<... {__html: "..."} ...>
- pattern-not: |
<... {__html: `...`} ...>
pattern-sanitizers:
- patterns:
- pattern-either:
- pattern-inside: |
import $S from "underscore.string"
...
- pattern-inside: |
import * as $S from "underscore.string"
...
- pattern-inside: |
import $S from "underscore.string"
...
- pattern-inside: |
$S = require("underscore.string")
...
- pattern-either:
- pattern: $S.escapeHTML(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from "dompurify"
...
- pattern-inside: |
import { ..., $S,... } from "dompurify"
...
- pattern-inside: |
import * as $S from "dompurify"
...
- pattern-inside: |
$S = require("dompurify")
...
- pattern-inside: |
import $S from "isomorphic-dompurify"
...
- pattern-inside: |
import * as $S from "isomorphic-dompurify"
...
- pattern-inside: |
$S = require("isomorphic-dompurify")
...
- pattern-either:
- patterns:
- pattern-inside: |
$VALUE = $S(...)
...
- pattern: $VALUE.sanitize(...)
- patterns:
- pattern-inside: |
$VALUE = $S.sanitize
...
- pattern: $S(...)
- pattern: $S.sanitize(...)
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'xss';
...
- pattern-inside: |
import * as $S from 'xss';
...
- pattern-inside: |
$S = require("xss")
...
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'sanitize-html';
...
- pattern-inside: |
import * as $S from "sanitize-html";
...
- pattern-inside: |
$S = require("sanitize-html")
...
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
$S = new Remarkable()
...
- pattern: $S.render(...)
- id: typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property
message: Property decoded from JWT token without verifying and cannot be trustworthy.
metadata:
cwe:
- 'CWE-922: Insecure Storage of Sensitive Information'
references:
- https://pragmaticwebsecurity.com/articles/oauthoidc/localstorage-xss.html
category: security
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
technology:
- react
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property
shortlink: https://sg.run/wx8x
semgrep.dev:
rule:
r_id: 9773
rv_id: 1263914
rule_id: d8Uzqz
version_id: JdTzxjz
url: https://semgrep.dev/playground/r/JdTzxjz/typescript.react.security.audit.react-jwt-decoded-property.react-jwt-decoded-property
origin: community
languages:
- typescript
- javascript
severity: INFO
patterns:
- pattern-inside: |
import jwt_decode from "jwt-decode";
...
- pattern-inside: |
$DECODED = jwt_decode($TOKEN,...);
...
- pattern: $DECODED.$PROPERTY
- id: typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage
message: Storing JWT tokens in localStorage known to be a bad practice, consider
moving your tokens from localStorage to a HTTP cookie.
metadata:
cwe:
- 'CWE-922: Insecure Storage of Sensitive Information'
references:
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
category: security
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
technology:
- react
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage
shortlink: https://sg.run/xYye
semgrep.dev:
rule:
r_id: 9774
rv_id: 1263915
rule_id: ZqUq6g
version_id: 5PTo1zq
url: https://semgrep.dev/playground/r/5PTo1zq/typescript.react.security.audit.react-jwt-in-localstorage.react-jwt-in-localstorage
origin: community
languages:
- typescript
- javascript
severity: INFO
patterns:
- pattern-inside: |
import jwt_decode from "jwt-decode";
...
- pattern-either:
- pattern: |
$DECODED = jwt_decode($TOKEN,...);
...
localStorage.setItem($NAME, <... $TOKEN ...>);
- pattern: |
$DECODED = jwt_decode(...);
...
localStorage.setItem($NAME, <... $DECODED ...>);
- id: typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method
message: Detection of $HTML from non-constant definition. This can inadvertently
expose users to cross-site scripting (XSS) attacks if this comes from user-provided
input. If you have to use $HTML, consider using a sanitization library such as
DOMPurify to sanitize your HTML.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://developer.mozilla.org/en-US/docs/Web/API/Document/writeln
- https://developer.mozilla.org/en-US/docs/Web/API/Document/write
- https://developer.mozilla.org/en-US/docs/Web/API/Element/insertAdjacentHTML
category: security
confidence: MEDIUM
technology:
- react
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method
shortlink: https://sg.run/E5x8
semgrep.dev:
rule:
r_id: 9781
rv_id: 1263916
rule_id: QrU68w
version_id: GxTkeRl
url: https://semgrep.dev/playground/r/GxTkeRl/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method
origin: community
languages:
- typescript
- javascript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
function ...({..., $X, ...}) { ... }
- pattern-inside: |
function ...(..., $X, ...) { ... }
- focus-metavariable: $X
- pattern-either:
- pattern: $X.$Y
- pattern: $X[...]
pattern-sinks:
- patterns:
- pattern-either:
- pattern: "this.window.document. ... .$HTML('...',$SINK) \n"
- pattern: "window.document. ... .$HTML('...',$SINK) \n"
- pattern: "document.$HTML($SINK) \n"
- metavariable-regex:
metavariable: $HTML
regex: (writeln|write)
- focus-metavariable: $SINK
- patterns:
- pattern-either:
- pattern: "$PROP. ... .$HTML('...',$SINK) \n"
- metavariable-regex:
metavariable: $HTML
regex: (insertAdjacentHTML)
- focus-metavariable: $SINK
pattern-sanitizers:
- patterns:
- pattern-either:
- pattern-inside: |
import $S from "underscore.string"
...
- pattern-inside: |
import * as $S from "underscore.string"
...
- pattern-inside: |
import $S from "underscore.string"
...
- pattern-inside: |
$S = require("underscore.string")
...
- pattern-either:
- pattern: $S.escapeHTML(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from "dompurify"
...
- pattern-inside: |
import { ..., $S,... } from "dompurify"
...
- pattern-inside: |
import * as $S from "dompurify"
...
- pattern-inside: |
$S = require("dompurify")
...
- pattern-inside: |
import $S from "isomorphic-dompurify"
...
- pattern-inside: |
import * as $S from "isomorphic-dompurify"
...
- pattern-inside: |
$S = require("isomorphic-dompurify")
...
- pattern-either:
- patterns:
- pattern-inside: |
$VALUE = $S(...)
...
- pattern: $VALUE.sanitize(...)
- patterns:
- pattern-inside: |
$VALUE = $S.sanitize
...
- pattern: $S(...)
- pattern: $S.sanitize(...)
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'xss';
...
- pattern-inside: |
import * as $S from 'xss';
...
- pattern-inside: |
$S = require("xss")
...
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'sanitize-html';
...
- pattern-inside: |
import * as $S from "sanitize-html";
...
- pattern-inside: |
$S = require("sanitize-html")
...
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
$S = new Remarkable()
...
- pattern: $S.render(...)
- id: ruby.lang.security.dangerous-exec.dangerous-exec
mode: taint
pattern-sources:
- patterns:
- pattern: |
def $F(...,$ARG,...)
...
end
- focus-metavariable: $ARG
- pattern: params
- pattern: cookies
pattern-sinks:
- patterns:
- pattern: |
$EXEC(...)
- pattern-not: |
$EXEC("...","...","...",...)
- pattern-not: |
$EXEC(["...","...","...",...],...)
- pattern-not: |
$EXEC({...},"...","...","...",...)
- pattern-not: |
$EXEC({...},["...","...","...",...],...)
- metavariable-regex:
metavariable: $EXEC
regex: ^(system|exec|spawn|Process.exec|Process.spawn|Open3.capture2|Open3.capture2e|Open3.capture3|Open3.popen2|Open3.popen2e|Open3.popen3|IO.popen|Gem::Util.popen|PTY.spawn)$
message: Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If
unverified user data can reach this call site, this is a code injection vulnerability.
A malicious actor can inject a malicious script to execute arbitrary code.
metadata:
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_execute.rb
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- ruby
- rails
references:
- https://guides.rubyonrails.org/security.html#command-line-injection
cwe2022-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/ruby.lang.security.dangerous-exec.dangerous-exec
shortlink: https://sg.run/R8GY
semgrep.dev:
rule:
r_id: 9805
rv_id: 1409405
rule_id: WAUZOw
version_id: WrT7erb
url: https://semgrep.dev/playground/r/WrT7erb/ruby.lang.security.dangerous-exec.dangerous-exec
origin: community
severity: WARNING
languages:
- ruby
- id: ruby.lang.security.dangerous-open.dangerous-open
patterns:
- pattern: |
open($CMD,...)
- pattern-not: |
open("...",...)
- metavariable-regex:
metavariable: $CMD
regex: '|'
message: Detected non-static command inside 'open'. Audit the input to 'open'. If
unverified user data can reach this call site, this is a code injection vulnerability.
A malicious actor can inject a malicious script to execute arbitrary code.
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- ruby
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/ruby.lang.security.dangerous-open.dangerous-open
shortlink: https://sg.run/Al8Q
semgrep.dev:
rule:
r_id: 9806
rv_id: 1263599
rule_id: 0oUEyd
version_id: 5PTo1WL
url: https://semgrep.dev/playground/r/5PTo1WL/ruby.lang.security.dangerous-open.dangerous-open
origin: community
severity: WARNING
languages:
- ruby
- id: ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline
patterns:
- pattern: |
Open3.$PIPE(...)
- pattern-not: |
Open3.$PIPE(...,"...",...)
- metavariable-regex:
metavariable: $PIPE
regex: ^(pipeline|pipeline_r|pipeline_rw|pipeline_start|pipeline_w)$
message: Detected non-static command inside $PIPE. Audit the input to '$PIPE'. If
unverified user data can reach this call site, this is a code injection vulnerability.
A malicious actor can inject a malicious script to execute arbitrary code.
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- ruby
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline
shortlink: https://sg.run/B4jv
semgrep.dev:
rule:
r_id: 9807
rv_id: 1263600
rule_id: KxU4nd
version_id: GxTkeNz
url: https://semgrep.dev/playground/r/GxTkeNz/ruby.lang.security.dangerous-open3-pipeline.dangerous-open3-pipeline
origin: community
severity: WARNING
languages:
- ruby
- id: ruby.lang.security.dangerous-syscall.dangerous-syscall
pattern: |
syscall
message: '''syscall'' is essentially unsafe and unportable. The DL (https://apidock.com/ruby/Fiddle)
library is preferred for safer and a bit more portable programming.'
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- ruby
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/ruby.lang.security.dangerous-syscall.dangerous-syscall
shortlink: https://sg.run/DJkv
semgrep.dev:
rule:
r_id: 9808
rv_id: 1263602
rule_id: qNUo50
version_id: A8TgdDN
url: https://semgrep.dev/playground/r/A8TgdDN/ruby.lang.security.dangerous-syscall.dangerous-syscall
origin: community
severity: WARNING
languages:
- ruby
- id: ruby.lang.security.dangerous-subshell.dangerous-subshell
patterns:
- pattern: |
`...#{$VAL}...`
- pattern-not: |
`...#{"..."}...`
- pattern-not-inside: |
$VAL = "..."
...
message: Detected non-static command inside `...`. If unverified user data can reach
this call site, this is a code injection vulnerability. A malicious actor can
inject a malicious script to execute arbitrary code.
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- ruby
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/ruby.lang.security.dangerous-subshell.dangerous-subshell
shortlink: https://sg.run/NrxL
semgrep.dev:
rule:
r_id: 9827
rv_id: 1263601
rule_id: OrUGn8
version_id: RGT0LJK
url: https://semgrep.dev/playground/r/RGT0LJK/ruby.lang.security.dangerous-subshell.dangerous-subshell
origin: community
severity: WARNING
languages:
- ruby
- id: javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell
message: Detected non-literal calls to $EXEC(). This could lead to a command injection
vulnerability.
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-child-process.js
category: security
technology:
- javascript
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell
shortlink: https://sg.run/DJ8v
semgrep.dev:
rule:
r_id: 9852
rv_id: 1263193
rule_id: qNUo10
version_id: PkTR3nY
url: https://semgrep.dev/playground/r/PkTR3nY/javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-inside: |
function ... (...,$FUNC,...) {
...
}
- focus-metavariable: $FUNC
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
require('child_process')
...
- pattern-inside: |
import 'child_process'
...
- pattern-either:
- pattern: spawn(...)
- pattern: spawnSync(...)
- pattern: $CP.spawn(...)
- pattern: $CP.spawnSync(...)
- pattern-either:
- pattern: |
$EXEC("=~/(sh|bash|ksh|csh|tcsh|zsh)/",["-c", $ARG, ...],...)
- patterns:
- pattern: $EXEC($CMD,["-c", $ARG, ...],...)
- pattern-inside: |
$CMD = "=~/(sh|bash|ksh|csh|tcsh|zsh)/"
...
- pattern: |
$EXEC("=~/(sh|bash|ksh|csh|tcsh|zsh)/",[$ARG, ...],...)
- patterns:
- pattern: $EXEC($CMD,[$ARG, ...],...)
- pattern-inside: |
$CMD = "=~/(sh|bash|ksh|csh|tcsh|zsh)/"
...
- focus-metavariable: $ARG
- id: javascript.lang.security.audit.spawn-shell-true.spawn-shell-true
message: 'Found ''$SPAWN'' with ''{shell: $SHELL}''. This is dangerous because this
call will spawn the command using a shell process. Doing so propagates current
shell settings and variables, which makes it much easier for a malicious actor
to execute commands. Use ''{shell: false}'' instead.'
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
category: security
technology:
- javascript
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/javascript.lang.security.audit.spawn-shell-true.spawn-shell-true
shortlink: https://sg.run/Wgeo
semgrep.dev:
rule:
r_id: 9853
rv_id: 1263204
rule_id: lBUdr5
version_id: qkTR79W
url: https://semgrep.dev/playground/r/qkTR79W/javascript.lang.security.audit.spawn-shell-true.spawn-shell-true
origin: community
languages:
- javascript
- typescript
severity: ERROR
patterns:
- pattern-either:
- pattern: |
spawn(...,{shell: $SHELL})
- pattern: |
spawnSync(...,{shell: $SHELL})
- pattern: |
$CP.spawn(...,{shell: $SHELL})
- pattern: |
$CP.spawnSync(...,{shell: $SHELL})
- pattern-not: |
spawn(...,{shell: false})
- pattern-not: |
spawnSync(...,{shell: false})
- pattern-not: |
$CP.spawn(...,{shell: false})
- pattern-not: |
$CP.spawnSync(...,{shell: false})
- id: javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run
message: Detected non-literal calls to Deno.run(). This could lead to a command
injection vulnerability.
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- deno
references:
- https://deno.land/manual/examples/subprocess#simple-example
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run
shortlink: https://sg.run/Nrrn
semgrep.dev:
rule:
r_id: 9927
rv_id: 1409397
rule_id: x8UWWg
version_id: PkTe7AP
url: https://semgrep.dev/playground/r/PkTe7AP/javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-inside: function ... (..., $ARG,...) {...}
- focus-metavariable: $ARG
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
Deno.run({cmd: [$INPUT,...]},...)
- pattern: |
Deno.run({cmd: ["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$INPUT,...]},...)
- patterns:
- pattern: |
Deno.run({cmd: [$CMD,"-c",$INPUT,...]},...)
- pattern-inside: |
$CMD = "=~/(sh|bash|ksh|csh|tcsh|zsh)/"
...
- focus-metavariable: $INPUT
- id: java.lang.security.audit.command-injection-process-builder.command-injection-process-builder
pattern-either:
- patterns:
- pattern: |
new ProcessBuilder($CMD,...)
- pattern-not-inside: |
$CMD = "...";
...
- pattern-not-inside: |
$CMD = Arrays.asList("...",...);
...
- pattern-not-inside: |
$CMD = new String[]{"...",...};
...
- pattern-not: |
new ProcessBuilder("...",...)
- pattern-not: |
new ProcessBuilder(new String[]{"...",...},...)
- pattern-not: |
new ProcessBuilder(Arrays.asList("...",...),...)
- patterns:
- pattern: |
$PB.command($CMD,...)
- pattern-inside: |
$TYPE $PB = new ProcessBuilder(...);
...
- pattern-not-inside: |
$CMD = "...";
...
- pattern-not-inside: |
$CMD = Arrays.asList("...",...);
...
- pattern-not-inside: |
$CMD = new String[]{"...",...};
...
- pattern-not: |
$PB.command("...",...)
- pattern-not: |
$PB.command(new String[]{"...",...},...)
- pattern-not: |
$PB.command(Arrays.asList("...",...),...)
- patterns:
- pattern-either:
- pattern: |
new ProcessBuilder("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$ARG,...)
- pattern: |
new ProcessBuilder("cmd","/c",$ARG,...)
- pattern: |
new ProcessBuilder(Arrays.asList("cmd","/c",$ARG,...),...)
- pattern: |
new ProcessBuilder(new String[]{"cmd","/c",$ARG,...},...)
- patterns:
- pattern-either:
- pattern: |
new ProcessBuilder($CMD,"/c",$ARG,...)
- pattern: |
new ProcessBuilder(Arrays.asList($CMD,"/c",$ARG,...),...)
- pattern: |
new ProcessBuilder(new String[]{$CMD,"/c",$ARG,...},...)
- pattern-inside: |
$CMD = "cmd";
...
- pattern-not-inside: |
$ARG = "...";
...
- pattern-not: |
new ProcessBuilder("...","...","...",...)
- pattern-not: |
new ProcessBuilder(new String[]{"...","...","...",...},...)
- pattern-not: |
new ProcessBuilder(Arrays.asList("...","...","...",...),...)
- patterns:
- pattern-either:
- pattern: |
$PB.command("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$ARG,...)
- pattern: |
$PB.command("cmd","/c",$ARG,...)
- pattern: |
$PB.command(Arrays.asList("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$ARG,...),...)
- pattern: |
$PB.command(Arrays.asList("cmd","/c",$ARG,...),...)
- pattern: |
$PB.command(new String[]{"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$ARG,...},...)
- pattern: |
$PB.command(new String[]{"cmd","/c",$ARG,...},...)
- patterns:
- pattern-either:
- pattern: |
$PB.command($CMD,"-c",$ARG,...)
- pattern: |
$PB.command(Arrays.asList($CMD,"-c",$ARG,...),...)
- pattern: |
$PB.command(new String[]{$CMD,"-c",$ARG,...},...)
- pattern-inside: |
$CMD = "=~/(sh|bash|ksh|csh|tcsh|zsh)/";
...
- patterns:
- pattern-either:
- pattern: |
$PB.command($CMD,"/c",$ARG,...)
- pattern: |
$PB.command(Arrays.asList($CMD,"/c",$ARG,...),...)
- pattern: |
$PB.command(new String[]{$CMD,"/c",$ARG,...},...)
- pattern-inside: |
$CMD = "cmd";
...
- pattern-inside: |
$TYPE $PB = new ProcessBuilder(...);
...
- pattern-not-inside: |
$ARG = "...";
...
- pattern-not: |
$PB.command("...","...","...",...)
- pattern-not: |
$PB.command(new String[]{"...","...","...",...},...)
- pattern-not: |
$PB.command(Arrays.asList("...","...","...",...),...)
message: A formatted or concatenated string was detected as input to a ProcessBuilder
call. This is dangerous if a variable is controlled by user input and could result
in a command injection. Ensure your variables are not controlled by users or sufficiently
sanitized.
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- java
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/java.lang.security.audit.command-injection-process-builder.command-injection-process-builder
shortlink: https://sg.run/gJJe
semgrep.dev:
rule:
r_id: 9941
rv_id: 1262992
rule_id: 4bUzzo
version_id: JdTzxnn
url: https://semgrep.dev/playground/r/JdTzxnn/java.lang.security.audit.command-injection-process-builder.command-injection-process-builder
origin: community
severity: ERROR
languages:
- java
- id: java.spring.security.audit.spring-jsp-eval.spring-jsp-eval
pattern: |
<spring:eval ... expression=...>
message: A Spring expression is built with a dynamic value. The source of the value(s)
should be verified to avoid that unfiltered values fall into this risky code evaluation.
severity: WARNING
languages:
- generic
metadata:
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#JSP_SPRING_EVAL
category: security
technology:
- spring
references:
- https://owasp.org/Top10/A03_2021-Injection
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/java.spring.security.audit.spring-jsp-eval.spring-jsp-eval
shortlink: https://sg.run/Q88o
semgrep.dev:
rule:
r_id: 9942
rv_id: 1263081
rule_id: PeUkkL
version_id: d6TyxL7
url: https://semgrep.dev/playground/r/d6TyxL7/java.spring.security.audit.spring-jsp-eval.spring-jsp-eval
origin: community
paths:
include:
- '*.jsp'
- id: javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls
message: 'If TLS is disabled on server side (Postgresql server), Sequelize establishes
connection without TLS and no error will be thrown. To prevent MITN (Man In The
Middle) attack, TLS must be enforce by Sequelize. Set "ssl: true" or define settings
"ssl: {...}"'
metadata:
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://node-postgres.com/features/ssl
- https://nodejs.org/api/tls.html#tls_class_tls_tlssocket
- https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options
- https://nodejs.org/api/tls.html#tls_tls_default_min_version
category: security
technology:
- sequelize
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls
shortlink: https://sg.run/yz6Z
semgrep.dev:
rule:
r_id: 9968
rv_id: 1263240
rule_id: NbUAYW
version_id: ZRTKAJ4
url: https://semgrep.dev/playground/r/ZRTKAJ4/javascript.sequelize.security.audit.sequelize-enforce-tls.sequelize-enforce-tls
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern: |
{
host: $HOST,
database: $DATABASE,
dialect: $DIALECT
}
- pattern-not: |
{
host: $HOST,
database: $DATABASE,
dialect: "postgres",
dialectOptions: {
ssl: true
}
}
- pattern-not: |
{
host: $HOST,
database: $DATABASE,
dialect: $DIALECT,
dialectOptions: {
ssl: { ... }
}
}
- metavariable-regex:
metavariable: $DIALECT
regex: '[''"](mariadb|mysql|postgres)[''"]'
- id: javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation
message: Set "rejectUnauthorized" to false is a convenient way to resolve certificate
error. But this method is unsafe because it disables the server certificate verification,
making the Node app open to MITM attack. "rejectUnauthorized" option must be alway
set to True (default value). With self -signed certificate or custom CA, use "ca"
option to define Root Certificate. This rule checks TLS configuration only for
Postgresql, MariaDB and MySQL. SQLite is not really concerned by TLS configuration.
This rule could be extended for MSSQL, but the dialectOptions is specific for
Tedious.
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://node-postgres.com/features/ssl
- https://nodejs.org/api/tls.html#tls_class_tls_tlssocket
- https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options
category: security
technology:
- sequelize
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation
shortlink: https://sg.run/rAkj
semgrep.dev:
rule:
r_id: 9969
rv_id: 1263243
rule_id: kxUR80
version_id: 7ZTE3w1
url: https://semgrep.dev/playground/r/7ZTE3w1/javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation
origin: community
languages:
- javascript
- typescript
severity: ERROR
patterns:
- pattern: |
{
host: $HOST,
database: $DATABASE,
dialect: $DIALECT,
dialectOptions: {
ssl: {
rejectUnauthorized: false
}
}
}
- metavariable-regex:
metavariable: $DIALECT
regex: '[''"](mariadb|mysql|postgres)[''"]'
- id: javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version
message: TLS1.0 and TLS1.1 are deprecated and should not be used anymore. By default,
NodeJS used TLSv1.2. So, TLS min version must not be downgrade to TLS1.0 or TLS1.1.
Enforce TLS1.3 is highly recommended This rule checks TLS configuration only for
PostgreSQL, MariaDB and MySQL. SQLite is not really concerned by TLS configuration.
This rule could be extended for MSSQL, but the dialectOptions is specific for
Tedious.
metadata:
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://node-postgres.com/features/ssl
- https://nodejs.org/api/tls.html#tls_class_tls_tlssocket
- https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options
- https://nodejs.org/api/tls.html#tls_tls_default_min_version
category: security
technology:
- sequelize
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version
shortlink: https://sg.run/bDrq
semgrep.dev:
rule:
r_id: 9970
rv_id: 1263244
rule_id: wdU8GB
version_id: LjTkgJy
url: https://semgrep.dev/playground/r/LjTkgJy/javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
{
host: $HOST,
database: $DATABASE,
dialect: $DIALECT,
dialectOptions:
{ ssl: ... }
}
- pattern-either:
- pattern: |
{
minVersion: 'TLSv1'
}
- pattern: |
{
minVersion: 'TLSv1.1'
}
- metavariable-regex:
metavariable: $DIALECT
regex: '[''"](mariadb|mysql|postgres)[''"]'
- id: java.jboss.security.seam-log-injection.seam-log-injection
patterns:
- pattern: |
$LOG.$INFO($X + $Y,...)
- pattern-either:
- pattern-inside: |
import org.jboss.seam.log.Log;
...
- pattern-inside: |
org.jboss.seam.log.Log $LOG = ...;
...
- metavariable-regex:
metavariable: $INFO
regex: (debug|error|fatal|info|trace|warn)
languages:
- java
message: Seam Logging API support an expression language to introduce bean property
to log messages. The expression language can also be the source to unwanted code
execution. In this context, an expression is built with a dynamic value. The source
of the value(s) should be verified to avoid that unfiltered values fall into this
risky code evaluation.
metadata:
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SEAM_LOG_INJECTION
category: security
technology:
- jboss
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/java.jboss.security.seam-log-injection.seam-log-injection
shortlink: https://sg.run/3A4o
semgrep.dev:
rule:
r_id: 9987
rv_id: 1262985
rule_id: JDUPQ7
version_id: LjTkgRE
url: https://semgrep.dev/playground/r/LjTkgRE/java.jboss.security.seam-log-injection.seam-log-injection
origin: community
severity: ERROR
- id: java.lang.security.audit.unsafe-reflection.unsafe-reflection
patterns:
- pattern: |
Class.forName($CLASS,...)
- pattern-not: |
Class.forName("...",...)
- pattern-not-inside: |
$CLASS = "...";
...
message: If an attacker can supply values that the application then uses to determine
which class to instantiate or which method to invoke, the potential exists for
the attacker to create control flow paths through the application that were not
intended by the application developers. This attack vector may allow the attacker
to bypass authentication or access control checks or otherwise cause the application
to behave in an unexpected manner.
metadata:
cwe:
- 'CWE-470: Use of Externally-Controlled Input to Select Classes or Code (''Unsafe
Reflection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
source-rule-url: https://owasp.org/www-community/vulnerabilities/Unsafe_use_of_Reflection
category: security
technology:
- java
references:
- https://owasp.org/Top10/A03_2021-Injection
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/java.lang.security.audit.unsafe-reflection.unsafe-reflection
shortlink: https://sg.run/R8X8
semgrep.dev:
rule:
r_id: 9993
rv_id: 1263047
rule_id: DbUW1W
version_id: 44TEj5L
url: https://semgrep.dev/playground/r/44TEj5L/java.lang.security.audit.unsafe-reflection.unsafe-reflection
origin: community
severity: WARNING
languages:
- java
- id: go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name
patterns:
- pattern-either:
- pattern: |
$SMTH.MethodByName($NAME,...)
- pattern: |
$SMTH.FieldByName($NAME,...)
- pattern-not: |
$SMTH.MethodByName("...",...)
- pattern-not: |
$SMTH.FieldByName("...",...)
- pattern-inside: |
import "reflect"
...
message: If an attacker can supply values that the application then uses to determine
which method or field to invoke, the potential exists for the attacker to create
control flow paths through the application that were not intended by the application
developers. This attack vector may allow the attacker to bypass authentication
or access control checks or otherwise cause the application to behave in an unexpected
manner.
metadata:
cwe:
- 'CWE-470: Use of Externally-Controlled Input to Select Classes or Code (''Unsafe
Reflection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- go
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name
shortlink: https://sg.run/R8Xv
semgrep.dev:
rule:
r_id: 10005
rv_id: 1262955
rule_id: BYUBdJ
version_id: WrTqK8e
url: https://semgrep.dev/playground/r/WrTqK8e/go.lang.security.audit.unsafe-reflect-by-name.unsafe-reflect-by-name
origin: community
severity: WARNING
languages:
- go
- id: yaml.docker-compose.security.privileged-service.privileged-service
patterns:
- pattern-inside: |
version: ...
...
services:
...
$SERVICE:
...
privileged: $TRUE
- focus-metavariable: $TRUE
- metavariable-regex:
metavariable: $TRUE
regex: (true)
fix: |
false
message: Service '$SERVICE' is running in privileged mode. This grants the container
the equivalent of root capabilities on the host machine. This can lead to container
escapes, privilege escalation, and other security concerns. Remove the 'privileged'
key to disable this capability.
metadata:
cwe:
- 'CWE-250: Execution with Unnecessary Privileges'
owasp:
- A06:2017 - Security Misconfiguration
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
references:
- https://www.trendmicro.com/en_us/research/19/l/why-running-a-privileged-container-in-docker-is-a-bad-idea.html
- https://containerjournal.com/topics/container-security/why-running-a-privileged-container-is-not-a-good-idea/
category: security
technology:
- docker-compose
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/yaml.docker-compose.security.privileged-service.privileged-service
shortlink: https://sg.run/AlX0
semgrep.dev:
rule:
r_id: 10006
rv_id: 1263922
rule_id: DbUW17
version_id: 0bTKzXZ
url: https://semgrep.dev/playground/r/0bTKzXZ/yaml.docker-compose.security.privileged-service.privileged-service
origin: community
languages:
- yaml
severity: WARNING
- id: generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash
pattern-regex: \$2[aby]?\$[\d]+\$[./A-Za-z0-9]{53}
languages:
- regex
message: bcrypt hash detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
category: security
technology:
- secrets
- bcrypt
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash
shortlink: https://sg.run/3A8G
semgrep.dev:
rule:
r_id: 10043
rv_id: 1262864
rule_id: PeUk0Q
version_id: 2KTv236
url: https://semgrep.dev/playground/r/2KTv236/generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash
origin: community
- id: generic.secrets.security.detected-etc-shadow.detected-etc-shadow
patterns:
- pattern-regex: ^(\s*)(?P<ROOT>root:[x!*]*:[0-9]*:[0-9]*)
- focus-metavariable: $ROOT
languages:
- regex
message: linux shadow file detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
category: security
technology:
- secrets
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-etc-shadow.detected-etc-shadow
shortlink: https://sg.run/4ylL
semgrep.dev:
rule:
r_id: 10044
rv_id: 1262866
rule_id: JDUP6p
version_id: jQTn5yp
url: https://semgrep.dev/playground/r/jQTn5yp/generic.secrets.security.detected-etc-shadow.detected-etc-shadow
origin: community
- id: generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token
patterns:
- pattern: $AUTHTOKEN = $VALUE
- metavariable-regex:
metavariable: $AUTHTOKEN
regex: _(authToken|auth|password)
- pattern-not: $AUTHTOKEN = ${...}
languages:
- generic
message: NPM registry authentication token detected
paths:
include:
- '*npmrc*'
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
category: security
technology:
- secrets
- npm
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token
shortlink: https://sg.run/Ppg3
semgrep.dev:
rule:
r_id: 10045
rv_id: 1262883
rule_id: 5rU4pe
version_id: 7ZTE3n2
url: https://semgrep.dev/playground/r/7ZTE3n2/generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token
origin: community
- id: javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket
message: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for
all WebSocket connections.
metadata:
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
asvs:
section: 'V13: API and Web Service Verification Requirements'
control_id: 13.5.1 Insecure WebSocket
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x21-V13-API.md#v135-websocket-security-requirements
version: '4'
category: security
technology:
- regex
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket
shortlink: https://sg.run/GWyz
semgrep.dev:
rule:
r_id: 10048
rv_id: 1263215
rule_id: AbUWeE
version_id: 0bTKzQ9
url: https://semgrep.dev/playground/r/0bTKzQ9/javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket
origin: community
languages:
- regex
severity: ERROR
patterns:
- pattern-regex: \bws:\/\/
- pattern-not-inside: \bws:\/\/localhost.*
- pattern-not-inside: \bws:\/\/127.0.0.1.*
- id: yaml.docker-compose.security.no-new-privileges.no-new-privileges
patterns:
- pattern-inside: |
version: ...
...
services:
...
- pattern: |
$SERVICE:
...
image: ...
- pattern-not: |
$SERVICE:
...
image: ...
...
security_opt:
- ...
- no-new-privileges:true
- ...
- focus-metavariable: $SERVICE
message: Service '$SERVICE' allows for privilege escalation via setuid or setgid
binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.
metadata:
cwe:
- 'CWE-732: Incorrect Permission Assignment for Critical Resource'
owasp:
- A05:2021 - Security Misconfiguration
- A06:2017 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
references:
- https://raesene.github.io/blog/2019/06/01/docker-capabilities-and-no-new-privs/
- https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt
- https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag
category: security
technology:
- docker-compose
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/yaml.docker-compose.security.no-new-privileges.no-new-privileges
shortlink: https://sg.run/0n8q
semgrep.dev:
rule:
r_id: 10054
rv_id: 1263921
rule_id: qNUoWr
version_id: WrTqKwk
url: https://semgrep.dev/playground/r/WrTqKwk/yaml.docker-compose.security.no-new-privileges.no-new-privileges
origin: community
languages:
- yaml
severity: WARNING
- id: yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled
patterns:
- pattern-inside: |
version: ...
...
services:
...
- pattern: |
$SERVICE:
...
image: ...
...
security_opt:
- ...
- seccomp:unconfined
message: Service '$SERVICE' is explicitly disabling seccomp confinement. This runs
the service in an unrestricted state. Remove 'seccomp:unconfined' to prevent this.
metadata:
cwe:
- 'CWE-284: Improper Access Control'
references:
- https://docs.docker.com/engine/security/seccomp/
category: security
technology:
- docker-compose
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled
shortlink: https://sg.run/KWkY
semgrep.dev:
rule:
r_id: 10055
rv_id: 1263923
rule_id: lBUdW3
version_id: K3TKkXA
url: https://semgrep.dev/playground/r/K3TKkXA/yaml.docker-compose.security.seccomp-confinement-disabled.seccomp-confinement-disabled
origin: community
languages:
- yaml
severity: WARNING
- id: yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled
patterns:
- pattern-inside: |
version: ...
...
services:
...
- pattern: |
$SERVICE:
...
image: ...
...
security_opt:
- ...
- label:disable
message: Service '$SERVICE' is explicitly disabling SELinux separation. This runs
the service as an unconfined type. Remove 'label:disable' to prevent this.
metadata:
cwe:
- 'CWE-284: Improper Access Control'
references:
- https://www.projectatomic.io/blog/2016/03/dwalsh_selinux_containers/
- https://docs.docker.com/engine/reference/run/#security-configuration
category: security
technology:
- docker-compose
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled
shortlink: https://sg.run/qryb
semgrep.dev:
rule:
r_id: 10056
rv_id: 1263924
rule_id: YGUrAG
version_id: qkTR7yg
url: https://semgrep.dev/playground/r/qkTR7yg/yaml.docker-compose.security.selinux-separation-disabled.selinux-separation-disabled
origin: community
languages:
- yaml
severity: WARNING
- id: yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation
patterns:
- pattern-inside: |
containers:
...
- pattern-inside: |
- name: $CONTAINER
...
- pattern: |
image: ...
...
- pattern-inside: |
image: ...
...
$SC:
...
- metavariable-regex:
metavariable: $SC
regex: ^(securityContext)$
- pattern-not-inside: |
image: ...
...
securityContext:
...
allowPrivilegeEscalation: $VAL
- focus-metavariable: $SC
fix: |
securityContext:
allowPrivilegeEscalation: false #
message: In Kubernetes, each pod runs in its own isolated environment with its own
set of security policies. However, certain container images may contain `setuid`
or `setgid` binaries that could allow an attacker to perform privilege escalation
and gain access to sensitive resources. To mitigate this risk, it's recommended
to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation`
set to `false`. This will prevent the container from running any privileged processes
and limit the impact of any potential attacks. By adding the `allowPrivilegeEscalation`
parameter to your the `securityContext`, you can help to ensure that your containerized
applications are more secure and less vulnerable to privilege escalation attacks.
metadata:
cwe:
- 'CWE-732: Incorrect Permission Assignment for Critical Resource'
owasp:
- A05:2021 - Security Misconfiguration
- A06:2017 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
references:
- https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation
- https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
- https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt
- https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag
category: security
technology:
- kubernetes
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation
shortlink: https://sg.run/ljp6
semgrep.dev:
rule:
r_id: 10057
rv_id: 1263933
rule_id: 6JUqEO
version_id: jQTn527
url: https://semgrep.dev/playground/r/jQTn527/yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation
origin: community
languages:
- yaml
severity: WARNING
- id: yaml.kubernetes.security.privileged-container.privileged-container
pattern-either:
- patterns:
- pattern-inside: |
containers:
...
- pattern: |
image: ...
...
securityContext:
...
privileged: true
- patterns:
- pattern-inside: |
spec:
...
- pattern-not-inside: |
image: ...
...
- pattern: |
privileged: true
message: Container or pod is running in privileged mode. This grants the container
the equivalent of root capabilities on the host machine. This can lead to container
escapes, privilege escalation, and other security concerns. Remove the 'privileged'
key to disable this capability.
metadata:
cwe:
- 'CWE-250: Execution with Unnecessary Privileges'
references:
- https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privileged
- https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
- https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html
category: security
technology:
- kubernetes
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/yaml.kubernetes.security.privileged-container.privileged-container
shortlink: https://sg.run/Ygr5
semgrep.dev:
rule:
r_id: 10058
rv_id: 947059
rule_id: oqUz2p
version_id: gETeWJA
url: https://semgrep.dev/playground/r/gETeWJA/yaml.kubernetes.security.privileged-container.privileged-container
origin: community
languages:
- yaml
severity: WARNING
- id: yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled
patterns:
- pattern-inside: |
containers:
...
- pattern: |
image: ...
...
securityContext:
...
seccompProfile: unconfined
message: 'Container is explicitly disabling seccomp confinement. This runs the service
in an unrestricted state. Remove ''seccompProfile: unconfined'' to prevent this.'
metadata:
cwe:
- 'CWE-284: Improper Access Control'
references:
- https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp
- https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
category: security
technology:
- kubernetes
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled
shortlink: https://sg.run/6rgY
semgrep.dev:
rule:
r_id: 10059
rv_id: 1263941
rule_id: zdUynw
version_id: w8TRoL3
url: https://semgrep.dev/playground/r/w8TRoL3/yaml.kubernetes.security.seccomp-confinement-disabled.seccomp-confinement-disabled
origin: community
languages:
- yaml
severity: WARNING
- id: python.lang.security.dangerous-globals-use.dangerous-globals-use
patterns:
- pattern-either:
- pattern: globals().get(...)
- pattern: locals().get(...)
- pattern: globals()[...]
- pattern: locals()[...]
- patterns:
- pattern-either:
- pattern-inside: |
$G = globals()
...
- pattern-inside: |
$G = locals()
...
- pattern-either:
- pattern: $G.get(...)
- pattern: $G[...]
- pattern: $FUNC.__globals__[...]
- pattern-not: globals().get("...")
- pattern-not: locals().get("...")
- pattern-not: globals()["..."]
- pattern-not: locals()["..."]
- pattern-not: $G.get("...")
- pattern-not: $G.get["..."]
- pattern-not: $G["..."]
- pattern-not: $FUNC.__globals__["..."]
- pattern-not-inside: globals()[...] = ...
- pattern-not-inside: locals()[...] = ...
- pattern-not-inside: $G[...] = ...
- pattern-not-inside: $FUNC.__globals__[...] = ...
message: Found non static data as an index to 'globals()'. This is extremely dangerous
because it allows an attacker to execute arbitrary code on the system. Refactor
your code not to use 'globals()'.
metadata:
cwe:
- 'CWE-96: Improper Neutralization of Directives in Statically Saved Code (''Static
Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186
category: security
technology:
- python
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/python.lang.security.dangerous-globals-use.dangerous-globals-use
shortlink: https://sg.run/jNzn
semgrep.dev:
rule:
r_id: 10065
rv_id: 1263522
rule_id: 9AUOZP
version_id: YDTZeB4
url: https://semgrep.dev/playground/r/YDTZeB4/python.lang.security.dangerous-globals-use.dangerous-globals-use
origin: community
severity: WARNING
languages:
- python
- id: java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell
patterns:
- pattern-either:
- pattern: |
$SHELL.parse(...)
- pattern: |
$SHELL.evaluate(...)
- pattern: |
$SHELL.parseClass(...)
- pattern-either:
- pattern-inside: |
groovy.lang.GroovyShell $SHELL = ...;
...
- pattern-inside: |
groovy.lang.GroovyClassLoader $SHELL = ...;
...
- pattern-not: |
$SHELL.parse("...",...)
- pattern-not: |
$SHELL.evaluate("...",...)
- pattern-not: |
$SHELL.parseClass("...",...)
message: A expression is built with a dynamic value. The source of the value(s)
should be verified to avoid that unfiltered values fall into this risky code evaluation.
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#GROOVY_SHELL
category: security
technology:
- groovy
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell
shortlink: https://sg.run/58LK
semgrep.dev:
rule:
r_id: 10091
rv_id: 1263020
rule_id: ReUPKp
version_id: zyTb2Nq
url: https://semgrep.dev/playground/r/zyTb2Nq/java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell
origin: community
languages:
- java
severity: WARNING
- id: yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster
pattern: |
cluster:
...
insecure-skip-tls-verify: true
message: 'Cluster is disabling TLS certificate verification when communicating with
the server. This makes your HTTPS connections insecure. Remove the ''insecure-skip-tls-verify:
true'' key to secure communication.'
metadata:
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
references:
- https://kubernetes.io/docs/reference/config-api/client-authentication.v1beta1/#client-authentication-k8s-io-v1beta1-Cluster
category: security
technology:
- kubernetes
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster
shortlink: https://sg.run/okyn
semgrep.dev:
rule:
r_id: 10116
rv_id: 1263943
rule_id: zdUyWx
version_id: O9Tpxbo
url: https://semgrep.dev/playground/r/O9Tpxbo/yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster
origin: community
languages:
- yaml
severity: WARNING
- id: yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service
pattern: |
spec:
...
insecureSkipTLSVerify: true
message: 'Service is disabling TLS certificate verification when communicating with
the server. This makes your HTTPS connections insecure. Remove the ''insecureSkipTLSVerify:
true'' key to secure communication.'
metadata:
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
references:
- https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#apiservice-v1-apiregistration-k8s-io
category: security
technology:
- kubernetes
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service
shortlink: https://sg.run/zk10
semgrep.dev:
rule:
r_id: 10117
rv_id: 1263944
rule_id: pKUGXr
version_id: e1TyjnR
url: https://semgrep.dev/playground/r/e1TyjnR/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service
origin: community
languages:
- yaml
severity: WARNING
- id: python.flask.security.flask-api-method-string-format.flask-api-method-string-format
patterns:
- pattern-either:
- pattern: |
def $METHOD(...,$ARG,...):
...
$STRING = "...".format(...,$ARG,...)
...
... = requests.$REQMETHOD($STRING,...)
- pattern: |
def $METHOD(...,$ARG,...):
...
... = requests.$REQMETHOD("...".format(...,$ARG,...),...)
- pattern-inside: |
class $CLASS(...):
method_decorators = ...
...
message: Method $METHOD in API controller $CLASS provides user arg $ARG to requests
method $REQMETHOD
severity: ERROR
languages:
- python
metadata:
cwe:
- 'CWE-134: Use of Externally-Controlled Format String'
category: security
technology:
- flask
references:
- https://cwe.mitre.org/data/definitions/134.html
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/python.flask.security.flask-api-method-string-format.flask-api-method-string-format
shortlink: https://sg.run/bDWr
semgrep.dev:
rule:
r_id: 10126
rv_id: 946219
rule_id: NbUAeY
version_id: WrTEo0r
url: https://semgrep.dev/playground/r/WrTEo0r/python.flask.security.flask-api-method-string-format.flask-api-method-string-format
origin: community
- id: yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume
patterns:
- pattern-inside: |
version: ...
...
- pattern-either:
- pattern: |
volumes:
- ...
- /var/run/docker.sock:/var/run/docker.sock
- ...
- pattern: |
volumes:
- ...
- /run/docker.sock:/run/docker.sock
- ...
- pattern: |
volumes:
- ...
- /var/run/docker.sock:/run/docker.sock
- ...
- pattern: |
volumes:
- ...
- /run/docker.sock:/var/run/docker.sock
- ...
- pattern: |
volumes:
- ...
- /var/run/docker.sock
- ...
- pattern: |
volumes:
- ...
- /run/docker.sock
- ...
- pattern: |
volumes:
- ...
- ...
source: /var/run/docker.sock
...
- ...
- pattern: |
volumes:
- ...
- ...
source: /run/docker.sock
...
- ...
message: Exposing host's Docker socket to containers via a volume. The owner of
this socket is root. Giving someone access to it is equivalent to giving unrestricted
root access to your host. Remove 'docker.sock' from volumes to prevent this.
metadata:
references:
- https://docs.docker.com/compose/compose-file/compose-file-v3/#volume-configuration-reference
- https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers
category: security
technology:
- docker-compose
cwe:
- 'CWE-250: Execution with Unnecessary Privileges'
owasp:
- A06:2017 - Security Misconfiguration
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume
shortlink: https://sg.run/O14b
semgrep.dev:
rule:
r_id: 10131
rv_id: 1263920
rule_id: eqUvZ9
version_id: DkTRbje
url: https://semgrep.dev/playground/r/DkTRbje/yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume
origin: community
languages:
- yaml
severity: WARNING
- id: yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service
patterns:
- pattern-inside: |
version: ...
...
services:
...
- pattern: |
$SERVICE:
...
image: ...
...
- pattern-not: |
$SERVICE:
...
image: ...
...
read_only: true
- focus-metavariable: $SERVICE
message: 'Service ''$SERVICE'' is running with a writable root filesystem. This
may allow malicious applications to download and run additional payloads, or modify
container files. If an application inside a container has to save something temporarily
consider using a tmpfs. Add ''read_only: true'' to this service to prevent this.'
metadata:
cwe:
- 'CWE-732: Incorrect Permission Assignment for Critical Resource'
owasp:
- A05:2021 - Security Misconfiguration
- A06:2017 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
references:
- https://docs.docker.com/compose/compose-file/compose-file-v3/#domainname-hostname-ipc-mac_address-privileged-read_only-shm_size-stdin_open-tty-user-working_dir
- https://blog.atomist.com/security-of-docker-kubernetes/
- https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-8-set-filesystem-and-volumes-to-read-only
category: security
technology:
- docker-compose
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service
shortlink: https://sg.run/e4JE
semgrep.dev:
rule:
r_id: 10132
rv_id: 1263925
rule_id: v8U5vN
version_id: l4TJR0w
url: https://semgrep.dev/playground/r/l4TJR0w/yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service
origin: community
languages:
- yaml
severity: WARNING
- id: yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath
patterns:
- pattern-inside: |
volumes:
...
- pattern: |
hostPath:
...
path: /var/run/docker.sock
message: Exposing host's Docker socket to containers via a volume. The owner of
this socket is root. Giving someone access to it is equivalent to giving unrestricted
root access to your host. Remove 'docker.sock' from hostpath to prevent this.
metadata:
cwe:
- 'CWE-250: Execution with Unnecessary Privileges'
references:
- https://kubernetes.io/docs/concepts/storage/volumes/#hostpath
- https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems
- https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
- https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers
category: security
technology:
- kubernetes
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath
shortlink: https://sg.run/v0pR
semgrep.dev:
rule:
r_id: 10133
rv_id: 947054
rule_id: d8Uz6v
version_id: nWTpYZe
url: https://semgrep.dev/playground/r/nWTpYZe/yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath
origin: community
languages:
- yaml
severity: WARNING
- id: yaml.kubernetes.security.run-as-non-root.run-as-non-root
patterns:
- pattern-inside: |
$SPEC:
...
containers:
...
...
- metavariable-regex:
metavariable: $SPEC
regex: ^(spec)$
- pattern-not-inside: |
spec:
...
securityContext:
...
...
- pattern-inside: |
$SPEC:
...
containers:
...
- pattern-not-inside: |
$SPEC:
...
containers:
...
- name: $NAME
image: ...
...
securityContext:
...
runAsNonRoot: $VALUE
- focus-metavariable: $SPEC
fix: |
$SPEC:
securityContext:
runAsNonRoot: true #
message: When running containers in Kubernetes, it's important to ensure that they are
properly secured to prevent privilege escalation attacks. One potential vulnerability
is when a container is allowed to run applications as the root user, which could
allow an attacker to gain access to sensitive resources. To mitigate this risk,
it's recommended to add a `securityContext` to the container, with the parameter
`runAsNonRoot` set to `true`. This will ensure that the container runs as a non-root
user, limiting the damage that could be caused by any potential attacks. By adding
a `securityContext` to the container in your Kubernetes pod, you can help to
ensure that your containerized applications are more secure and less vulnerable
to privilege escalation attacks.
metadata:
references:
- https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/
- https://kubernetes.io/docs/concepts/policy/pod-security-policy/
- https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user
category: security
cwe:
- 'CWE-250: Execution with Unnecessary Privileges'
owasp:
- A05:2021 - Security Misconfiguration
- A06:2017 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
technology:
- kubernetes
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/yaml.kubernetes.security.run-as-non-root.run-as-non-root
shortlink: https://sg.run/dgP5
semgrep.dev:
rule:
r_id: 10134
rv_id: 1263940
rule_id: ZqUqeK
version_id: kbTzGbo
url: https://semgrep.dev/playground/r/kbTzGbo/yaml.kubernetes.security.run-as-non-root.run-as-non-root
origin: community
languages:
- yaml
severity: INFO
- id: yaml.kubernetes.security.hostipc-pod.hostipc-pod
patterns:
- pattern-inside: |
spec:
...
- pattern: |
hostIPC: true
message: Pod is sharing the host IPC namespace. This allows container processes
to communicate with processes on the host which reduces isolation and bypasses
container protection models. Remove the 'hostIPC' key to disable this functionality.
metadata:
cwe:
- 'CWE-693: Protection Mechanism Failure'
references:
- https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces
category: security
technology:
- kubernetes
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/yaml.kubernetes.security.hostipc-pod.hostipc-pod
shortlink: https://sg.run/nqGO
semgrep.dev:
rule:
r_id: 10236
rv_id: 947055
rule_id: nJUYPE
version_id: ExTg4KB
url: https://semgrep.dev/playground/r/ExTg4KB/yaml.kubernetes.security.hostipc-pod.hostipc-pod
origin: community
languages:
- yaml
severity: WARNING
- id: yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod
patterns:
- pattern-inside: |
spec:
...
- pattern: |
hostNetwork: true
message: Pod may use the node network namespace. This gives the pod access to the
loopback device, services listening on localhost, and could be used to snoop on
network activity of other pods on the same node. Remove the 'hostNetwork' key
to disable this functionality.
metadata:
cwe:
- 'CWE-406: Insufficient Control of Network Message Volume (Network Amplification)'
references:
- https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces
category: security
technology:
- kubernetes
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod
shortlink: https://sg.run/E51A
semgrep.dev:
rule:
r_id: 10237
rv_id: 947056
rule_id: EwU4NO
version_id: 7ZTreWz
url: https://semgrep.dev/playground/r/7ZTreWz/yaml.kubernetes.security.hostnetwork-pod.hostnetwork-pod
origin: community
languages:
- yaml
severity: WARNING
- id: yaml.kubernetes.security.hostpid-pod.hostpid-pod
patterns:
- pattern-inside: |
spec:
...
- pattern: |
hostPID: true
message: Pod is sharing the host process ID namespace. When paired with ptrace this
can be used to escalate privileges outside of the container. Remove the 'hostPID'
key to disable this functionality.
metadata:
cwe:
- 'CWE-269: Improper Privilege Management'
references:
- https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces
category: security
technology:
- kubernetes
owasp:
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/yaml.kubernetes.security.hostpid-pod.hostpid-pod
shortlink: https://sg.run/708R
semgrep.dev:
rule:
r_id: 10238
rv_id: 1263934
rule_id: 7KUeo0
version_id: 1QTypvL
url: https://semgrep.dev/playground/r/1QTypvL/yaml.kubernetes.security.hostpid-pod.hostpid-pod
origin: community
languages:
- yaml
severity: WARNING
- id: go.lang.security.audit.sqli.gosql-sqli.gosql-sqli
patterns:
- pattern-either:
- patterns:
- pattern: $DB.$METHOD(...,$QUERY,...)
- pattern-either:
- pattern-inside: |
$QUERY = $X + $Y
...
- pattern-inside: |
$QUERY += $X
...
- pattern-inside: |
$QUERY = fmt.Sprintf("...", $PARAM1, ...)
...
- pattern-not-inside: |
$QUERY += "..."
...
- pattern-not-inside: |
$QUERY = "..." + "..."
...
- pattern: $DB.$METHOD(..., $X + $Y, ...)
- pattern: $DB.$METHOD(..., fmt.Sprintf("...", $PARAM1, ...), ...)
- pattern-either:
- pattern-inside: |
$DB, ... = sql.Open(...)
...
- pattern-inside: |
func $FUNCNAME(..., $DB *sql.DB, ...) {
...
}
- pattern-not: $DB.$METHOD(..., "..." + "...", ...)
- metavariable-regex:
metavariable: $METHOD
regex: ^(Exec|ExecContent|Query|QueryContext|QueryRow|QueryRowContext)$
languages:
- go
message: Detected string concatenation with a non-literal variable in a "database/sql"
Go SQL statement. This could lead to SQL injection if the variable is user-controlled
and not properly sanitized. In order to prevent SQL injection, use parameterized
queries or prepared statements instead. You can use prepared statements with the
'Prepare' and 'PrepareContext' calls.
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
references:
- https://golang.org/pkg/database/sql/
category: security
technology:
- go
confidence: LOW
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/go.lang.security.audit.sqli.gosql-sqli.gosql-sqli
shortlink: https://sg.run/YgOX
semgrep.dev:
rule:
r_id: 10258
rv_id: 1262951
rule_id: YGUrnQ
version_id: RGT0Lpr
url: https://semgrep.dev/playground/r/RGT0Lpr/go.lang.security.audit.sqli.gosql-sqli.gosql-sqli
origin: community
severity: ERROR
- id: go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli
patterns:
- pattern-inside: |
import (
...
"$IMPORT"
)
...
- metavariable-regex:
metavariable: $IMPORT
regex: .*go-pg
- pattern-either:
- patterns:
- pattern: $DB.$METHOD(...,$QUERY,...)
- pattern-either:
- pattern-inside: |
$QUERY = $X + $Y
...
- pattern-inside: |
$QUERY += $X
...
- pattern-inside: |
$QUERY = fmt.Sprintf("...", $PARAM1, ...)
...
- pattern-not-inside: |
$QUERY += "..."
...
- pattern-not-inside: |
$QUERY = "..." + "..."
...
- pattern: |
$DB.$INTFUNC1(...).$METHOD(..., $X + $Y, ...).$INTFUNC2(...)
- pattern: |
$DB.$METHOD(..., fmt.Sprintf("...", $PARAM1, ...), ...)
- pattern-inside: |
$DB = pg.Connect(...)
...
- pattern-inside: |
func $FUNCNAME(..., $DB *pg.DB, ...) {
...
}
- pattern-not-inside: |
$QUERY = fmt.Sprintf("...", ...,"...", ...)
...
- pattern-not-inside: |
$QUERY += "..."
...
- pattern-not: $DB.$METHOD(...,"...",...)
- pattern-not: |
$DB.$INTFUNC1(...).$METHOD(..., "...", ...).$INTFUNC2(...)
- pattern-not-inside: |
$QUERY = "..." + "..."
- pattern-not: |
"..."
- pattern-not: path.Join(...)
- pattern-not: filepath.Join(...)
- metavariable-regex:
metavariable: $METHOD
regex: ^(Where|WhereOr|Join|GroupExpr|OrderExpr|ColumnExpr)$
languages:
- go
message: Detected string concatenation with a non-literal variable in a go-pg ORM
SQL statement. This could lead to SQL injection if the variable is user-controlled
and not properly sanitized. In order to prevent SQL injection, do not use strings
concatenated with user-controlled input. Instead, use parameterized statements.
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
references:
- https://pg.uptrace.dev/queries/
category: security
technology:
- go-pg
confidence: LOW
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli
shortlink: https://sg.run/6rA6
semgrep.dev:
rule:
r_id: 10259
rv_id: 1262952
rule_id: 6JUqQ1
version_id: A8Tgdqn
url: https://semgrep.dev/playground/r/A8Tgdqn/go.lang.security.audit.sqli.pg-orm-sqli.pg-orm-sqli
origin: community
severity: ERROR
- id: go.lang.security.audit.sqli.pgx-sqli.pgx-sqli
languages:
- go
message: 'Detected string concatenation with a non-literal variable in a pgx Go
SQL statement. This could lead to SQL injection if the variable is user-controlled
and not properly sanitized. In order to prevent SQL injection, use parameterized
queries instead. You can use parameterized queries like so: (`SELECT $1 FROM table`,
`data1)'
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
references:
- https://github.com/jackc/pgx
- https://pkg.go.dev/github.com/jackc/pgx/v4#hdr-Connection_Pool
category: security
technology:
- pgx
confidence: LOW
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/go.lang.security.audit.sqli.pgx-sqli.pgx-sqli
shortlink: https://sg.run/okKN
semgrep.dev:
rule:
r_id: 10260
rv_id: 1262954
rule_id: oqUz92
version_id: DkTRbkL
url: https://semgrep.dev/playground/r/DkTRbkL/go.lang.security.audit.sqli.pgx-sqli.pgx-sqli
origin: community
patterns:
- pattern-either:
- patterns:
- pattern: $DB.$METHOD(...,$QUERY,...)
- pattern-either:
- pattern-inside: |
$QUERY = $X + $Y
...
- pattern-inside: |
$QUERY += $X
...
- pattern-inside: |
$QUERY = fmt.Sprintf("...", $PARAM1, ...)
...
- pattern-not-inside: |
$QUERY += "..."
...
- pattern-not-inside: |
$QUERY = "..." + "..."
...
- pattern: $DB.$METHOD(..., $X + $Y, ...)
- pattern: $DB.$METHOD(..., fmt.Sprintf("...", $PARAM1, ...), ...)
- pattern-either:
- pattern-inside: |
$DB, ... = pgx.Connect(...)
...
- pattern-inside: |
$DB, ... = pgx.NewConnPool(...)
...
- pattern-inside: |
$DB, ... = pgx.ConnectConfig(...)
...
- pattern-inside: |
func $FUNCNAME(..., $DB *pgx.Conn, ...) {
...
}
- pattern-not: $DB.$METHOD(..., "..." + "...", ...)
- metavariable-regex:
metavariable: $METHOD
regex: ^(Exec|ExecEx|Query|QueryEx|QueryRow|QueryRowEx)$
severity: ERROR
- id: go.lang.security.audit.sqli.pg-sqli.pg-sqli
languages:
- go
message: 'Detected string concatenation with a non-literal variable in a go-pg SQL
statement. This could lead to SQL injection if the variable is user-controlled
and not properly sanitized. In order to prevent SQL injection, use parameterized
queries instead of string concatenation. You can use parameterized queries like
so: ''(SELECT ? FROM table, data1)'''
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
references:
- https://pg.uptrace.dev/
- https://pkg.go.dev/github.com/go-pg/pg/v10
category: security
technology:
- go-pg
confidence: LOW
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/go.lang.security.audit.sqli.pg-sqli.pg-sqli
shortlink: https://sg.run/Al94
semgrep.dev:
rule:
r_id: 10294
rv_id: 1262953
rule_id: AbUWXY
version_id: BjTkZbQ
url: https://semgrep.dev/playground/r/BjTkZbQ/go.lang.security.audit.sqli.pg-sqli.pg-sqli
origin: community
severity: ERROR
patterns:
- pattern-either:
- patterns:
- pattern: |
$DB.$METHOD(...,$QUERY,...)
- pattern-either:
- pattern-inside: |
$QUERY = $X + $Y
...
- pattern-inside: |
$QUERY += $X
...
- pattern-inside: |
$QUERY = fmt.Sprintf("...", $PARAM1, ...)
...
- pattern-not-inside: |
$QUERY += "..."
...
- pattern-not-inside: |
$QUERY = "..." + "..."
...
- pattern: $DB.$METHOD(..., $X + $Y, ...)
- pattern: $DB.$METHOD(..., fmt.Sprintf("...", $PARAM1, ...), ...)
- pattern-either:
- pattern-inside: |
$DB = pg.Connect(...)
...
- pattern-inside: |
func $FUNCNAME(..., $DB *pg.DB, ...) {
...
}
- pattern-not: $DB.$METHOD(..., "..." + "...", ...)
- metavariable-regex:
metavariable: $METHOD
regex: ^(Exec|ExecContext|ExecOne|ExecOneContext|Query|QueryOne|QueryContext|QueryOneContext)$
- id: python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli
languages:
- python
message: 'Detected string concatenation with a non-literal variable in an aiopg
Python SQL statement. This could lead to SQL injection if the variable is user-controlled
and not properly sanitized. In order to prevent SQL injection, use parameterized
queries instead. You can create parameterized queries like so: ''cur.execute("SELECT
%s FROM table", (user_value,))''.'
metadata:
references:
- https://github.com/aio-libs/aiopg
category: security
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aiopg
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli
shortlink: https://sg.run/WgGL
semgrep.dev:
rule:
r_id: 10309
rv_id: 1263512
rule_id: DbUWRY
version_id: GxTke3z
url: https://semgrep.dev/playground/r/GxTke3z/python.lang.security.audit.sqli.aiopg-sqli.aiopg-sqli
origin: community
patterns:
- pattern-either:
- patterns:
- pattern: $CUR.$METHOD(...,$QUERY,...)
- pattern-either:
- pattern-inside: |
$QUERY = $X + $Y
...
- pattern-inside: |
$QUERY += $X
...
- pattern-inside: |
$QUERY = '...'.format(...)
...
- pattern-inside: |
$QUERY = '...' % (...)
...
- pattern-inside: |
$QUERY = f'...{$USERINPUT}...'
...
- pattern-not-inside: |
$QUERY += "..."
...
- pattern-not-inside: |
$QUERY = "..." + "..."
...
- pattern-not-inside: |
$QUERY = '...'.format()
...
- pattern-not-inside: |
$QUERY = '...' % ()
...
- pattern: $CUR.$METHOD(..., $X + $Y, ...)
- pattern: $CUR.$METHOD(..., '...'.format(...), ...)
- pattern: $CUR.$METHOD(..., '...' % (...), ...)
- pattern: $CUR.$METHOD(..., f'...{$USERINPUT}...', ...)
- pattern-either:
- pattern-inside: |
$CONN = await aiopg.connect(...)
...
$CUR = await $CONN.cursor(...)
...
- pattern-inside: |
$POOL = await aiopg.create_pool(...)
...
async with $POOL.acquire(...) as $CONN:
...
async with $CONN.cursor(...) as $CUR:
...
- pattern-inside: |
$POOL = await aiopg.create_pool(...)
...
with (await $POOL.cursor(...)) as $CUR:
...
- pattern-inside: |
$POOL = await aiopg.create_pool(...)
...
async with $POOL as $CONN:
...
$CUR = await $CONN.cursor(...)
...
- pattern-inside: |
$POOL = await aiopg.create_pool(...)
...
async with $POOL.cursor(...) as $CUR:
...
- pattern-not: $CUR.$METHOD(..., "..." + "...", ...)
- pattern-not: $CUR.$METHOD(..., '...'.format(), ...)
- pattern-not: $CUR.$METHOD(..., '...'%(), ...)
- metavariable-regex:
metavariable: $METHOD
regex: ^(execute)$
severity: WARNING
- id: python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli
languages:
- python
message: 'Detected string concatenation with a non-literal variable in a asyncpg
Python SQL statement. This could lead to SQL injection if the variable is user-controlled
and not properly sanitized. In order to prevent SQL injection, use parameterized
queries or prepared statements instead. You can create parameterized queries like
so: ''conn.fetch("SELECT $1 FROM table", value)''. You can also create prepared
statements with ''Connection.prepare'': ''stmt = conn.prepare("SELECT $1 FROM
table"); await stmt.fetch(user_value)'''
metadata:
references:
- https://github.com/MagicStack/asyncpg
- https://magicstack.github.io/asyncpg/current/
category: security
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- asyncpg
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli
shortlink: https://sg.run/0nBB
semgrep.dev:
rule:
r_id: 10310
rv_id: 1263513
rule_id: WAUZqq
version_id: RGT0L8K
url: https://semgrep.dev/playground/r/RGT0L8K/python.lang.security.audit.sqli.asyncpg-sqli.asyncpg-sqli
origin: community
patterns:
- pattern-either:
- patterns:
- pattern: $CONN.$METHOD(...,$QUERY,...)
- pattern-either:
- pattern-inside: |
$QUERY = $X + $Y
...
- pattern-inside: |
$QUERY += $X
...
- pattern-inside: |
$QUERY = '...'.format(...)
...
- pattern-inside: |
$QUERY = '...' % (...)
...
- pattern-inside: |
$QUERY = f'...{$USERINPUT}...'
...
- pattern-not-inside: |
$QUERY += "..."
...
- pattern-not-inside: |
$QUERY = "..." + "..."
...
- pattern-not-inside: |
$QUERY = '...'.format()
...
- pattern-not-inside: |
$QUERY = '...' % ()
...
- pattern: $CONN.$METHOD(..., $X + $Y, ...)
- pattern: $CONN.$METHOD(..., $Y.format(...), ...)
- pattern: $CONN.$METHOD(..., '...'.format(...), ...)
- pattern: $CONN.$METHOD(..., '...' % (...), ...)
- pattern: $CONN.$METHOD(..., f'...{$USERINPUT}...', ...)
- pattern-either:
- pattern-inside: |
$CONN = await asyncpg.connect(...)
...
- pattern-inside: |
async with asyncpg.create_pool(...) as $CONN:
...
- pattern-inside: |
async with $POOL.acquire(...) as $CONN:
...
- pattern-inside: |
$CONN = await $POOL.acquire(...)
...
- pattern-inside: |
def $FUNCNAME(..., $CONN: Connection, ...):
...
- pattern-inside: |
def $FUNCNAME(..., $CONN: asyncpg.Connection, ...):
...
- pattern-not: $CONN.$METHOD(..., "..." + "...", ...)
- pattern-not: $CONN.$METHOD(..., '...'.format(), ...)
- pattern-not: $CONN.$METHOD(..., '...'%(), ...)
- metavariable-regex:
metavariable: $METHOD
regex: ^(fetch|fetchrow|fetchval|execute|executemany|prepare|cursor|copyfromquery)$
severity: WARNING
- id: python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli
languages:
- python
message: 'Detected string concatenation with a non-literal variable in a pg8000
Python SQL statement. This could lead to SQL injection if the variable is user-controlled
and not properly sanitized. In order to prevent SQL injection, use parameterized
queries or prepared statements instead. You can create parameterized queries like
so: ''conn.run("SELECT :value FROM table", value=myvalue)''. You can also create
prepared statements with ''conn.prepare'': ''conn.prepare("SELECT (:v) FROM table")'''
metadata:
references:
- https://github.com/tlocke/pg8000
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
category: security
technology:
- pg8000
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli
shortlink: https://sg.run/KWAL
semgrep.dev:
rule:
r_id: 10311
rv_id: 1263514
rule_id: 0oUEKo
version_id: A8TgdKN
url: https://semgrep.dev/playground/r/A8TgdKN/python.lang.security.audit.sqli.pg8000-sqli.pg8000-sqli
origin: community
patterns:
- pattern-either:
- patterns:
- pattern: $CONN.$METHOD(...,$QUERY,...)
- pattern-either:
- pattern-inside: |
$QUERY = $X + $Y
...
- pattern-inside: |
$QUERY += $X
...
- pattern-inside: |
$QUERY = '...'.format(...)
...
- pattern-inside: |
$QUERY = '...' % (...)
...
- pattern-inside: |
$QUERY = f'...{$USERINPUT}...'
...
- pattern-not-inside: |
$QUERY += "..."
...
- pattern-not-inside: |
$QUERY = "..." + "..."
...
- pattern-not-inside: |
$QUERY = '...'.format()
...
- pattern-not-inside: |
$QUERY = '...' % ()
...
- pattern: $CONN.$METHOD(..., $X + $Y, ...)
- pattern: $CONN.$METHOD(..., '...'.format(...), ...)
- pattern: $CONN.$METHOD(..., '...' % (...), ...)
- pattern: $CONN.$METHOD(..., f'...{$USERINPUT}...', ...)
- pattern-either:
- pattern-inside: |
$CONN = pg8000.native.Connection(...)
...
- pattern-inside: |
$CONN = pg8000.dhapi.connect(...)
...
- pattern-inside: |
$CONN1 = pg8000.connect(...)
...
$CONN = $CONN1.cursor(...)
...
- pattern-inside: |
$CONN = pg8000.connect(...)
...
- pattern-not: $CONN.$METHOD(..., "..." + "...", ...)
- pattern-not: $CONN.$METHOD(..., '...'.format(), ...)
- pattern-not: $CONN.$METHOD(..., '...'%(), ...)
- metavariable-regex:
metavariable: $METHOD
regex: ^(run|execute|executemany|prepare)$
severity: WARNING
- id: python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli
languages:
- python
message: 'Detected string concatenation with a non-literal variable in a psycopg2
Python SQL statement. This could lead to SQL injection if the variable is user-controlled
and not properly sanitized. In order to prevent SQL injection, use parameterized
queries or prepared statements instead. You can use prepared statements by creating
a ''sql.SQL'' string. You can also use the pyformat binding style to create parameterized
queries. For example: ''cur.execute(SELECT * FROM table WHERE name=%s, user_input)'''
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
references:
- https://www.psycopg.org/docs/sql.html
category: security
technology:
- psycopg
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli
shortlink: https://sg.run/qrLe
semgrep.dev:
rule:
r_id: 10312
rv_id: 1263515
rule_id: KxU4Kg
version_id: BjTkZl1
url: https://semgrep.dev/playground/r/BjTkZl1/python.lang.security.audit.sqli.psycopg-sqli.psycopg-sqli
origin: community
patterns:
- pattern-either:
- patterns:
- pattern: $CUR.$METHOD(...,$QUERY,...)
- pattern-either:
- pattern-inside: |
$QUERY = $X + $Y
...
- pattern-inside: |
$QUERY += $X
...
- pattern-inside: |
$QUERY = '...'.format(...)
...
- pattern-inside: |
$QUERY = '...' % (...)
...
- pattern-inside: |
$QUERY = f'...{$USERINPUT}...'
...
- pattern-not-inside: |
$QUERY += "..."
...
- pattern-not-inside: |
$QUERY = "..." + "..."
...
- pattern-not-inside: |
$QUERY = '...'.format()
...
- pattern-not-inside: |
$QUERY = '...' % ()
...
- pattern: $CUR.$METHOD(..., $X + $Y, ...)
- pattern: $CUR.$METHOD(..., '...'.format(...), ...)
- pattern: $CUR.$METHOD(..., '...' % (...), ...)
- pattern: $CUR.$METHOD(..., f'...{$USERINPUT}...', ...)
- pattern-either:
- pattern-inside: |
$CONN = psycopg2.connect(...)
...
$CUR = $CONN.cursor(...)
...
- pattern-inside: |
$CONN = psycopg2.connect(...)
...
with $CONN.cursor(...) as $CUR:
...
- pattern-not: $CUR.$METHOD(..., "..." + "...", ...)
- pattern-not: $CUR.$METHOD(..., '...'.format(), ...)
- pattern-not: $CUR.$METHOD(..., '...'%(), ...)
- metavariable-regex:
metavariable: $METHOD
regex: ^(execute|executemany|mogrify)$
severity: WARNING
- id: ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli
mode: taint
pattern-propagators:
- pattern: $X << $Y
from: $Y
to: $X
pattern-sources:
- pattern-either:
- pattern: |
params
- pattern: |
cookies
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
$CON = PG.connect(...)
...
- pattern-inside: |
$CON = PG::Connection.open(...)
...
- pattern-inside: |
$CON = PG::Connection.new(...)
...
- pattern-either:
- pattern: |
$CON.$METHOD($X,...)
- pattern: |
$CON.$METHOD $X, ...
- focus-metavariable: $X
- metavariable-regex:
metavariable: $METHOD
regex: ^(exec|exec_params)$
languages:
- ruby
message: 'Detected string concatenation with a non-literal variable in a pg Ruby
SQL statement. This could lead to SQL injection if the variable is user-controlled
and not properly sanitized. In order to prevent SQL injection, use parameterized
queries or prepared statements instead. You can use parameterized queries like
so: `conn.exec_params(''SELECT $1 AS a, $2 AS b, $3 AS c'', [1, 2, nil])` And
you can use prepared statements with `exec_prepared`.'
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://www.rubydoc.info/gems/pg/PG/Connection
category: security
technology:
- rails
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli
shortlink: https://sg.run/kL0o
semgrep.dev:
rule:
r_id: 10328
rv_id: 1263628
rule_id: NbUAz7
version_id: 2KTv2y2
url: https://semgrep.dev/playground/r/2KTv2y2/ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli
origin: community
severity: WARNING
- id: java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled
pattern: management.endpoints.web.exposure.include=*
message: Spring Boot Actuator is fully enabled. This exposes sensitive endpoints
such as /actuator/env, /actuator/logfile, /actuator/heapdump and others. Unless
you have Spring Security enabled or another means to protect these endpoints,
this functionality is available without authentication, causing a significant
security risk.
severity: ERROR
languages:
- generic
paths:
include:
- '*properties'
metadata:
cwe:
- 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html#production-ready-endpoints-exposing-endpoints
- https://medium.com/walmartglobaltech/perils-of-spring-boot-actuators-misconfiguration-185c43a0f785
- https://blog.maass.xyz/spring-actuator-security-part-1-stealing-secrets-using-spring-actuators
category: security
technology:
- spring
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled
shortlink: https://sg.run/L0vY
semgrep.dev:
rule:
r_id: 10439
rv_id: 1263077
rule_id: EwU4vg
version_id: xyTjzwp
url: https://semgrep.dev/playground/r/xyTjzwp/java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled
origin: community
- id: generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling
patterns:
- pattern-either:
- pattern: |
proxy_http_version 1.1 ...;
...
proxy_set_header Upgrade ...;
...
proxy_set_header Connection ...;
- pattern: |
proxy_set_header Upgrade ...;
...
proxy_set_header Connection ...;
...
proxy_http_version 1.1 ...;
- pattern: |
proxy_set_header Upgrade ...;
...
proxy_http_version 1.1 ...;
...
proxy_set_header Connection ...;
- pattern-inside: |
location ... {
...
}
languages:
- generic
severity: WARNING
message: 'Conditions for Nginx H2C smuggling identified. H2C smuggling allows upgrading
HTTP/1.1 connections to lesser-known HTTP/2 over cleartext (h2c) connections which
can allow a bypass of reverse proxy access controls, and lead to long-lived, unrestricted
HTTP traffic directly to back-end servers. To mitigate: WebSocket support required:
Allow only the value websocket for HTTP/1.1 upgrade headers (e.g., Upgrade: websocket).
WebSocket support not required: Do not forward Upgrade headers.'
paths:
include:
- '*.conf'
- '*.vhost'
- '**/sites-available/*'
- '**/sites-enabled/*'
metadata:
cwe:
- 'CWE-444: Inconsistent Interpretation of HTTP Requests (''HTTP Request/Response
Smuggling'')'
references:
- https://labs.bishopfox.com/tech-blog/h2c-smuggling-request-smuggling-via-http/2-cleartext-h2c
category: security
technology:
- nginx
confidence: MEDIUM
owasp:
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling
shortlink: https://sg.run/ploZ
semgrep.dev:
rule:
r_id: 10562
rv_id: 1262679
rule_id: 6JUq0Z
version_id: nWT2Lyp
url: https://semgrep.dev/playground/r/nWT2Lyp/generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling
origin: community
- id: python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query
message: 'Avoiding SQL string concatenation: untrusted input concatenated with raw
SQL query can result in SQL Injection. In order to execute raw query safely, prepared
statement should be used. SQLAlchemy provides TextualSQL to easily used prepared
statement with named parameters. For complex SQL composition, use SQL Expression
Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be
a better option.'
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql
- https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm
- https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column
category: security
technology:
- sqlalchemy
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query
shortlink: https://sg.run/2b1L
semgrep.dev:
rule:
r_id: 10563
rv_id: 1263578
rule_id: oqUz5y
version_id: bZT53rp
url: https://semgrep.dev/playground/r/bZT53rp/python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query
origin: community
severity: ERROR
languages:
- python
pattern-either:
- pattern: |
$CONNECTION.execute( $SQL + ..., ... )
- pattern: |
$CONNECTION.execute( $SQL % (...), ...)
- pattern: |
$CONNECTION.execute( $SQL.format(...), ... )
- pattern: |
$CONNECTION.execute(f"...{...}...", ...)
- patterns:
- pattern-inside: |
$QUERY = $SQL + ...
...
- pattern: |
$CONNECTION.execute($QUERY, ...)
- patterns:
- pattern-inside: |
$QUERY = $SQL % (...)
...
- pattern: |
$CONNECTION.execute($QUERY, ...)
- patterns:
- pattern-inside: |
$QUERY = $SQL.format(...)
...
- pattern: |
$CONNECTION.execute($QUERY, ...)
- patterns:
- pattern-inside: |
$QUERY = f"...{...}..."
...
- pattern: |
$CONNECTION.execute($QUERY, ...)
- id: javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli
message: 'Detected string concatenation with a non-literal variable in a node-postgres
JS SQL statement. This could lead to SQL injection if the variable is user-controlled
and not properly sanitized. In order to prevent SQL injection, use parameterized
queries or prepared statements instead. You can use parameterized statements like
so: `client.query(''SELECT $1 from table'', [userinput])`'
metadata:
owasp:
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object
Attributes'
references:
- https://node-postgres.com/features/queries
category: security
technology:
- node-postgres
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mass Assignment
source: https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli
shortlink: https://sg.run/0n3v
semgrep.dev:
rule:
r_id: 10710
rv_id: 1263208
rule_id: ReUPN9
version_id: 5PTo1BA
url: https://semgrep.dev/playground/r/5PTo1BA/javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-inside: |
function ... (...,$FUNC,...) {
...
}
- focus-metavariable: $FUNC
- pattern-not-inside: |
$F. ... .$SOURCE(...)
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
const { $CLIENT } = require('pg')
...
- pattern-inside: |
var { $CLIENT } = require('pg')
...
- pattern-inside: |
let { $CLIENT } = require('pg')
...
- pattern-either:
- pattern-inside: |
$DB = new $CLIENT(...)
...
- pattern-inside: |
$NEWPOOL = new $CLIENT(...)
...
$NEWPOOL.connect((..., $DB, ...) => {
...
})
- pattern: $DB.query($QUERY,...)
- focus-metavariable: $QUERY
- id: csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization
severity: WARNING
languages:
- C#
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
references:
- https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide
category: security
technology:
- .net
confidence: HIGH
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization
shortlink: https://sg.run/ZeXW
semgrep.dev:
rule:
r_id: 11135
rv_id: 1262635
rule_id: bwUOjK
version_id: nWT2LGp
url: https://semgrep.dev/playground/r/nWT2LGp/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization
origin: community
message: The BinaryFormatter type is dangerous and is not recommended for data processing.
Applications should stop using BinaryFormatter as soon as possible, even if they
believe the data they're processing to be trustworthy. BinaryFormatter is insecure
and can't be made secure
patterns:
- pattern-inside: |
using System.Runtime.Serialization.Formatters.Binary;
...
- pattern: |
new BinaryFormatter();
- id: csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization
severity: WARNING
languages:
- C#
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
references:
- https://github.com/mgholam/fastJSON#security-warning-update
category: security
technology:
- .net
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization
shortlink: https://sg.run/nqnd
semgrep.dev:
rule:
r_id: 11136
rv_id: 1262637
rule_id: NbUAwk
version_id: 7ZTE3Wn
url: https://semgrep.dev/playground/r/7ZTE3Wn/csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization
origin: community
message: $type extension has the potential to be unsafe, so use it with common sense
and known json sources and not public facing ones to be safe
patterns:
- pattern-inside: |
using fastJSON;
...
- pattern: |
new JSONParameters
{
BadListTypeChecking = false
}
- id: csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization
severity: WARNING
languages:
- C#
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
references:
- https://mbraceproject.github.io/FsPickler/tutorial.html#Disabling-Subtype-Resolution
category: security
technology:
- .net
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization
shortlink: https://sg.run/E5e5
semgrep.dev:
rule:
r_id: 11137
rv_id: 1262638
rule_id: kxURnR
version_id: LjTkgPk
url: https://semgrep.dev/playground/r/LjTkgPk/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization
origin: community
message: The FsPickler is dangerous and is not recommended for data processing.
Default configuration tend to insecure deserialization vulnerability.
patterns:
- pattern-inside: |
using MBrace.FsPickler.Json;
...
- pattern: |
FsPickler.CreateJsonSerializer();
- id: csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization
severity: WARNING
languages:
- C#
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
references:
- https://docs.microsoft.com/en-us/dotnet/api/system.web.ui.losformatter?view=netframework-4.8
category: security
technology:
- .net
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization
shortlink: https://sg.run/70pG
semgrep.dev:
rule:
r_id: 11138
rv_id: 1262641
rule_id: wdU87G
version_id: QkTGqnA
url: https://semgrep.dev/playground/r/QkTGqnA/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization
origin: community
message: The LosFormatter type is dangerous and is not recommended for data processing.
Applications should stop using LosFormatter as soon as possible, even if they
believe the data they're processing to be trustworthy. LosFormatter is insecure
and can't be made secure
patterns:
- pattern-inside: |
using System.Web.UI;
...
- pattern: |
new LosFormatter();
- id: csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization
severity: WARNING
languages:
- C#
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
references:
- https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.netdatacontractserializer?view=netframework-4.8#security
category: security
technology:
- .net
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization
shortlink: https://sg.run/L0AX
semgrep.dev:
rule:
r_id: 11139
rv_id: 1262642
rule_id: x8UW7x
version_id: 3ZT4X6b
url: https://semgrep.dev/playground/r/3ZT4X6b/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization
origin: community
message: The NetDataContractSerializer type is dangerous and is not recommended
for data processing. Applications should stop using NetDataContractSerializer
as soon as possible, even if they believe the data they're processing to be trustworthy.
NetDataContractSerializer is insecure and can't be made secure
patterns:
- pattern-inside: |
using System.Runtime.Serialization;
...
- pattern: |
new NetDataContractSerializer();
- id: csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization
patterns:
- pattern-either:
- pattern: TypeNameHandling = TypeNameHandling.$TYPEHANDLER
- pattern: |
$SETTINGS.TypeNameHandling = TypeNameHandling.$TYPEHANDLER;
...
JsonConvert.DeserializeObject<$TYPE>(...,$SETTINGS);
- pattern: |
$SETTINGS.TypeNameHandling = TypeNameHandling.$TYPEHANDLER;
...
JsonConvert.DeserializeObject(...,$SETTINGS);
- pattern-inside: |
using Newtonsoft.Json;
...
- metavariable-regex:
metavariable: $TYPEHANDLER
regex: (All|Auto|Objects|Arrays)
message: TypeNameHandling $TYPEHANDLER is unsafe and can lead to arbitrary code
execution in the context of the process. Use a custom SerializationBinder whenever
using a setting other than TypeNameHandling.None.
languages:
- csharp
severity: WARNING
metadata:
category: security
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
references:
- https://www.newtonsoft.com/json/help/html/T_Newtonsoft_Json_TypeNameHandling.htm#remarks
technology:
- .net
- newtonsoft
- json
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization
shortlink: https://sg.run/8n2g
semgrep.dev:
rule:
r_id: 11140
rv_id: 1262643
rule_id: OrUGgl
version_id: 44TEjgG
url: https://semgrep.dev/playground/r/44TEjgG/csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization
origin: community
- id: csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization
severity: WARNING
languages:
- C#
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
references:
- https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.soap.soapformatter?view=netframework-4.8#remarks
category: security
technology:
- .net
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization
shortlink: https://sg.run/gJnR
semgrep.dev:
rule:
r_id: 11141
rv_id: 1262644
rule_id: eqUvND
version_id: PkTR30n
url: https://semgrep.dev/playground/r/PkTR30n/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization
origin: community
message: The SoapFormatter type is dangerous and is not recommended for data processing.
Applications should stop using SoapFormatter as soon as possible, even if they
believe the data they're processing to be trustworthy. SoapFormatter is insecure
and can't be made secure
patterns:
- pattern-inside: |
using System.Runtime.Serialization.Formatters.Soap;
...
- pattern: |
new SoapFormatter();
- id: csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization
severity: ERROR
languages:
- C#
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
references:
- https://docs.microsoft.com/en-us/dotnet/api/system.web.script.serialization.simpletyperesolver?view=netframework-4.8#remarks
category: security
technology:
- .net
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization
shortlink: https://sg.run/0nJq
semgrep.dev:
rule:
r_id: 11198
rv_id: 1262640
rule_id: PeUkrK
version_id: gETB7Jr
url: https://semgrep.dev/playground/r/gETB7Jr/csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization
origin: community
message: The SimpleTypeResolver class is insecure and should not be used. Using
SimpleTypeResolver to deserialize JSON could allow the remote client to execute
malicious code within the app and take control of the web server.
patterns:
- pattern-inside: |
using System.Web.Script.Serialization;
...
- pattern: |
new JavaScriptSerializer((SimpleTypeResolver $RESOLVER))
- id: csharp.lang.security.injections.os-command.os-command-injection
severity: ERROR
languages:
- csharp
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/www-community/attacks/Command_Injection
category: security
technology:
- .net
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/csharp.lang.security.injections.os-command.os-command-injection
shortlink: https://sg.run/Ze6p
semgrep.dev:
rule:
r_id: 11479
rv_id: 1262634
rule_id: 9AUOjg
version_id: ZRTKAGe
url: https://semgrep.dev/playground/r/ZRTKAGe/csharp.lang.security.injections.os-command.os-command-injection
origin: community
message: The software constructs all or part of an OS command using externally-influenced
input from an upstream component, but it does not neutralize or incorrectly neutralizes
special elements that could modify the intended OS command when it is sent to
a downstream component.
patterns:
- pattern-inside: |
using System.Diagnostics;
...
- pattern-inside: |
public $T $F(..., $ARG, ...)
{
...
}
- pattern-either:
- patterns:
- pattern: |
Process.Start($ARG, ...);
- focus-metavariable: $ARG
- patterns:
- pattern-inside: |
Process $PROC = new Process();
...
- pattern-either:
- pattern-inside: |
$PROC.StartInfo.FileName = $ARG;
...
- pattern-inside: |
$PROC.StartInfo.Arguments = <... $ARG ...>;
...
- pattern: |
$PROC.Start();
- patterns:
- patterns:
- pattern-inside: |
ProcessStartInfo $PSINFO = new ProcessStartInfo()
{
...
};
...
- pattern-either:
- pattern-inside: |
FileName = $ARG;
...
- pattern-inside: |
Arguments = <... $ARG ...>;
...
- pattern: |
Process.Start($PSINFO);
- focus-metavariable: $PSINFO
- patterns:
- pattern-inside: |
Process $PROC = new Process()
{
StartInfo = new ProcessStartInfo()
{
...
}
};
...
- pattern-either:
- pattern-inside: |
FileName = $ARG;
...
- pattern-inside: |
Arguments = $ARG;
...
- pattern: |
$PROC.Start();
- id: generic.secrets.security.detected-github-token.detected-github-token
patterns:
- pattern-either:
- pattern: |
$VAR = $SECRET
- pattern: |
$VAR: $SECRET
- pattern: |
$VAR = '$SECRET'
- pattern: |
$VAR: '$SECRET'
- pattern: |
'$VAR' = '$SECRET'
- pattern: |
'$VAR': '$SECRET'
- pattern: |
"[hH][tT][tT][pP][sS]?://.*$SECRET.*"
- metavariable-regex:
metavariable: $SECRET
regex: gh[pousr]_[A-Za-z0-9_]{36,251}
- metavariable-analysis:
analyzer: entropy
metavariable: $SECRET
languages:
- generic
message: GitHub Token detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.blog/changelog/2021-03-04-authentication-token-format-updates/
category: security
technology:
- secrets
- github
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-github-token.detected-github-token
shortlink: https://sg.run/PpOv
semgrep.dev:
rule:
r_id: 11589
rv_id: 1262871
rule_id: eqUv7b
version_id: bZT5397
url: https://semgrep.dev/playground/r/bZT5397/generic.secrets.security.detected-github-token.detected-github-token
origin: community
- id: trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil
message: The `func ($O *$CODEC) ReadRequestBody($ARG $TYPE) error` function does
not handle `nil` argument, as the `ServerCodec` interface requires. An incorrect
implementation could lead to denial of service
languages:
- go
severity: WARNING
metadata:
category: security
cwe: 'CWE-476: NULL Pointer Dereference'
subcategory:
- vuln
confidence: HIGH
likelihood: MEDIUM
impact: LOW
technology:
- --no-technology--
description: Possible incorrect `ServerCodec` interface implementation
references:
- https://github.com/golang/go/blob/go1.15.2/src/net/rpc/server.go#L643-L658
license: AGPL-3.0 license
vulnerability_class:
- Other
source: https://semgrep.dev/r/trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil
shortlink: https://sg.run/lx09
semgrep.dev:
rule:
r_id: 11757
rv_id: 833272
rule_id: QrUp7k
version_id: yeTN1ek
url: https://semgrep.dev/playground/r/yeTN1ek/trailofbits.go.servercodec-readrequestbody-unhandled-nil.servercodec-readrequestbody-unhandled-nil
origin: community
patterns:
- pattern: |
func ($O *$CODEC) ReadRequestBody($ARG $TYPE) error {
...
}
- pattern-not: |
func ($O *$CODEC) ReadRequestBody($ARG $TYPE) error {
...
if $ARG == nil { ... }
...
}
- pattern-not: |
func ($O *$CODEC) ReadRequestBody($ARG $TYPE) error {
...
if $ARG != nil { ... }
...
}
- id: trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast
message: Downcasting or changing sign of an integer with `$CAST_METHOD` method
languages:
- go
severity: WARNING
metadata:
category: security
cwe: 'CWE-681: Incorrect Conversion between Numeric Types'
subcategory:
- audit
confidence: HIGH
likelihood: LOW
impact: MEDIUM
technology:
- --no-technology--
description: Integer underflows
references:
- https://github.com/golang/go/issues/30209
license: AGPL-3.0 license
vulnerability_class:
- Other
source: https://semgrep.dev/r/trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast
shortlink: https://sg.run/65WB
semgrep.dev:
rule:
r_id: 11759
rv_id: 833273
rule_id: 4bU2AZ
version_id: rxTDzNy
url: https://semgrep.dev/playground/r/rxTDzNy/trailofbits.go.string-to-int-signedness-cast.string-to-int-signedness-cast
origin: community
pattern-either:
- patterns:
- metavariable-pattern:
metavariable: $CAST_METHOD
pattern-either:
- pattern: uint8
- pattern: uint16
- pattern: uint32
- pattern: int8
- pattern: int16
- pattern: int32
- pattern-either:
- pattern: |
$X, ... = strconv.Atoi(...)
...
$CAST_METHOD($X)
- pattern: |
$X, ... = strconv.ParseInt(..., ..., 64)
...
$CAST_METHOD($X)
- pattern: |
$X, ... = strconv.ParseUint(..., ..., 64)
...
$CAST_METHOD($X)
- pattern: |
$X, ... = strconv.Atoi(...)
...
uint64($X)
- pattern: |
$X, ... = strconv.ParseInt(..., ..., 64)
...
uint64($X)
- pattern: |
$X, ... = strconv.ParseUint(..., ..., 64)
...
int64($X)
- patterns:
- metavariable-pattern:
metavariable: $CAST_METHOD
pattern-either:
- pattern: uint8
- pattern: uint16
- pattern: int8
- pattern: int16
- pattern-either:
- pattern: |
$X, ... = strconv.ParseInt(..., ..., 32)
...
$CAST_METHOD($X)
- pattern: |
$X, ... = strconv.ParseUint(..., ..., 32)
...
$CAST_METHOD($X)
- pattern: |
$X, ... = strconv.ParseInt(..., ..., 32)
...
uint32($X)
- pattern: |
$X, ... = strconv.ParseUint(..., ..., 32)
...
int32($X)
- patterns:
- metavariable-pattern:
metavariable: $CAST_METHOD
pattern-either:
- pattern: uint8
- pattern: int8
- pattern-either:
- pattern: |
$X, ... = strconv.ParseInt(..., ..., 16)
...
$CAST_METHOD($X)
- pattern: |
$X, ... = strconv.ParseUint(..., ..., 16)
...
$CAST_METHOD($X)
- pattern: |
$X, ... = strconv.ParseInt(..., ..., 16)
...
uint16($X)
- pattern: |
$X, ... = strconv.ParseUint(..., ..., 16)
...
int16($X)
- pattern: |
$X, ... = strconv.ParseInt(..., ..., 8)
...
uint8($X)
- pattern: |
$X, ... = strconv.ParseUint(..., ..., 8)
...
int8($X)
- id: trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied
message: A `sync.Mutex` is copied in function `$FUNC` given that `$T` is value receiver. As
a result, the struct `$T` may not be locked as intended
languages:
- go
severity: ERROR
metadata:
category: security
cwe: 'CWE-688: Function Call With Incorrect Variable or Reference as Argument'
subcategory:
- vuln
confidence: HIGH
likelihood: HIGH
impact: LOW
technology:
- --no-technology--
description: Copying of `sync.Mutex` via value receivers
references:
- https://go101.org/article/concurrent-common-mistakes.html
license: AGPL-3.0 license
vulnerability_class:
- Other
source: https://semgrep.dev/r/trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied
shortlink: https://sg.run/owlR
semgrep.dev:
rule:
r_id: 11760
rv_id: 833274
rule_id: PeUBW1
version_id: bZTBelR
url: https://semgrep.dev/playground/r/bZTBelR/trailofbits.go.sync-mutex-value-copied.sync-mutex-value-copied
origin: community
patterns:
- pattern-either:
- pattern: |
func ($T $TYPE) $FUNC(...){
...
$T.Lock()
...
}
- pattern: |
func ($T $TYPE) $FUNC(...){
...
$T.RLock()
...
}
- pattern-not: |
func ($T2 *$TYPE2) $FUNC(...){
...
}
- id: trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine
message: |
Calling `$WG.Add` inside of an anonymous goroutine may result in `$WG.Wait`
waiting for more or less calls to `$WG.Done()` than expected
languages:
- go
severity: ERROR
metadata:
category: security
cwe: 'CWE-667: Improper Locking'
subcategory:
- vuln
confidence: MEDIUM
likelihood: MEDIUM
impact: MEDIUM
technology:
- --no-technology--
description: Calls to `sync.WaitGroup.Add` inside of anonymous goroutines
references:
- https://go101.org/article/concurrent-common-mistakes.html
license: AGPL-3.0 license
vulnerability_class:
- Other
source: https://semgrep.dev/r/trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine
shortlink: https://sg.run/z98W
semgrep.dev:
rule:
r_id: 11761
rv_id: 833276
rule_id: JDUQ3v
version_id: kbT2l5k
url: https://semgrep.dev/playground/r/kbT2l5k/trailofbits.go.waitgroup-add-called-inside-goroutine.waitgroup-add-called-inside-goroutine
origin: community
patterns:
- pattern-either:
- pattern: |
$WG := &sync.WaitGroup{}
...
go func(...) {
...
$WG.Add(...)
...
}(...)
...
$WG.Wait()
- pattern: |
var $WG sync.WaitGroup
...
go func(...) {
...
$WG.Add(...)
...
}(...)
...
$WG.Wait()
- pattern-not-inside: |
for ... {
...
$WG.Add(...)
...
}
- id: trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop
message: Calling `$WG.Wait()` inside a loop blocks the call to `$WG.Done()`
languages:
- go
severity: WARNING
metadata:
category: security
cwe: 'CWE-667: Improper Locking'
subcategory:
- vuln
confidence: MEDIUM
likelihood: MEDIUM
impact: MEDIUM
technology:
- --no-technology--
description: Calls to `sync.WaitGroup.Wait` inside a loop
references:
- https://go101.org/article/concurrent-common-mistakes.html
license: AGPL-3.0 license
vulnerability_class:
- Other
source: https://semgrep.dev/r/trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop
shortlink: https://sg.run/pkGL
semgrep.dev:
rule:
r_id: 11762
rv_id: 833277
rule_id: 5rU8Po
version_id: w8TAx58
url: https://semgrep.dev/playground/r/w8TAx58/trailofbits.go.waitgroup-wait-inside-loop.waitgroup-wait-inside-loop
origin: community
patterns:
- pattern-either:
- pattern: |
var $WG sync.WaitGroup
...
for ... {
...
go func(...){
...
defer $WG.Done()
...
}()
...
$WG.Wait()
...
}
- pattern: |
$WG := &sync.WaitGroup{}
...
for ... {
...
go func(...){
...
defer $WG.Done()
...
}()
...
$WG.Wait()
...
}
- pattern: |
var $WG sync.WaitGroup
...
for ... {
...
go func(...){
...
$WG.Done()
...
}()
...
$WG.Wait()
...
}
- pattern: |
$WG := &sync.WaitGroup{}
...
for ... {
...
go func(...){
...
$WG.Done()
...
}()
...
$WG.Wait()
...
}
- id: trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal
message: Possible path traversal through `tarfile.open($PATH).extractall()` if the
source tar is controlled by an attacker
languages:
- python
severity: ERROR
metadata:
category: security
cwe: 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
subcategory:
- vuln
confidence: MEDIUM
likelihood: MEDIUM
impact: MEDIUM
technology:
- --no-technology--
description: Potential path traversal in call to `extractall` for a `tarfile`
references:
- https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall
license: AGPL-3.0 license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal
shortlink: https://sg.run/2RLD
semgrep.dev:
rule:
r_id: 11763
rv_id: 833310
rule_id: GdUZxq
version_id: pZTXjAW
url: https://semgrep.dev/playground/r/pZTXjAW/trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal
origin: community
patterns:
- pattern-either:
- pattern: |
with tarfile.open(...) as $TAR:
...
$TAR.extractall(...)
- pattern: |
tarfile.open(...).extractall(...)
- pattern: |
$TAR = tarfile.open(...)
...
$TAR.extractall(...)
- pattern-not: |
with tarfile.open(...) as $TAR:
...
$TAR.extractall(..., members=$MEMBERS, ...)
- pattern-not: |
tarfile.open(...).extractall(..., members=$MEMBERS, ...)
- pattern-not: |
$TAR = tarfile.open(...)
...
$TAR.extractall(..., members=$MEMBERS, ...)
- id: trailofbits.go.racy-append-to-slice.racy-append-to-slice
message: Appending `$SLICE` from multiple goroutines is not concurrency safe
languages:
- go
severity: ERROR
metadata:
category: security
cwe: 'CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization
(''Race Condition'')'
subcategory:
- vuln
confidence: MEDIUM
likelihood: HIGH
impact: MEDIUM
technology:
- --no-technology--
description: Concurrent calls to `append` from multiple goroutines
references:
- https://go.dev/blog/maps#concurrency
license: AGPL-3.0 license
vulnerability_class:
- Other
source: https://semgrep.dev/r/trailofbits.go.racy-append-to-slice.racy-append-to-slice
shortlink: https://sg.run/jkNY
semgrep.dev:
rule:
r_id: 11865
rv_id: 833270
rule_id: ReUoP7
version_id: 1QTPL3x
url: https://semgrep.dev/playground/r/1QTPL3x/trailofbits.go.racy-append-to-slice.racy-append-to-slice
origin: community
patterns:
- pattern: |
$SLICE = append($SLICE, $ITEM)
- pattern-either:
- pattern-inside: |
var $SLICE []$TYPE
...
for ... {
...
go func(...) {
...
$SLICE = append($SLICE, ...)
...
}(...)
...
}
- pattern-inside: |
$SLICE := make([]$TYPE, ...)
...
for ... {
...
go func(...) {
...
$SLICE = append($SLICE, ...)
...
}(...)
...
}
- pattern-not-inside: |
$MUTEX.Lock()
...
$MUTEX.Unlock()
- pattern-not-inside: |
$MUTEX.Lock()
...
defer $MUTEX.Unlock()
...
- id: trailofbits.go.racy-write-to-map.racy-write-to-map
message: Writing `$MAP` from multiple goroutines is not concurrency safe
languages:
- go
severity: ERROR
metadata:
category: security
cwe: 'CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization
(''Race Condition'')'
subcategory:
- vuln
confidence: MEDIUM
likelihood: HIGH
impact: MEDIUM
technology:
- --no-technology--
description: Concurrent writes to the same map in multiple goroutines
references:
- https://go.dev/blog/maps#concurrency
license: AGPL-3.0 license
vulnerability_class:
- Other
source: https://semgrep.dev/r/trailofbits.go.racy-write-to-map.racy-write-to-map
shortlink: https://sg.run/1Gnw
semgrep.dev:
rule:
r_id: 11866
rv_id: 833271
rule_id: AbUGWD
version_id: 9lTJ0qD
url: https://semgrep.dev/playground/r/9lTJ0qD/trailofbits.go.racy-write-to-map.racy-write-to-map
origin: community
patterns:
- pattern: |
$MAP[$KEY] = $VALUE
- pattern-inside: |
$MAP = make(map[$KTYPE]$VTYPE)
...
for ... {
...
go func(...) {
...
$MAP[$KEY] = $VALUE
...
}(...)
...
}
- pattern-not-inside: |
$MUTEX.Lock()
...
$MUTEX.Unlock()
- pattern-not-inside: |
$MUTEX.Lock()
...
defer $MUTEX.Unlock()
...
- id: java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse
metadata:
functional-categories:
- crypto::search::randomness::javax.crypto
cwe:
- 'CWE-323: Reusing a Nonce, Key Pair in Encryption'
category: security
source-rule-url: https://www.youtube.com/watch?v=r1awgAl90wM
technology:
- java
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse
shortlink: https://sg.run/Dww2
semgrep.dev:
rule:
r_id: 11908
rv_id: 1263000
rule_id: GdUZZ3
version_id: 0bTKzGk
url: https://semgrep.dev/playground/r/0bTKzGk/java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse
origin: community
languages:
- java
message: 'GCM IV/nonce is reused: encryption can be totally useless'
patterns:
- pattern-either:
- pattern: new GCMParameterSpec(..., "...".getBytes(...), ...);
- pattern: byte[] $NONCE = "...".getBytes(...); ... new GCMParameterSpec(...,
$NONCE, ...);
severity: ERROR
- id: java.lang.security.audit.java-reverse-shell.java-reverse-shell
patterns:
- pattern-either:
- pattern: |
Socket $S=new Socket(...);
...
InputStream $SI = $S.getInputStream();
...
while(!$S.isClosed())
{
...
while($SI.available()>0)$PO.write($SI.read());
...
$SO.flush();
...
}
- pattern-inside: |
Process $P=new ProcessBuilder(...).redirectErrorStream(true).start();
...
$P.destroy();
message: Semgrep found potential reverse shell behavior
severity: WARNING
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
category: security
technology:
- java
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/java.lang.security.audit.java-reverse-shell.java-reverse-shell
shortlink: https://sg.run/kkrX
semgrep.dev:
rule:
r_id: 11928
rv_id: 1263025
rule_id: KxUY7b
version_id: 1QTyp3Z
url: https://semgrep.dev/playground/r/1QTyp3Z/java.lang.security.audit.java-reverse-shell.java-reverse-shell
origin: community
languages:
- java
- id: typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard
message: 'Unescaped ''.'' character in CORS domain regex $CORS: $PATTERN'
metadata:
cwe:
- 'CWE-183: Permissive List of Allowed Inputs'
category: security
technology:
- cors
owasp:
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard
shortlink: https://sg.run/w13x
semgrep.dev:
rule:
r_id: 11929
rv_id: 1263908
rule_id: qNUbXo
version_id: WrTqKwN
url: https://semgrep.dev/playground/r/WrTqKwN/typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard
origin: community
languages:
- ts
severity: WARNING
patterns:
- pattern-either:
- pattern: $CORS = [...,/$PATTERN/,...]
- pattern: $CORS = /$PATTERN/
- focus-metavariable: $PATTERN
- metavariable-regex:
metavariable: $PATTERN
regex: .+?(?<!\\).\..+(?<!\\)\..+
- metavariable-regex:
metavariable: $CORS
regex: (?i)cors
- id: python.django.security.globals-as-template-context.globals-as-template-context
languages:
- python
message: 'Using ''globals()'' as a context to ''render(...)'' is extremely dangerous.
This exposes Python functions to the template that were not meant to be exposed.
An attacker could use these functions to execute code that was not intended to
run and could compromise the application. (This is server-side template injection
(SSTI)). Do not use ''globals()''. Instead, specify each variable in a dictionary
or ''django.template.Context'' object, like ''{"var1": "hello"}'' and use that
instead.'
metadata:
category: security
cwe:
- 'CWE-96: Improper Neutralization of Directives in Statically Saved Code (''Static
Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.2/ref/settings/#templates
- https://docs.djangoproject.com/en/3.2/topics/templates/#django.template.backends.django.DjangoTemplates
- https://docs.djangoproject.com/en/3.2/ref/templates/api/#rendering-a-context
technology:
- django
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/python.django.security.globals-as-template-context.globals-as-template-context
shortlink: https://sg.run/7GYv
semgrep.dev:
rule:
r_id: 11938
rv_id: 1263381
rule_id: j2UR3n
version_id: O9TpxKJ
url: https://semgrep.dev/playground/r/O9TpxKJ/python.django.security.globals-as-template-context.globals-as-template-context
origin: community
pattern-either:
- pattern: django.shortcuts.render(..., globals(...), ...)
- pattern: django.template.Template.render(..., globals(...), ...)
- patterns:
- pattern-inside: |
$CONTEXT = globals(...)
...
- pattern-either:
- pattern: django.shortcuts.render(..., $CONTEXT, ...)
- pattern: django.template.Template.render(..., $CONTEXT, ...)
severity: ERROR
- id: python.django.security.locals-as-template-context.locals-as-template-context
languages:
- python
message: 'Using ''locals()'' as a context to ''render(...)'' is extremely dangerous.
This exposes Python functions to the template that were not meant to be exposed.
An attacker could use these functions to execute code that was not intended to
run and could compromise the application. (This is server-side template injection
(SSTI)). Do not use ''locals()''. Instead, specify each variable in a dictionary
or ''django.template.Context'' object, like ''{"var1": "hello"}'' and use that
instead.'
metadata:
category: security
cwe:
- 'CWE-96: Improper Neutralization of Directives in Statically Saved Code (''Static
Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.2/ref/settings/#templates
- https://docs.djangoproject.com/en/3.2/topics/templates/#django.template.backends.django.DjangoTemplates
- https://docs.djangoproject.com/en/3.2/ref/templates/api/#rendering-a-context
technology:
- django
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/python.django.security.locals-as-template-context.locals-as-template-context
shortlink: https://sg.run/L8XL
semgrep.dev:
rule:
r_id: 11939
rv_id: 1263410
rule_id: 10Ued2
version_id: 5PTo10w
url: https://semgrep.dev/playground/r/5PTo10w/python.django.security.locals-as-template-context.locals-as-template-context
origin: community
pattern-either:
- pattern: django.shortcuts.render(..., locals(...), ...)
- pattern: django.template.Template.render(..., locals(...), ...)
- patterns:
- pattern-inside: |
$CONTEXT = locals(...)
...
- pattern-either:
- pattern: django.shortcuts.render(..., $CONTEXT, ...)
- pattern: django.template.Template.render(..., $CONTEXT, ...)
severity: ERROR
- id: python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage
patterns:
- pattern: |
$C.__annotations__[$NAME] = $X
- pattern-not: |
$C.__annotations__[$NAME] = "..."
- pattern-not: |
$C.__annotations__[$NAME] = typing.$Y
- metavariable-regex:
metavariable: $X
regex: (?!(int|float|complex|list|tuple|range|str|bytes|bytearray|memoryview|set|frozenset|dict))
message: Annotations passed to `typing.get_type_hints` are evaluated in `globals`
and `locals` namespaces. Make sure that no arbitrary value can be written as the
annotation and passed to `typing.get_type_hints` function.
severity: INFO
metadata:
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
category: security
references:
- https://docs.python.org/3/library/typing.html#typing.get_type_hints
technology:
- python
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage
shortlink: https://sg.run/8R6J
semgrep.dev:
rule:
r_id: 11940
rv_id: 1263456
rule_id: 9AUkR3
version_id: RGT0LZX
url: https://semgrep.dev/playground/r/RGT0LZX/python.lang.security.audit.dangerous-annotations-usage.dangerous-annotations-usage
origin: community
languages:
- python
- id: csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos
severity: WARNING
languages:
- C#
metadata:
cwe:
- 'CWE-1333: Inefficient Regular Expression Complexity'
owasp: A01:2017 - Injection
references:
- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
- https://docs.microsoft.com/en-us/dotnet/standard/base-types/regular-expressions#regular-expression-examples
category: security
technology:
- .net
confidence: MEDIUM
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Denial-of-Service (DoS)
source: https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos
shortlink: https://sg.run/RPyY
semgrep.dev:
rule:
r_id: 12005
rv_id: 945225
rule_id: 4bU2gd
version_id: rxT6rjl
url: https://semgrep.dev/playground/r/rxT6rjl/csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos
origin: community
message: When using `System.Text.RegularExpressions` to process untrusted input,
pass a timeout. A malicious user can provide input to `RegularExpressions` that
abuses the backtracking behaviour of this regular expression engine. This will
lead to excessive CPU usage, causing a Denial-of-Service attack
patterns:
- pattern-inside: |
using System.Text.RegularExpressions;
...
- pattern-either:
- pattern: |
public $T $F($X)
{
Regex $Y = new Regex($P);
...
$Y.Match($X);
}
- pattern: |
public $T $F($X)
{
Regex $Y = new Regex($P, $O);
...
$Y.Match($X);
}
- pattern: |
public $T $F($X)
{
... Regex.Match($X, $P);
}
- pattern: |
public $T $F($X)
{
... Regex.Match($X, $P, $O);
}
- id: python.lang.security.audit.non-literal-import.non-literal-import
patterns:
- pattern: |
importlib.import_module($NAME, ...)
- pattern-not: |
importlib.import_module("...", ...)
message: Untrusted user input in `importlib.import_module()` function allows an
attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()`
or use a whitelist to prevent running untrusted code.
metadata:
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-706: Use of Incorrectly-Resolved Name or Reference'
category: security
technology:
- python
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/python.lang.security.audit.non-literal-import.non-literal-import
shortlink: https://sg.run/y6Jk
semgrep.dev:
rule:
r_id: 12068
rv_id: 1263508
rule_id: AbUGN5
version_id: l4TJRg9
url: https://semgrep.dev/playground/r/l4TJRg9/python.lang.security.audit.non-literal-import.non-literal-import
origin: community
languages:
- python
severity: WARNING
- id: python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle
patterns:
- pattern: |
jsonpickle.decode($PAYLOAD,...)
- pattern-not: |
jsonpickle.decode("...",...)
metadata:
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
references:
- https://github.com/jsonpickle/jsonpickle#jsonpickle
- https://www.exploit-db.com/exploits/49585
category: security
technology:
- jsonpickle
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle
shortlink: https://sg.run/rkNP
semgrep.dev:
rule:
r_id: 12069
rv_id: 1263529
rule_id: BYU7Kp
version_id: jQTn58A
url: https://semgrep.dev/playground/r/jQTn58A/python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle
origin: community
message: Avoid using `jsonpickle`, which is known to lead to code execution vulnerabilities.
When unpickling, the serialized data could be manipulated to run arbitrary code.
Instead, consider serializing the relevant data using `json` module.
languages:
- python
severity: WARNING
- id: python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter
message: Passing a formatted string as first parameter to `format_html` disables
the proper encoding of variables. Any HTML in the first parameter is not encoded.
Using a formatted string as first parameter obscures which parameters are encoded.
Correct use of `format_html` is passing a static format string as first parameter,
and the variables to substitute as subsequent parameters.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.html.format_html
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter
shortlink: https://sg.run/lxQo
semgrep.dev:
rule:
r_id: 12657
rv_id: 1263373
rule_id: v8UjKg
version_id: 9lT4bYd
url: https://semgrep.dev/playground/r/9lT4bYd/python.django.security.audit.xss.formathtml-fstring-parameter.formathtml-fstring-parameter
origin: community
languages:
- python
severity: WARNING
pattern-either:
- pattern: format_html(<... f"..." ...>, ...)
- pattern: format_html("..." % ..., ...)
- pattern: format_html("...".format(...), ...)
- id: python.pymongo.security.mongodb.mongo-client-bad-auth
pattern: |
pymongo.MongoClient(..., authMechanism='MONGODB-CR')
message: Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is
no longer supported by MongoDB 4.0 (see https://api.mongodb.com/python/current/examples/authentication.html
for details).
fix-regex:
regex: MONGODB-CR
replacement: SCRAM-SHA-256
severity: WARNING
languages:
- python
metadata:
cwe:
- 'CWE-477: Use of Obsolete Function'
category: security
technology:
- pymongo
references:
- https://cwe.mitre.org/data/definitions/477.html
subcategory:
- vuln
likelihood: LOW
impact: LOW
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Dangerous Method or Function
source: https://semgrep.dev/r/python.pymongo.security.mongodb.mongo-client-bad-auth
shortlink: https://sg.run/YXRd
semgrep.dev:
rule:
r_id: 12658
rv_id: 946422
rule_id: d8UlOX
version_id: 0bT15XY
url: https://semgrep.dev/playground/r/0bT15XY/python.pymongo.security.mongodb.mongo-client-bad-auth
origin: community
- id: java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor
languages:
- java
metadata:
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
references:
- https://securitylab.github.com/research/swagger-yaml-parser-vulnerability/#snakeyaml-deserialization-vulnerability
category: security
technology:
- snakeyaml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor
shortlink: https://sg.run/L8qY
semgrep.dev:
rule:
r_id: 12683
rv_id: 1263067
rule_id: 6JU67x
version_id: X0Tzynw
url: https://semgrep.dev/playground/r/X0Tzynw/java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor
origin: community
message: Used SnakeYAML org.yaml.snakeyaml.Yaml() constructor with no arguments,
which is vulnerable to deserialization attacks. Use the one-argument Yaml(...)
constructor instead, with SafeConstructor or a custom Constructor as the argument.
patterns:
- pattern: |
$Y = new org.yaml.snakeyaml.Yaml();
...
$Y.load(...);
severity: WARNING
- id: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp
message: RegExp() called with a `$ARG` function argument, this might allow an attacker
to cause a Regular Expression Denial-of-Service (ReDoS) within your application
as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded
regexes instead. If your regex is run on user-controlled input, consider performing
input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck
to verify that the regex does not appear vulnerable to ReDoS.
metadata:
owasp:
- A05:2021 - Security Misconfiguration
- A06:2017 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe:
- 'CWE-1333: Inefficient Regular Expression Complexity'
references:
- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-non-literal-regexp.js
category: security
technology:
- javascript
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Denial-of-Service (DoS)
source: https://semgrep.dev/r/javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp
shortlink: https://sg.run/gr65
semgrep.dev:
rule:
r_id: 12685
rv_id: 1263195
rule_id: zdU1gD
version_id: 5PTo1Yn
url: https://semgrep.dev/playground/r/5PTo1Yn/javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-inside: |
function ... (...,$ARG,...) {...}
- focus-metavariable: $ARG
pattern-sinks:
- patterns:
- pattern-either:
- pattern: new RegExp($ARG, ...)
- pattern: RegExp($ARG, ...)
- pattern-not: RegExp("...", ...)
- pattern-not: new RegExp("...", ...)
- pattern-not: RegExp(/.../, ...)
- pattern-not: new RegExp(/.../, ...)
- id: ocaml.lang.portability.crlf-support.broken-input-line
pattern: |
input_line
message: '''input_line'' leaves a ''\r'' (CR) character when reading lines from
a Windows text file, whose lines end in "\r\n" (CRLF). This is a problem for any
Windows file that is being read either on a Unix-like platform or on Windows in
binary mode. If the code already takes care of removing any trailing ''\r'' after
reading the line, add a ''(* nosemgrep *)'' comment to disable this warning.'
languages:
- ocaml
severity: WARNING
metadata:
category: portability
technology:
- ocaml
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/ocaml.lang.portability.crlf-support.broken-input-line
shortlink: https://sg.run/v2gY
semgrep.dev:
rule:
r_id: 12777
rv_id: 945971
rule_id: DbUKZX
version_id: BjT1Ngb
url: https://semgrep.dev/playground/r/BjT1Ngb/ocaml.lang.portability.crlf-support.broken-input-line
origin: community
- id: ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode
pattern: open_in
fix: open_in_bin
message: '''open_in'' behaves differently on Windows and on Unix-like systems with
respect to line endings. To get the same behavior everywhere, use ''open_in_bin''
or ''open_in_gen [Open_binary]''. If you really want CRLF-to-LF translations to
take place when running on Windows, use ''open_in_gen [Open_text]''.'
languages:
- ocaml
severity: WARNING
metadata:
category: portability
technology:
- ocaml
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode
shortlink: https://sg.run/d0YE
semgrep.dev:
rule:
r_id: 12778
rv_id: 945972
rule_id: WAUPAJ
version_id: DkTNpPw
url: https://semgrep.dev/playground/r/DkTNpPw/ocaml.lang.portability.crlf-support.prefer-read-in-binary-mode
origin: community
- id: ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode
pattern: open_out
fix: open_out_bin
message: '''open_out'' behaves differently on Windows and on Unix-like systems with
respect to line endings. To get the same behavior everywhere, use ''open_out_bin''
or ''open_out_gen [Open_binary]''. If you really want LF-to-CRLF translations
to take place when running on Windows, use ''open_out_gen [Open_text]''.'
languages:
- ocaml
severity: WARNING
metadata:
category: portability
technology:
- ocaml
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode
shortlink: https://sg.run/ZkGw
semgrep.dev:
rule:
r_id: 12779
rv_id: 945973
rule_id: 0oUJY9
version_id: WrTEoXG
url: https://semgrep.dev/playground/r/WrTEoXG/ocaml.lang.portability.crlf-support.prefer-write-in-binary-mode
origin: community
- id: ocaml.lang.portability.slash-tmp.not-portable-tmp-string
pattern: |
"=~/\/tmp/"
message: You should probably use Filename.get_temp_dirname().
languages:
- ocaml
severity: WARNING
metadata:
category: portability
technology:
- ocaml
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/ocaml.lang.portability.slash-tmp.not-portable-tmp-string
shortlink: https://sg.run/Q4ZZ
semgrep.dev:
rule:
r_id: 12786
rv_id: 945974
rule_id: zdU100
version_id: 0bT158q
url: https://semgrep.dev/playground/r/0bT158q/ocaml.lang.portability.slash-tmp.not-portable-tmp-string
origin: community
- id: javascript.express.security.express-data-exfiltration.express-data-exfiltration
message: Depending on the context, user control data in `Object.assign` can cause
web response to include data that it should not have or can lead to a mass assignment
vulnerability.
metadata:
owasp:
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object
Attributes'
references:
- https://en.wikipedia.org/wiki/Mass_assignment_vulnerability
- https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html
category: security
technology:
- express
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mass Assignment
source: https://semgrep.dev/r/javascript.express.security.express-data-exfiltration.express-data-exfiltration
shortlink: https://sg.run/pkpL
semgrep.dev:
rule:
r_id: 12818
rv_id: 1263163
rule_id: ReUo60
version_id: 6xT290x
url: https://semgrep.dev/playground/r/6xT290x/javascript.express.security.express-data-exfiltration.express-data-exfiltration
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- pattern: Object.assign(...)
- id: javascript.lang.security.insecure-object-assign.insecure-object-assign
message: Depending on the context, user control data in `Object.assign` can cause
web response to include data that it should not have or can lead to a mass assignment
vulnerability.
metadata:
cwe:
- 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html
- https://en.wikipedia.org/wiki/Mass_assignment_vulnerability
category: security
technology:
- javascript
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Open Redirect
source: https://semgrep.dev/r/javascript.lang.security.insecure-object-assign.insecure-object-assign
shortlink: https://sg.run/2R0D
semgrep.dev:
rule:
r_id: 12819
rv_id: 1263219
rule_id: AbUGOq
version_id: YDTZezg
url: https://semgrep.dev/playground/r/YDTZezg/javascript.lang.security.insecure-object-assign.insecure-object-assign
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern: JSON.parse(...)
- pattern-not: JSON.parse("...",...)
pattern-sinks:
- pattern: Object.assign(...)
- id: javascript.express.security.express-vm-injection.express-vm-injection
message: Make sure that unverified user data can not reach `$VM`.
metadata:
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
category: security
technology:
- express
cwe2022-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/javascript.express.security.express-vm-injection.express-vm-injection
shortlink: https://sg.run/jkqJ
semgrep.dev:
rule:
r_id: 12821
rv_id: 1263170
rule_id: DbUKPX
version_id: 1QTypXQ
url: https://semgrep.dev/playground/r/1QTypXQ/javascript.express.security.express-vm-injection.express-vm-injection
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern-inside: |
$VM = require('vm');
...
- pattern-either:
- pattern: |
$VM.runInContext(...)
- pattern: |
$VM.runInNewContext(...)
- pattern: |
$VM.compileFunction(...)
- pattern: |
$VM.runInThisContext(...)
- pattern: new $VM.Script(...)
- id: javascript.express.security.express-vm2-injection.express-vm2-injection
message: Make sure that unverified user data can not reach `vm2`.
metadata:
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
category: security
technology:
- express
cwe2022-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/javascript.express.security.express-vm2-injection.express-vm2-injection
shortlink: https://sg.run/1GWv
semgrep.dev:
rule:
r_id: 12822
rv_id: 1263171
rule_id: WAUPXJ
version_id: 9lT4bnX
url: https://semgrep.dev/playground/r/9lT4bnX/javascript.express.security.express-vm2-injection.express-vm2-injection
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern-inside: |
require('vm2')
...
- pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
$VM = new VM(...)
...
- pattern-inside: |
$VM = new NodeVM(...)
...
- pattern: |
$VM.run(...)
- pattern: |
new VM(...).run(...)
- pattern: |
new NodeVM(...).run(...)
- pattern: |
new VMScript(...)
- pattern: |
new VM(...)
- pattern: new NodeVM(...)
- id: generic.secrets.security.detected-jwt-token.detected-jwt-token
pattern-regex: eyJ[A-Za-z0-9-_=]{14,}\.[A-Za-z0-9-_=]{13,}\.?[A-Za-z0-9-_.+/=]*?
languages:
- regex
message: JWT token detected
severity: ERROR
metadata:
source-rule-url: https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/jwt.py
category: security
technology:
- secrets
- jwt
confidence: LOW
references:
- https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
cwe:
- 'CWE-321: Use of Hard-coded Cryptographic Key'
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/generic.secrets.security.detected-jwt-token.detected-jwt-token
shortlink: https://sg.run/05N5
semgrep.dev:
rule:
r_id: 12854
rv_id: 1262879
rule_id: kxU8E8
version_id: d6Tyxvg
url: https://semgrep.dev/playground/r/d6Tyxvg/generic.secrets.security.detected-jwt-token.detected-jwt-token
origin: community
- id: generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key
pattern-regex: SG\.[a-zA-Z0-9]{22}\.[a-zA-Z0-9-]{43}\b
languages:
- regex
message: SendGrid API Key detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/narendrakadali/gitrob/blob/master/rules/contentsignatures.json
category: security
technology:
- secrets
- sendgrid
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key
shortlink: https://sg.run/qqOy
semgrep.dev:
rule:
r_id: 12856
rv_id: 1262890
rule_id: x8U2EG
version_id: PkTR3RD
url: https://semgrep.dev/playground/r/PkTR3RD/generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key
origin: community
- id: generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key
pattern-regex: (?i)snyk.{0,50}['|"|`]?[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}['"\s]?
languages:
- regex
message: Snyk API Key detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
category: security
technology:
- secrets
- snyk
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key
shortlink: https://sg.run/lxO9
semgrep.dev:
rule:
r_id: 12857
rv_id: 1262893
rule_id: OrUD9J
version_id: GxTkek0
url: https://semgrep.dev/playground/r/GxTkek0/generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key
origin: community
- id: generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key
pattern-regex: (?i)softlayer.{0,50}["|'|`]?[a-z0-9]{64}["|'|`]?
languages:
- regex
message: SoftLayer API Key detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/softlayer.py
category: security
technology:
- secrets
- softlayer
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key
shortlink: https://sg.run/YXq4
semgrep.dev:
rule:
r_id: 12858
rv_id: 1262894
rule_id: eqUplZ
version_id: RGT0L0o
url: https://semgrep.dev/playground/r/RGT0L0o/generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key
origin: community
- id: javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf
message: User-controllable argument $DATAVAL to $METHOD passed to Axios via internal
handler $INNERFUNC. This could be a server-side request forgery. A user could
call a restricted API or leak internal headers to an unauthorized party. Validate
your user arguments against an allowlist of known URLs, or consider refactoring
so that user-controlled data is not necessary.
metadata:
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
category: security
technology:
- apollo
- axios
references:
- https://www.cvedetails.com/cve/CVE-2020-28168/
- https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf
shortlink: https://sg.run/jkEZ
semgrep.dev:
rule:
r_id: 13021
rv_id: 1263102
rule_id: AbUGBR
version_id: K3TKk30
url: https://semgrep.dev/playground/r/K3TKk30/javascript.apollo.security.apollo-axios-ssrf.apollo-axios-ssrf
origin: community
languages:
- javascript
severity: WARNING
patterns:
- pattern: const $RESPONSE = await axios.request($INNERARG,...)
- pattern-inside: |
Query: {
$METHOD(parent, args, context, info) {
...
$DATA = args.$DATAVAL
...
async function $INNERFUNC(...,$INNERARG,...){
...
}
...
return $INNERFUNC(...,$DATA,...)
}
}
- id: javascript.lang.security.audit.code-string-concat.code-string-concat
message: Found data from an Express or Next web request flowing to `eval`. If this
data is user-controllable this can lead to execution of arbitrary system commands
in the context of your application process. Avoid `eval` whenever possible.
options:
interfile: true
metadata:
interfile: true
confidence: HIGH
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
references:
- https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval
- https://nodejs.org/api/child_process.html#child_processexeccommand-options-callback
- https://www.stackhawk.com/blog/nodejs-command-injection-examples-and-prevention/
- https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_server_side_js_injection.html
category: security
technology:
- node.js
- Express
- Next.js
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/javascript.lang.security.audit.code-string-concat.code-string-concat
shortlink: https://sg.run/96Yk
semgrep.dev:
rule:
r_id: 13023
rv_id: 1263192
rule_id: DbUKEz
version_id: 44TEjYX
url: https://semgrep.dev/playground/r/44TEjYX/javascript.lang.security.audit.code-string-concat.code-string-concat
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- pattern-either:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT)
{...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
import { ...,$IMPORT,... } from 'next/router'
...
- pattern-inside: |
import $IMPORT from 'next/router';
...
- pattern-either:
- patterns:
- pattern-inside: |
$ROUTER = $IMPORT()
...
- pattern-either:
- pattern-inside: |
const { ...,$PROPS,... } = $ROUTER.query
...
- pattern-inside: |
var { ...,$PROPS,... } = $ROUTER.query
...
- pattern-inside: |
let { ...,$PROPS,... } = $ROUTER.query
...
- focus-metavariable: $PROPS
- patterns:
- pattern-inside: |
$ROUTER = $IMPORT()
...
- pattern: "$ROUTER.query.$VALUE \n"
- patterns:
- pattern: $IMPORT().query.$VALUE
pattern-sinks:
- patterns:
- pattern: |
eval(...)
- id: yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled
languages:
- yaml
severity: WARNING
message: Do not set FLASK_ENV to "development" since that sets `debug=True` in Flask.
Use "dev" or a similar term instead.
metadata:
owasp: A06:2017 - Security Misconfiguration
cwe:
- 'CWE-489: Active Debug Code'
references:
- https://flask.palletsprojects.com/en/2.0.x/debugging/
- https://flask.palletsprojects.com/en/2.0.x/config/#ENV
category: security
technology:
- kubernetes
- flask
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Active Debug Code
source: https://semgrep.dev/r/yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled
shortlink: https://sg.run/y6x8
semgrep.dev:
rule:
r_id: 13024
rv_id: 947053
rule_id: WAUP0z
version_id: ZRT3qOw
url: https://semgrep.dev/playground/r/ZRT3qOw/yaml.kubernetes.security.env.flask-debugging-enabled.flask-debugging-enabled
origin: community
patterns:
- pattern-inside: |
env: [...]
- pattern: |
{name: FLASK_ENV, value: "development"}
fix-regex:
regex: development
replacement: dev
- id: javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli
message: 'Detected string concatenation with a non-literal variable in a `mssql`
JS SQL statement. This could lead to SQL injection if the variable is user-controlled
and not properly sanitized. In order to prevent SQL injection, use parameterized
queries or prepared statements instead. You can use parameterized statements like
so: `$REQ.input(''USER_ID'', mssql.Int, id);`'
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
category: security
technology:
- mssql
references:
- https://www.npmjs.com/package/mssql
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli
shortlink: https://sg.run/lxlB
semgrep.dev:
rule:
r_id: 13157
rv_id: 1263206
rule_id: kxU8Pd
version_id: YDTZezY
url: https://semgrep.dev/playground/r/YDTZezY/javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-inside: |
function ... (...,$FUNC,...) {
...
}
- focus-metavariable: $FUNC
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
require('mssql');
...
- pattern-inside: |
import 'mssql';
...
- pattern-inside: |
$REQ = $POOL.request(...)
...
- pattern: |
$REQ.query($QUERY,...)
- focus-metavariable: $QUERY
- id: yaml.github-actions.security.run-shell-injection.run-shell-injection
languages:
- yaml
message: 'Using variable interpolation `${{...}}` with `github` context data in
a `run:` step could allow an attacker to inject their own code into the runner.
This would allow them to steal secrets and code. `github` context data can have
arbitrary user input and should be treated as untrusted. Instead, use an intermediate
environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like
this: "$ENVVAR".'
metadata:
category: security
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
- https://securitylab.github.com/research/github-actions-untrusted-input/
technology:
- github-actions
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection
shortlink: https://sg.run/pkzk
semgrep.dev:
rule:
r_id: 13162
rv_id: 1423395
rule_id: v8UjQj
version_id: GxTl1DQ
url: https://semgrep.dev/playground/r/GxTl1DQ/yaml.github-actions.security.run-shell-injection.run-shell-injection
origin: community
patterns:
- pattern-inside: 'steps: [...]'
- pattern-inside: |
- run: ...
...
- pattern: 'run: $SHELL'
- metavariable-pattern:
language: generic
metavariable: $SHELL
patterns:
- pattern-either:
- pattern: ${{ ... github.event.issue.title ... }}
- pattern: ${{ ... github.event.issue.body ... }}
- pattern: ${{ ... github.event.pull_request.title ... }}
- pattern: ${{ ... github.event.pull_request.body ... }}
- pattern: ${{ ... github.event.comment.body ... }}
- pattern: ${{ ... github.event.review.body ... }}
- pattern: ${{ ... github.event.review_comment.body ... }}
- pattern: ${{ ... github.event.pages ... .page_name ... }}
- pattern: ${{ ... github.event.head_commit.message ... }}
- pattern: ${{ ... github.event.head_commit.author.email ... }}
- pattern: ${{ ... github.event.head_commit.author.name ... }}
- pattern: ${{ ... github.event.commits ... .author.email ... }}
- pattern: ${{ ... github.event.commits ... .author.name ... }}
- pattern: ${{ ... github.event.commits ... .message ... }}
- pattern: ${{ ... github.event.pull_request.head.ref ... }}
- pattern: ${{ ... github.event.pull_request.head.label ... }}
- pattern: ${{ ... github.event.pull_request.head.repo.default_branch ...
}}
- pattern: ${{ ... github.ref ... }}
- pattern: ${{ ... github.base_ref ... }}
- pattern: ${{ ... github.head_ref ... }}
- pattern: ${{ ... github.ref_name ... }}
- pattern: ${{ ... github.workflow ... }}
- pattern: ${{ ... github.event.inputs ... }}
- pattern: ${{ ... github.event.discussion.title ... }}
- pattern: ${{ ... github.event.discussion.body ... }}
- pattern: ${{ ... github.event.workflow_run.head_branch ... }}
- pattern: ${{ ... github.event.workflow_run.head_commit.message ... }}
- pattern: ${{ ... github.event.milestone.title ... }}
- pattern: ${{ ... github.event.milestone.description ... }}
- pattern: ${{ ... github.event.project_card.note ... }}
- pattern: ${{ ... github.event.project.name ... }}
- pattern: ${{ ... github.event.project_column.name ... }}
- pattern: ${{ ... github.event.release.name ... }}
- pattern: ${{ ... github.event.release.body ... }}
- pattern: ${{ ... github.event.deployment.ref ... }}
- pattern: ${{ ... inputs ... }}
- pattern-not: ${{ ... github.event.issue.title && ... }}
- pattern-not: ${{ ... github.event.issue.body && ... }}
- pattern-not: ${{ ... github.event.pull_request.title && ... }}
- pattern-not: ${{ ... github.event.pull_request.body && ... }}
- pattern-not: ${{ ... github.event.comment.body && ... }}
- pattern-not: ${{ ... github.event.review.body && ... }}
- pattern-not: ${{ ... github.event.review_comment.body && ... }}
- pattern-not: ${{ ... github.event.pages ... .page_name && ... }}
- pattern-not: ${{ ... github.event.head_commit.message && ... }}
- pattern-not: ${{ ... github.event.head_commit.author.email && ... }}
- pattern-not: ${{ ... github.event.head_commit.author.name && ... }}
- pattern-not: ${{ ... github.event.commits ... .author.email && ... }}
- pattern-not: ${{ ... github.event.commits ... .author.name && ... }}
- pattern-not: ${{ ... github.event.commits ... .message && ... }}
- pattern-not: ${{ ... github.event.pull_request.head.ref && ... }}
- pattern-not: ${{ ... github.event.pull_request.head.label && ... }}
- pattern-not: ${{ ... github.event.pull_request.head.repo.default_branch &&
... }}
- pattern-not: ${{ ... github.event.workflow_run.head_commit.message && ...
}}
- pattern-not: ${{ ... github.ref && ... }}
- pattern-not: ${{ ... github.base_ref && ... }}
- pattern-not: ${{ ... github.head_ref && ... }}
- pattern-not: ${{ ... github.ref_name && ... }}
- pattern-not: ${{ ... github.workflow && ... }}
- pattern-not: ${{ ... github.event.inputs && ... }}
- pattern-not: ${{ ... github.event.discussion.title && ... }}
- pattern-not: ${{ ... github.event.discussion.body && ... }}
- pattern-not: ${{ ... github.event.workflow_run.head_branch && ... }}
- pattern-not: ${{ ... github.event.milestone.title && ... }}
- pattern-not: ${{ ... github.event.milestone.description && ... }}
- pattern-not: ${{ ... github.event.project_card.note && ... }}
- pattern-not: ${{ ... github.event.project.name && ... }}
- pattern-not: ${{ ... github.event.project_column.name && ... }}
- pattern-not: ${{ ... github.event.release.name && ... }}
- pattern-not: ${{ ... github.event.release.body && ... }}
- pattern-not: ${{ ... github.event.deployment.ref && ... }}
severity: ERROR
- id: yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout
languages:
- yaml
message: This GitHub Actions workflow file uses `pull_request_target` and checks
out code from the incoming pull request. When using `pull_request_target`, the
Action runs in the context of the target repository, which includes access to
all repository secrets. Normally, this is safe because the Action only runs code
from the target repository, not the incoming PR. However, by checking out the
incoming PR code, you're now using the incoming code for the rest of the action.
You may be inadvertently executing arbitrary code from the incoming PR with access
to repository secrets, which would let an attacker steal repository secrets. This
normally happens by running build scripts (e.g., `npm build` and `make`) or dependency
installation scripts (e.g., `python setup.py install`). Audit your workflow file
to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
for additional mitigations.
metadata:
category: security
owasp:
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software and Data Integrity Failures
cwe:
- 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere'
references:
- https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
- https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
- https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md
technology:
- github-actions
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout
shortlink: https://sg.run/jkdn
semgrep.dev:
rule:
r_id: 13365
rv_id: 1413423
rule_id: d8Ulkd
version_id: O9TQ2nX
url: https://semgrep.dev/playground/r/O9TQ2nX/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout
origin: community
patterns:
- pattern-either:
- pattern-inside: |
on:
...
pull_request_target: ...
...
...
- pattern-inside: |
on: [..., pull_request_target, ...]
...
- pattern-inside: |
on: pull_request_target
...
- pattern-inside: |
jobs:
...
$JOBNAME:
...
steps:
...
- pattern: |
...
uses: "$ACTION"
with:
...
ref: $EXPR
- metavariable-regex:
metavariable: $ACTION
regex: actions/checkout@.*
- metavariable-pattern:
language: generic
metavariable: $EXPR
patterns:
- pattern-inside: ${{ ... }}
- pattern-either:
- pattern: github.event.pull_request ...
- pattern: github.head_ref ...
severity: ERROR
- id: javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop
message: 'Possibility of prototype polluting function detected. By adding or modifying
attributes of an object prototype, it is possible to create attributes that exist
on every object, or replace critical attributes with malicious ones. This can
be problematic if the software depends on existence or non-existence of certain
attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty,
toString or valueOf). Possible mitigations might be: freezing the object prototype,
using an object without prototypes (via Object.create(null) ), blocking modifications
of attributes that resolve to object prototype, using Map instead of object.'
metadata:
cwe:
- 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object
Attributes'
category: security
references:
- https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf
technology:
- typescript
owasp:
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mass Assignment
source: https://semgrep.dev/r/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop
shortlink: https://sg.run/w1DB
semgrep.dev:
rule:
r_id: 13373
rv_id: 1263203
rule_id: QrUpbJ
version_id: K3TKkP7
url: https://semgrep.dev/playground/r/K3TKkP7/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop
origin: community
languages:
- typescript
- javascript
severity: WARNING
patterns:
- pattern-either:
- pattern: |
$SMTH = $SMTH[$A]
- pattern: |
$SMTH = $SMTH[$A] = ...
- pattern: |
$SMTH = $SMTH[$A] && $Z
- pattern: |
$SMTH = $SMTH[$A] || $Z
- pattern-either:
- pattern-inside: |
for(...) {
...
}
- pattern-inside: |
while(...) {
...
}
- pattern-inside: |
$X.forEach(function $NAME(...) {
...
})
- pattern-not-inside: |
for(var $A = $S; ...; ...) {...}
- pattern-not-inside: |
for($A = $S; ...; ...) {...}
- pattern-not-inside: |
$X.forEach(function $NAME($OBJ, $A,...) {...})
- metavariable-pattern:
patterns:
- pattern-not: '"..."'
- pattern-not: |
`...${...}...`
- pattern-not: |
($A: float)
metavariable: $A
- id: yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands
languages:
- yaml
severity: WARNING
message: The environment variable `ACTIONS_ALLOW_UNSECURE_COMMANDS` grants this
workflow permissions to use the `set-env` and `add-path` commands. There is a
vulnerability in these commands that could result in environment variables being
modified by an attacker. Depending on the use of the environment variable, this
could enable an attacker to, at worst, modify the system path to run a different
command than intended, resulting in arbitrary code execution. This could result
in stolen code or secrets. Don't use `ACTIONS_ALLOW_UNSECURE_COMMANDS`. Instead,
use Environment Files. See https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files
for more information.
metadata:
cwe:
- 'CWE-749: Exposed Dangerous Method or Function'
owasp: A06:2017 - Security Misconfiguration
references:
- https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/
- https://github.com/actions/toolkit/security/advisories/GHSA-mfwh-5m23-j46w
- https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files
category: security
technology:
- github-actions
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Dangerous Method or Function
source: https://semgrep.dev/r/yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands
shortlink: https://sg.run/qq78
semgrep.dev:
rule:
r_id: 13412
rv_id: 947039
rule_id: EwUQ9x
version_id: jQTzq34
url: https://semgrep.dev/playground/r/jQTzq34/yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands
origin: community
patterns:
- pattern-either:
- patterns:
- pattern-inside: '{env: ...}'
- pattern: 'ACTIONS_ALLOW_UNSECURE_COMMANDS: true'
- id: json.aws.security.public-s3-bucket.public-s3-bucket
languages:
- json
message: Detected public S3 bucket. This policy allows anyone to have some kind
of access to the bucket. The exact level of access and types of actions allowed
will depend on the configuration of bucket policy and ACLs. Please review the
bucket configuration to make sure they are set with intended values.
metadata:
category: security
cwe:
- 'CWE-264: CWE CATEGORY: Permissions, Privileges, and Access Controls'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
technology:
- aws
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/json.aws.security.public-s3-bucket.public-s3-bucket
shortlink: https://sg.run/lxv5
semgrep.dev:
rule:
r_id: 13413
rv_id: 1263254
rule_id: 7KUpLy
version_id: RGT0Ld0
url: https://semgrep.dev/playground/r/RGT0Ld0/json.aws.security.public-s3-bucket.public-s3-bucket
origin: community
patterns:
- pattern-inside: |
$BUCKETNAME: {
"Type": "AWS::S3::Bucket",
"Properties": {
...,
},
...,
}
- pattern-either:
- pattern: |
"PublicAccessBlockConfiguration": {
...,
"RestrictPublicBuckets": false,
...,
},
- pattern: |
"PublicAccessBlockConfiguration": {
...,
"IgnorePublicAcls": false,
...,
},
- pattern: |
"PublicAccessBlockConfiguration": {
...,
"BlockPublicAcls": false,
...,
},
- pattern: |
"PublicAccessBlockConfiguration": {
...,
"BlockPublicPolicy": false,
...,
},
severity: WARNING
- id: javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization
message: '`$STR.replace` method will only replace the first occurrence when used
with a string argument ($CHAR). If this method is used for escaping of dangerous
data then there is a possibility for a bypass. Try to use sanitization library
instead or use a Regex with a global flag.'
metadata:
cwe:
- 'CWE-116: Improper Encoding or Escaping of Output'
category: security
technology:
- javascript
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Encoding
source: https://semgrep.dev/r/javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization
shortlink: https://sg.run/1GbQ
semgrep.dev:
rule:
r_id: 13466
rv_id: 1263199
rule_id: d8UlRq
version_id: BjTkZQD
url: https://semgrep.dev/playground/r/BjTkZQD/javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern: |
$STR.replace(($CHAR: string), ...)
- metavariable-regex:
metavariable: $CHAR
regex: ^[\"\']([\'\"\<\>\*\|\{\}\[\]\%\$]{1}|\\n|\\r|\\t|\\&)[\"\']$
- id: terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges
pattern-either:
- patterns:
- pattern-inside: |
resource $TYPE "..." {
...
policy = jsonencode({
...
Statement = [
...
]
...
})
...
}
- pattern-not-inside: |
resource $TYPE "..." {
...
policy = jsonencode({
...
Statement = [
...,
{... Effect = "Deny" ...},
...
]
...
})
...
}
- patterns:
- pattern: |
{..., Action = "*", ...}
- pattern: |
{..., Resource = "*", ...}
- metavariable-pattern:
metavariable: $TYPE
pattern-either:
- pattern: |
"aws_iam_role_policy"
- pattern: |
"aws_iam_policy"
- pattern: |
"aws_iam_user_policy"
- pattern: |
"aws_iam_group_policy"
- patterns:
- pattern-inside: |
data aws_iam_policy_document "..." {
...
statement {
...
}
...
}
- pattern-not-inside: |
data aws_iam_policy_document "..." {
...
statement {
...
effect = "Deny"
...
}
...
}
- patterns:
- pattern: |
{..., resources = ["*"], ...}
- pattern: |
{..., actions = ["*"], ...}
message: IAM policies that allow full "*-*" admin privileges violates the principle
of least privilege. This allows an attacker to take full control over all AWS
account resources. Instead, give each user more fine-grained control with only
the privileges they need. $TYPE
metadata:
references:
- https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/data/aws/AdminPolicyDocument.py
category: security
cwe:
- 'CWE-269: Improper Privilege Management'
technology:
- terraform
- aws
owasp:
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges
shortlink: https://sg.run/oY0N
semgrep.dev:
rule:
r_id: 13560
rv_id: 1263889
rule_id: NbUNDX
version_id: d6Tyxxd
url: https://semgrep.dev/playground/r/d6Tyxxd/terraform.lang.security.iam.no-iam-admin-privileges.no-iam-admin-privileges
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure
patterns:
- pattern-either:
- patterns:
- pattern-inside: |
resource $TYPE "..." {
...
policy = jsonencode({
...
Statement = [
...
]
...
})
...
}
- pattern-not-inside: |
resource $TYPE "..." {
...
policy = jsonencode({
...
Statement = [
...,
{... Effect = "Deny" ...},
...
]
...
})
...
}
- pattern: |
Action = $ACTION
- metavariable-pattern:
metavariable: $TYPE
pattern-either:
- pattern: |
"aws_iam_role_policy"
- pattern: |
"aws_iam_policy"
- pattern: |
"aws_iam_user_policy"
- pattern: |
"aws_iam_group_policy"
- patterns:
- pattern-inside: |
data aws_iam_policy_document "..." {
...
statement {
...
}
...
}
- pattern-not-inside: |
data aws_iam_policy_document "..." {
...
statement {
...
effect = "Deny"
...
}
...
}
- pattern: |
actions = [..., $ACTION, ...]
- metavariable-pattern:
metavariable: $ACTION
pattern-either:
- pattern: |
"chime:CreateApiKey"
- pattern: |
"codepipeline:PollForJobs"
- pattern: |
"cognito-identity:GetOpenIdToken"
- pattern: |
"cognito-identity:GetOpenIdTokenForDeveloperEdentity"
- pattern: |
"cognito-identity:GetCredentialsForIdentity"
- pattern: |
"connect:GetFederationToken"
- pattern: |
"connect:GetFederationTokens"
- pattern: |
"ec2:GetPasswordData"
- pattern: |
"ecr:GetAuthorizationToken"
- pattern: |
"gamelift:RequestUploadCredentials"
- pattern: |
"iam:CreateAccessKey"
- pattern: |
"iam:CreateLoginProfile"
- pattern: |
"iam:CreateServiceSpecificCredential"
- pattern: |
"iam:ResetServiceSpecificCredential"
- pattern: |
"iam:UpdateAccessKey"
- pattern: |
"lightsail:GetInstanceAccessDetails"
- pattern: |
"lightsail:GetRelationalDatabaseMasterUserPassword"
- pattern: |
"rds-db:Connect"
- pattern: |
"redshift:GetClusterCredentials"
- pattern: |
"sso:GetRoleCredentials"
- pattern: |
"mediapackage:RotateChannelCredentials"
- pattern: |
"mediapackage:RotateIngestEndpointCredentials"
- pattern: |
"sts:AssumeRole"
- pattern: |
"sts:AssumeRoleWithSaml"
- pattern: |
"sts:AssumeRoleWithWebIdentity"
- pattern: |
"sts:GetFederationToken"
- pattern: |
"sts:GetSessionToken"
- pattern: |
"ec2:*"
- pattern: |
"codepipeline:*"
- pattern: |
"rds-db:*"
- pattern: |
"connect:*"
- pattern: |
"iam:*"
- pattern: |
"ecr:*"
- pattern: |
"sts:*"
- pattern: |
"chime:*"
- pattern: |
"mediapackage:*"
- pattern: |
"redshift:*"
- pattern: |
"gamelift:*"
- pattern: |
"cognito-identity:*"
- pattern: |
"lightsail:*"
- pattern: |
"sso:*"
message: Ensure IAM policies don't allow credentials exposure. Credentials exposure
actions return credentials as part of the API response, and can possibly lead
to leaking important credentials. Instead, use another action that doesn't return
sensitive data as part of the API response.
metadata:
references:
- https://cloudsplaining.readthedocs.io/en/latest/glossary/credentials-exposure/
- https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMCredentialsExposure.py
category: security
cwe:
- 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
technology:
- terraform
- aws
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure
shortlink: https://sg.run/zxY1
semgrep.dev:
rule:
r_id: 13561
rv_id: 1263890
rule_id: kxUwK2
version_id: ZRTKAAP
url: https://semgrep.dev/playground/r/ZRTKAAP/terraform.lang.security.iam.no-iam-creds-exposure.no-iam-creds-exposure
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration
patterns:
- pattern-either:
- patterns:
- pattern-inside: |
resource $TYPE "..." {
...
policy = jsonencode({
...
Statement = [
...,
{... Resource = "*" ...},
...
]
...
})
...
}
- pattern-not-inside: |
resource $TYPE "..." {
...
policy = jsonencode({
...
Statement = [
...,
{... Effect = "Deny" ...},
...
]
...
})
...
}
- pattern: |
Action = $ACTION
- metavariable-pattern:
metavariable: $TYPE
pattern-either:
- pattern: |
"aws_iam_role_policy"
- pattern: |
"aws_iam_policy"
- pattern: |
"aws_iam_user_policy"
- pattern: |
"aws_iam_group_policy"
- patterns:
- pattern-inside: |
data aws_iam_policy_document "..." {
...
statement {
...
resources = ["*"]
...
}
...
}
- pattern-not-inside: |
data aws_iam_policy_document "..." {
...
statement {
...
effect = "Deny"
...
}
...
}
- pattern: |
actions = [..., $ACTION, ...]
- metavariable-pattern:
metavariable: $ACTION
pattern-either:
- pattern: |
"s3:GetObject"
- pattern: |
"ssm:GetParameter*"
- pattern: |
"secretsmanager:GetSecretValue"
- pattern: |
"rds:CopyDBSnapshot"
- pattern: |
"rds:CreateDBSnapshot"
- pattern: |
"ssm:*"
- pattern: |
"s3:*"
- pattern: |
"rds:*"
- pattern: |
"rn: secretsmanager:*"
message: Ensure that IAM policies don't allow data exfiltration actions that are
not resource-constrained. This can allow the user to read sensitive data they
don't need to read. Instead, make sure that the user granted these privileges
are given these permissions on specific resources.
metadata:
references:
- https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMDataExfiltration.py
- https://cloudsplaining.readthedocs.io/en/latest/glossary/data-exfiltration/
category: security
cwe:
- 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
technology:
- terraform
- aws
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration
shortlink: https://sg.run/pYrN
semgrep.dev:
rule:
r_id: 13562
rv_id: 1263891
rule_id: wdUj1k
version_id: nWT2LLN
url: https://semgrep.dev/playground/r/nWT2LLN/terraform.lang.security.iam.no-iam-data-exfiltration.no-iam-data-exfiltration
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs
patterns:
- pattern-either:
- patterns:
- pattern-inside: |
resource $TYPE "..." {
...
policy = jsonencode({
...
Statement = [
...
]
...
})
...
}
- pattern-not-inside: |
resource $TYPE "..." {
...
policy = jsonencode({
...
Statement = [
...,
{... Effect = "Deny" ...},
...
]
...
})
...
}
- pattern: Action = $ACTION
- metavariable-pattern:
metavariable: $TYPE
pattern-either:
- pattern: |
"aws_iam_role_policy"
- pattern: |
"aws_iam_policy"
- pattern: |
"aws_iam_user_policy"
- pattern: |
"aws_iam_group_policy"
- patterns:
- pattern-inside: |
data aws_iam_policy_document "..." {
...
statement {
...
}
...
}
- pattern-not-inside: |
data aws_iam_policy_document "..." {
...
statement {
...
effect = "Deny"
...
}
...
}
- pattern: |
actions = [..., $ACTION, ...]
- metavariable-pattern:
metavariable: $ACTION
pattern-either:
- pattern: |
"iam:AddUserToGroup"
- pattern: |
"iam:CreatePolicyVersion"
- pattern: |
"iam:SetDefaultPolicyVersion"
- pattern: |
"iam:AttachUserPolicy"
- pattern: |
"iam:AttachGroupPolicy"
- pattern: |
"iam:AttachRolePolicy"
- pattern: |
"iam:PutUserPolicy"
- pattern: |
"iam:PutGroupPolicy"
- pattern: |
"iam:PutRolePolicy"
- pattern: |
"glue:UpdateDevEndpoint"
- pattern: |
"iam:*"
- pattern: |
"glue:*"
message: Ensure that actions that can result in privilege escalation are not used.
These actions could potentially result in an attacker gaining full administrator
access of an AWS account. Try not to use these actions.
metadata:
references:
- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
- https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/
category: security
cwe:
- 'CWE-250: Execution with Unnecessary Privileges'
technology:
- terraform
- aws
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs
shortlink: https://sg.run/28y5
semgrep.dev:
rule:
r_id: 13563
rv_id: 946990
rule_id: x8UxLq
version_id: o5TZzrP
url: https://semgrep.dev/playground/r/o5TZzrP/terraform.lang.security.iam.no-iam-priv-esc-funcs.no-iam-priv-esc-funcs
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users
patterns:
- pattern-either:
- patterns:
- pattern-inside: |
resource $TYPE "..." {
...
policy = jsonencode({
...
Statement = [
...,
{... Resource = $RESOURCE ...},
...
]
...
})
...
}
- pattern-not-inside: |
resource $TYPE "..." {
...
policy = jsonencode({
...
Statement = [
...,
{... Effect = "Deny" ...},
...
]
...
})
...
}
- pattern: |
Action = $ACTION
- metavariable-pattern:
metavariable: $TYPE
pattern-either:
- pattern: |
"aws_iam_role_policy"
- pattern: |
"aws_iam_policy"
- pattern: |
"aws_iam_user_policy"
- pattern: |
"aws_iam_group_policy"
- patterns:
- pattern-inside: |
data aws_iam_policy_document "..." {
...
statement {
...
resources = $RESOURCE
...
}
...
}
- pattern-not-inside: |
data aws_iam_policy_document "..." {
...
statement {
...
effect = "Deny"
...
}
...
}
- pattern: |
actions = [..., $ACTION, ...]
- metavariable-pattern:
metavariable: $RESOURCE
pattern-either:
- pattern-regex: .*\*.*
- metavariable-pattern:
metavariable: $ACTION
pattern-either:
- pattern: |
"iam:CreateAccessKey"
- pattern: |
"iam:CreateLoginProfile"
- pattern: |
"iam:UpdateLoginProfile"
- pattern: |
"iam:*"
message: Ensure that IAM policies with permissions on other users don't allow for
privilege escalation. This can lead to an attacker gaining full administrator
access of AWS accounts. Instead, specify which user the permission should be used
on or do not use the listed actions. $RESOURCE
metadata:
references:
- https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/
- https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPrivilegeEscalation.py
category: security
cwe:
- 'CWE-269: Improper Privilege Management'
technology:
- terraform
- aws
owasp:
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users
shortlink: https://sg.run/XOeA
semgrep.dev:
rule:
r_id: 13564
rv_id: 1263892
rule_id: OrU6jO
version_id: ExTExxx
url: https://semgrep.dev/playground/r/ExTExxx/terraform.lang.security.iam.no-iam-priv-esc-other-users.no-iam-priv-esc-other-users
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles
patterns:
- pattern-either:
- patterns:
- pattern-inside: |
resource $TYPE "..." {
...
policy = jsonencode({
...
Statement = [
...
]
...
})
...
}
- pattern-not-inside: |
resource $TYPE "..." {
...
policy = jsonencode({
...
Statement = [
...,
{... Effect = "Deny" ...},
...
]
...
})
...
}
- pattern: |
Action = $ACTION
- metavariable-pattern:
metavariable: $TYPE
pattern-either:
- pattern: |
"aws_iam_role_policy"
- pattern: |
"aws_iam_policy"
- pattern: |
"aws_iam_user_policy"
- pattern: |
"aws_iam_group_policy"
- patterns:
- pattern-inside: |
data aws_iam_policy_document "..." {
...
statement {
...
}
...
}
- pattern-not-inside: |
data aws_iam_policy_document "..." {
...
statement {
...
effect = "Deny"
...
}
...
}
- pattern: |
actions = $ACTION
- metavariable-pattern:
metavariable: $ACTION
pattern-either:
- patterns:
- pattern: |
[..., "sts:AssumeRole", ...]
- pattern: |
[..., "iam:UpdateAssumeRolePolicy", ...]
- patterns:
- pattern: |
[..., "iam:PassRole", ...]
- pattern: |
[..., "lambda:CreateFunction", ...]
- pattern: |
[..., "lambda:InvokeFunction", ...]
- patterns:
- pattern: |
[..., "iam:PassRole", ...]
- pattern: |
[..., "lambda:CreateFunction", ...]
- pattern: |
[..., "lambda:CreateEventSourceMapping", ...]
- pattern: |
"lambda:UpdateFunctionCode"
- patterns:
- pattern: |
[..., "iam:PassRole", ...]
- pattern: |
[..., "glue:CreateDevEndpoint", ...]
- patterns:
- pattern: |
[..., "iam:PassRole", ...]
- pattern: |
[..., "cloudformation:CreateStack", ...]
- patterns:
- pattern: |
[..., "iam:PassRole", ...]
- pattern: |
[..., "datapipeline:CreatePipeline", ...]
- pattern: |
[..., "datapipeline:PutPipelineDefinition", ...]
message: Ensure that groups of actions that include iam:PassRole and could result
in privilege escalation are not all allowed for the same user. These actions could
result in an attacker gaining full admin access of an AWS account. Try not to
use these actions in conjuction.
metadata:
references:
- https://cloudsplaining.readthedocs.io/en/latest/glossary/privilege-escalation/
- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
category: security
cwe:
- 'CWE-269: Improper Privilege Management'
technology:
- terraform
- aws
owasp:
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles
shortlink: https://sg.run/jwrA
semgrep.dev:
rule:
r_id: 13565
rv_id: 1263893
rule_id: eqUzR3
version_id: 7ZTE33y
url: https://semgrep.dev/playground/r/7ZTE33y/terraform.lang.security.iam.no-iam-priv-esc-roles.no-iam-priv-esc-roles
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure
patterns:
- pattern-either:
- patterns:
- pattern-inside: |
resource $TYPE "..." {
...
policy = jsonencode({
...
Statement = [
...
]
...
})
...
}
- pattern-not-inside: |
resource $TYPE "..." {
...
policy = jsonencode({
...
Statement = [
...,
{... Effect = "Deny" ...},
...
]
...
})
...
}
- pattern: |
Action = $ACTION
- metavariable-pattern:
metavariable: $TYPE
pattern-either:
- pattern: |
"aws_iam_role_policy"
- pattern: |
"aws_iam_policy"
- pattern: |
"aws_iam_user_policy"
- pattern: |
"aws_iam_group_policy"
- patterns:
- pattern-inside: |
data aws_iam_policy_document "..." {
...
statement {
...
}
...
}
- pattern-not-inside: |
data aws_iam_policy_document "..." {
...
statement {
...
effect = "Deny"
...
}
...
}
- pattern: |
actions = [..., $ACTION, ...]
- metavariable-pattern:
metavariable: $ACTION
pattern-either:
- pattern: |
"acm-pca:CreatePermission"
- pattern: |
"acm-pca:DeletePermission"
- pattern: |
"acm-pca:DeletePolicy"
- pattern: |
"acm-pca:PutPolicy"
- pattern: |
"apigateway:UpdateRestApiPolicy"
- pattern: |
"backup:DeleteBackupVaultAccessPolicy"
- pattern: |
"backup:PutBackupVaultAccessPolicy"
- pattern: |
"chime:DeleteVoiceConnectorTerminationCredentials"
- pattern: |
"chime:PutVoiceConnectorTerminationCredentials"
- pattern: |
"cloudformation:SetStackPolicy"
- pattern: |
"cloudsearch:UpdateServiceAccessPolicies"
- pattern: |
"codeartifact:DeleteDomainPermissionsPolicy"
- pattern: |
"codeartifact:DeleteRepositoryPermissionsPolicy"
- pattern: |
"codebuild:DeleteResourcePolicy"
- pattern: |
"codebuild:DeleteSourceCredentials"
- pattern: |
"codebuild:ImportSourceCredentials"
- pattern: |
"codebuild:PutResourcePolicy"
- pattern: |
"codeguru-profiler:PutPermission"
- pattern: |
"codeguru-profiler:RemovePermission"
- pattern: |
"codestar:AssociateTeamMember"
- pattern: |
"codestar:CreateProject"
- pattern: |
"codestar:DeleteProject"
- pattern: |
"codestar:DisassociateTeamMember"
- pattern: |
"codestar:UpdateTeamMember"
- pattern: |
"cognito-identity:CreateIdentityPool"
- pattern: |
"cognito-identity:DeleteIdentities"
- pattern: |
"cognito-identity:DeleteIdentityPool"
- pattern: |
"cognito-identity:GetId"
- pattern: |
"cognito-identity:MergeDeveloperIdentities"
- pattern: |
"cognito-identity:SetIdentityPoolRoles"
- pattern: |
"cognito-identity:UnlinkDeveloperIdentity"
- pattern: |
"cognito-identity:UnlinkIdentity"
- pattern: |
"cognito-identity:UpdateIdentityPool"
- pattern: |
"deeplens:AssociateServiceRoleToAccount"
- pattern: |
"ds:CreateConditionalForwarder"
- pattern: |
"ds:CreateDirectory"
- pattern: |
"ds:CreateMicrosoftAD"
- pattern: |
"ds:CreateTrust"
- pattern: |
"ds:ShareDirectory"
- pattern: |
"ec2:CreateNetworkInterfacePermission"
- pattern: |
"ec2:DeleteNetworkInterfacePermission"
- pattern: |
"ec2:ModifySnapshotAttribute"
- pattern: |
"ec2:ModifyVpcEndpointServicePermissions"
- pattern: |
"ec2:ResetSnapshotAttribute"
- pattern: |
"ecr:DeleteRepositoryPolicy"
- pattern: |
"ecr:SetRepositoryPolicy"
- pattern: |
"elasticfilesystem:DeleteFileSystemPolicy"
- pattern: |
"elasticfilesystem:PutFileSystemPolicy"
- pattern: |
"elasticmapreduce:PutBlockPublicAccessConfiguration"
- pattern: |
"es:CreateElasticsearchDomain"
- pattern: |
"es:UpdateElasticsearchDomainConfig"
- pattern: |
"glacier:AbortVaultLock"
- pattern: |
"glacier:CompleteVaultLock"
- pattern: |
"glacier:DeleteVaultAccessPolicy"
- pattern: |
"glacier:InitiateVaultLock"
- pattern: |
"glacier:SetDataRetrievalPolicy"
- pattern: |
"glacier:SetVaultAccessPolicy"
- pattern: |
"glue:DeleteResourcePolicy"
- pattern: |
"glue:PutResourcePolicy"
- pattern: |
"greengrass:AssociateServiceRoleToAccount"
- pattern: |
"health:DisableHealthServiceAccessForOrganization"
- pattern: |
"health:EnableHealthServiceAccessForOrganization"
- pattern: |
"iam:AddClientIDToOpenIDConnectProvider"
- pattern: |
"iam:AddRoleToInstanceProfile"
- pattern: |
"iam:AddUserToGroup"
- pattern: |
"iam:AttachGroupPolicy"
- pattern: |
"iam:AttachRolePolicy"
- pattern: |
"iam:AttachUserPolicy"
- pattern: |
"iam:ChangePassword"
- pattern: |
"iam:CreateAccessKey"
- pattern: |
"iam:CreateAccountAlias"
- pattern: |
"iam:CreateGroup"
- pattern: |
"iam:CreateInstanceProfile"
- pattern: |
"iam:CreateLoginProfile"
- pattern: |
"iam:CreateOpenIDConnectProvider"
- pattern: |
"iam:CreatePolicy"
- pattern: |
"iam:CreatePolicyVersion"
- pattern: |
"iam:CreateRole"
- pattern: |
"iam:CreateSAMLProvider"
- pattern: |
"iam:CreateServiceLinkedRole"
- pattern: |
"iam:CreateServiceSpecificCredential"
- pattern: |
"iam:CreateUser"
- pattern: |
"iam:CreateVirtualMFADevice"
- pattern: |
"iam:DeactivateMFADevice"
- pattern: |
"iam:DeleteAccessKey"
- pattern: |
"iam:DeleteAccountAlias"
- pattern: |
"iam:DeleteAccountPasswordPolicy"
- pattern: |
"iam:DeleteGroup"
- pattern: |
"iam:DeleteGroupPolicy"
- pattern: |
"iam:DeleteInstanceProfile"
- pattern: |
"iam:DeleteLoginProfile"
- pattern: |
"iam:DeleteOpenIDConnectProvider"
- pattern: |
"iam:DeletePolicy"
- pattern: |
"iam:DeletePolicyVersion"
- pattern: |
"iam:DeleteRole"
- pattern: |
"iam:DeleteRolePermissionsBoundary"
- pattern: |
"iam:DeleteRolePolicy"
- pattern: |
"iam:DeleteSAMLProvider"
- pattern: |
"iam:DeleteSSHPublicKey"
- pattern: |
"iam:DeleteServerCertificate"
- pattern: |
"iam:DeleteServiceLinkedRole"
- pattern: |
"iam:DeleteServiceSpecificCredential"
- pattern: |
"iam:DeleteSigningCertificate"
- pattern: |
"iam:DeleteUser"
- pattern: |
"iam:DeleteUserPermissionsBoundary"
- pattern: |
"iam:DeleteUserPolicy"
- pattern: |
"iam:DeleteVirtualMFADevice"
- pattern: |
"iam:DetachGroupPolicy"
- pattern: |
"iam:DetachRolePolicy"
- pattern: |
"iam:DetachUserPolicy"
- pattern: |
"iam:EnableMFADevice"
- pattern: |
"iam:PassRole"
- pattern: |
"iam:PutGroupPolicy"
- pattern: |
"iam:PutRolePermissionsBoundary"
- pattern: |
"iam:PutRolePolicy"
- pattern: |
"iam:PutUserPermissionsBoundary"
- pattern: |
"iam:PutUserPolicy"
- pattern: |
"iam:RemoveClientIDFromOpenIDConnectProvider"
- pattern: |
"iam:RemoveRoleFromInstanceProfile"
- pattern: |
"iam:RemoveUserFromGroup"
- pattern: |
"iam:ResetServiceSpecificCredential"
- pattern: |
"iam:ResyncMFADevice"
- pattern: |
"iam:SetDefaultPolicyVersion"
- pattern: |
"iam:SetSecurityTokenServicePreferences"
- pattern: |
"iam:UpdateAccessKey"
- pattern: |
"iam:UpdateAccountPasswordPolicy"
- pattern: |
"iam:UpdateAssumeRolePolicy"
- pattern: |
"iam:UpdateGroup"
- pattern: |
"iam:UpdateLoginProfile"
- pattern: |
"iam:UpdateOpenIDConnectProviderThumbprint"
- pattern: |
"iam:UpdateRole"
- pattern: |
"iam:UpdateRoleDescription"
- pattern: |
"iam:UpdateSAMLProvider"
- pattern: |
"iam:UpdateSSHPublicKey"
- pattern: |
"iam:UpdateServerCertificate"
- pattern: |
"iam:UpdateServiceSpecificCredential"
- pattern: |
"iam:UpdateSigningCertificate"
- pattern: |
"iam:UpdateUser"
- pattern: |
"iam:UploadSSHPublicKey"
- pattern: |
"iam:UploadServerCertificate"
- pattern: |
"iam:UploadSigningCertificate"
- pattern: |
"imagebuilder:PutComponentPolicy"
- pattern: |
"imagebuilder:PutImagePolicy"
- pattern: |
"imagebuilder:PutImageRecipePolicy"
- pattern: |
"iot:AttachPolicy"
- pattern: |
"iot:AttachPrincipalPolicy"
- pattern: |
"iot:DetachPolicy"
- pattern: |
"iot:DetachPrincipalPolicy"
- pattern: |
"iot:SetDefaultAuthorizer"
- pattern: |
"iot:SetDefaultPolicyVersion"
- pattern: |
"iotsitewise:CreateAccessPolicy"
- pattern: |
"iotsitewise:DeleteAccessPolicy"
- pattern: |
"iotsitewise:UpdateAccessPolicy"
- pattern: |
"kms:CreateGrant"
- pattern: |
"kms:PutKeyPolicy"
- pattern: |
"kms:RetireGrant"
- pattern: |
"kms:RevokeGrant"
- pattern: |
"lakeformation:BatchGrantPermissions"
- pattern: |
"lakeformation:BatchRevokePermissions"
- pattern: |
"lakeformation:GrantPermissions"
- pattern: |
"lakeformation:PutDataLakeSettings"
- pattern: |
"lakeformation:RevokePermissions"
- pattern: |
"lambda:AddLayerVersionPermission"
- pattern: |
"lambda:AddPermission"
- pattern: |
"lambda:DisableReplication"
- pattern: |
"lambda:EnableReplication"
- pattern: |
"lambda:RemoveLayerVersionPermission"
- pattern: |
"lambda:RemovePermission"
- pattern: |
"license-manager:UpdateServiceSettings"
- pattern: |
"lightsail:GetRelationalDatabaseMasterUserPassword"
- pattern: |
"logs:DeleteResourcePolicy"
- pattern: |
"logs:PutResourcePolicy"
- pattern: |
"mediapackage:RotateIngestEndpointCredentials"
- pattern: |
"mediastore:DeleteContainerPolicy"
- pattern: |
"mediastore:PutContainerPolicy"
- pattern: |
"opsworks:SetPermission"
- pattern: |
"opsworks:UpdateUserProfile"
- pattern: |
"quicksight:CreateAdmin"
- pattern: |
"quicksight:CreateGroup"
- pattern: |
"quicksight:CreateGroupMembership"
- pattern: |
"quicksight:CreateIAMPolicyAssignment"
- pattern: |
"quicksight:CreateUser"
- pattern: |
"quicksight:DeleteGroup"
- pattern: |
"quicksight:DeleteGroupMembership"
- pattern: |
"quicksight:DeleteIAMPolicyAssignment"
- pattern: |
"quicksight:DeleteUser"
- pattern: |
"quicksight:DeleteUserByPrincipalId"
- pattern: |
"quicksight:RegisterUser"
- pattern: |
"quicksight:UpdateDashboardPermissions"
- pattern: |
"quicksight:UpdateGroup"
- pattern: |
"quicksight:UpdateIAMPolicyAssignment"
- pattern: |
"quicksight:UpdateTemplatePermissions"
- pattern: |
"quicksight:UpdateUser"
- pattern: |
"ram:AcceptResourceShareInvitation"
- pattern: |
"ram:AssociateResourceShare"
- pattern: |
"ram:CreateResourceShare"
- pattern: |
"ram:DeleteResourceShare"
- pattern: |
"ram:DisassociateResourceShare"
- pattern: |
"ram:EnableSharingWithAwsOrganization"
- pattern: |
"ram:RejectResourceShareInvitation"
- pattern: |
"ram:UpdateResourceShare"
- pattern: |
"rds:AuthorizeDBSecurityGroupIngress"
- pattern: |
"rds-db:connect"
- pattern: |
"redshift:AuthorizeSnapshotAccess"
- pattern: |
"redshift:CreateClusterUser"
- pattern: |
"redshift:CreateSnapshotCopyGrant"
- pattern: |
"redshift:JoinGroup"
- pattern: |
"redshift:ModifyClusterIamRoles"
- pattern: |
"redshift:RevokeSnapshotAccess"
- pattern: |
"route53resolver:PutResolverRulePolicy"
- pattern: |
"s3:BypassGovernanceRetention"
- pattern: |
"s3:DeleteAccessPointPolicy"
- pattern: |
"s3:DeleteBucketPolicy"
- pattern: |
"s3:ObjectOwnerOverrideToBucketOwner"
- pattern: |
"s3:PutAccessPointPolicy"
- pattern: |
"s3:PutAccountPublicAccessBlock"
- pattern: |
"s3:PutBucketAcl"
- pattern: |
"s3:PutBucketPolicy"
- pattern: |
"s3:PutBucketPublicAccessBlock"
- pattern: |
"s3:PutObjectAcl"
- pattern: |
"s3:PutObjectVersionAcl"
- pattern: |
"secretsmanager:DeleteResourcePolicy"
- pattern: |
"secretsmanager:PutResourcePolicy"
- pattern: |
"secretsmanager:ValidateResourcePolicy"
- pattern: |
"servicecatalog:CreatePortfolioShare"
- pattern: |
"servicecatalog:DeletePortfolioShare"
- pattern: |
"sns:AddPermission"
- pattern: |
"sns:CreateTopic"
- pattern: |
"sns:RemovePermission"
- pattern: |
"sns:SetTopicAttributes"
- pattern: |
"sqs:AddPermission"
- pattern: |
"sqs:CreateQueue"
- pattern: |
"sqs:RemovePermission"
- pattern: |
"sqs:SetQueueAttributes"
- pattern: |
"ssm:ModifyDocumentPermission"
- pattern: |
"sso:AssociateDirectory"
- pattern: |
"sso:AssociateProfile"
- pattern: |
"sso:CreateApplicationInstance"
- pattern: |
"sso:CreateApplicationInstanceCertificate"
- pattern: |
"sso:CreatePermissionSet"
- pattern: |
"sso:CreateProfile"
- pattern: |
"sso:CreateTrust"
- pattern: |
"sso:DeleteApplicationInstance"
- pattern: |
"sso:DeleteApplicationInstanceCertificate"
- pattern: |
"sso:DeletePermissionSet"
- pattern: |
"sso:DeletePermissionsPolicy"
- pattern: |
"sso:DeleteProfile"
- pattern: |
"sso:DisassociateDirectory"
- pattern: |
"sso:DisassociateProfile"
- pattern: |
"sso:ImportApplicationInstanceServiceProviderMetadata"
- pattern: |
"sso:PutPermissionsPolicy"
- pattern: |
"sso:StartSSO"
- pattern: |
"sso:UpdateApplicationInstanceActiveCertificate"
- pattern: |
"sso:UpdateApplicationInstanceDisplayData"
- pattern: |
"sso:UpdateApplicationInstanceResponseConfiguration"
- pattern: |
"sso:UpdateApplicationInstanceResponseSchemaConfiguration"
- pattern: |
"sso:UpdateApplicationInstanceSecurityConfiguration"
- pattern: |
"sso:UpdateApplicationInstanceServiceProviderConfiguration"
- pattern: |
"sso:UpdateApplicationInstanceStatus"
- pattern: |
"sso:UpdateDirectoryAssociation"
- pattern: |
"sso:UpdatePermissionSet"
- pattern: |
"sso:UpdateProfile"
- pattern: |
"sso:UpdateSSOConfiguration"
- pattern: |
"sso:UpdateTrust"
- pattern: |
"sso-directory:AddMemberToGroup"
- pattern: |
"sso-directory:CreateAlias"
- pattern: |
"sso-directory:CreateGroup"
- pattern: |
"sso-directory:CreateUser"
- pattern: |
"sso-directory:DeleteGroup"
- pattern: |
"sso-directory:DeleteUser"
- pattern: |
"sso-directory:DisableUser"
- pattern: |
"sso-directory:EnableUser"
- pattern: |
"sso-directory:RemoveMemberFromGroup"
- pattern: |
"sso-directory:UpdateGroup"
- pattern: |
"sso-directory:UpdatePassword"
- pattern: |
"sso-directory:UpdateUser"
- pattern: |
"sso-directory:VerifyEmail"
- pattern: |
"storagegateway:DeleteChapCredentials"
- pattern: |
"storagegateway:SetLocalConsolePassword"
- pattern: |
"storagegateway:SetSMBGuestPassword"
- pattern: |
"storagegateway:UpdateChapCredentials"
- pattern: |
"waf:DeletePermissionPolicy"
- pattern: |
"waf:PutPermissionPolicy"
- pattern: |
"waf-regional:DeletePermissionPolicy"
- pattern: |
"waf-regional:PutPermissionPolicy"
- pattern: |
"wafv2:CreateWebACL"
- pattern: |
"wafv2:DeletePermissionPolicy"
- pattern: |
"wafv2:DeleteWebACL"
- pattern: |
"wafv2:PutPermissionPolicy"
- pattern: |
"wafv2:UpdateWebACL"
- pattern: |
"worklink:UpdateDevicePolicyConfiguration"
- pattern: |
"workmail:ResetPassword"
- pattern: |
"workmail:ResetUserPassword"
- pattern: |
"xray:PutEncryptionConfig"
- pattern: |
"worklink:*"
- pattern: |
"route53resolver:*"
- pattern: |
"es:*"
- pattern: |
"greengrass:*"
- pattern: |
"redshift:*"
- pattern: |
"license-manager:*"
- pattern: |
"rds:*"
- pattern: |
"lambda:*"
- pattern: |
"elasticfilesystem:*"
- pattern: |
"logs:*"
- pattern: |
"sso:*"
- pattern: |
"waf:*"
- pattern: |
"mediastore:*"
- pattern: |
"acm-pca:*"
- pattern: |
"sso-directory:*"
- pattern: |
"imagebuilder:*"
- pattern: |
"sqs:*"
- pattern: |
"codeguru-profiler:*"
- pattern: |
"wafv2:*"
- pattern: |
"cloudformation:*"
- pattern: |
"xray:*"
- pattern: |
"codeartifact:*"
- pattern: |
"iotsitewise:*"
- pattern: |
"workmail:*"
- pattern: |
"glue:*"
- pattern: |
"deeplens:*"
- pattern: |
"chime:*"
- pattern: |
"mediapackage:*"
- pattern: |
"opsworks:*"
- pattern: |
"ds:*"
- pattern: |
"ram:*"
- pattern: |
"iam:*"
- pattern: |
"waf-regional:*"
- pattern: |
"glacier:*"
- pattern: |
"cloudsearch:*"
- pattern: |
"lakeformation:*"
- pattern: |
"elasticmapreduce:*"
- pattern: |
"quicksight:*"
- pattern: |
"sns:*"
- pattern: |
"ec2:*"
- pattern: |
"health:*"
- pattern: |
"lightsail:*"
- pattern: |
"codestar:*"
- pattern: |
"kms:*"
- pattern: |
"codebuild:*"
- pattern: |
"s3:*"
- pattern: |
"cognito-identity:*"
- pattern: |
"apigateway:*"
- pattern: |
"rds-db:*"
- pattern: |
"iot:*"
- pattern: |
"backup:*"
- pattern: |
"secretsmanager:*"
- pattern: |
"servicecatalog:*"
- pattern: |
"ssm:*"
- pattern: |
"storagegateway:*"
- pattern: |
"ecr:*"
message: Ensure IAM policies don't allow resource exposure. These actions can expose
AWS resources to the public. For example `ecr:SetRepositoryPolicy` could let an
attacker retrieve container images. Instead, use another action that doesn't expose
AWS resources.
metadata:
references:
- https://cloudsplaining.readthedocs.io/en/latest/glossary/resource-exposure/
- https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/IAMPermissionsManagement.py
category: security
cwe:
- 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
technology:
- terraform
- aws
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure
shortlink: https://sg.run/18rD
semgrep.dev:
rule:
r_id: 13566
rv_id: 1263894
rule_id: v8U9r0
version_id: LjTkggK
url: https://semgrep.dev/playground/r/LjTkggK/terraform.lang.security.iam.no-iam-resource-exposure.no-iam-resource-exposure
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions
patterns:
- pattern-either:
- patterns:
- pattern-inside: |
resource $TYPE "..." {
...
policy = jsonencode({
...
Statement = [
...
]
...
})
...
}
- pattern-not-inside: |
resource $TYPE "..." {
...
policy = jsonencode({
...
Statement = [
...,
{... Effect = "Deny" ...},
...
]
...
})
...
}
- pattern-either:
- pattern: Action = "*"
- pattern: Action = ["*"]
- metavariable-pattern:
metavariable: $TYPE
pattern-either:
- pattern: |
"aws_iam_role_policy"
- pattern: |
"aws_iam_policy"
- pattern: |
"aws_iam_user_policy"
- pattern: |
"aws_iam_group_policy"
- patterns:
- pattern-inside: |
data aws_iam_policy_document "..." {
...
statement {
...
}
...
}
- pattern-not-inside: |
data aws_iam_policy_document "..." {
...
statement {
...
effect = "Deny"
...
}
...
}
- pattern: |
actions = ["*"]
message: Ensure that no IAM policies allow "*" as a statement's actions. This allows
all actions to be performed on the specified resources, and is a violation of
the principle of least privilege. Instead, specify the actions that a certain
user or policy is allowed to take.
metadata:
references:
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy
- https://github.com/bridgecrewio/checkov/blob/ca830e14745c2c8e1b941985f305abe985d7f1f9/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py
category: security
cwe:
- 'CWE-269: Improper Privilege Management'
technology:
- terraform
- aws
owasp:
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions
shortlink: https://sg.run/9rZ4
semgrep.dev:
rule:
r_id: 13567
rv_id: 1263895
rule_id: d8Uew3
version_id: 8KT5rrp
url: https://semgrep.dev/playground/r/8KT5rrp/terraform.lang.security.iam.no-iam-star-actions.no-iam-star-actions
origin: community
languages:
- hcl
severity: WARNING
- id: javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true
message: 'By setting `allErrors: true` in `Ajv` library, all error objects will
be allocated without limit. This allows the attacker to produce a huge number
of errors which can lead to denial of service. Do not use `allErrors: true` in
production.'
metadata:
cwe:
- 'CWE-400: Uncontrolled Resource Consumption'
category: security
technology:
- ajv
references:
- https://ajv.js.org/options.html#allerrors
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Denial-of-Service (DoS)
source: https://semgrep.dev/r/javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true
shortlink: https://sg.run/d2jY
semgrep.dev:
rule:
r_id: 13578
rv_id: 945749
rule_id: PeUo5X
version_id: 44TZkJ6
url: https://semgrep.dev/playground/r/44TZkJ6/javascript.ajv.security.audit.ajv-allerrors-true.ajv-allerrors-true
origin: community
languages:
- javascript
- typescript
severity: WARNING
pattern-either:
- pattern: |
new Ajv({...,allErrors: true,...},...)
- patterns:
- pattern: |
new Ajv($SETTINGS,...)
- pattern-inside: |
$SETTINGS = {...,allErrors: true,...}
...
- id: javascript.express.security.audit.remote-property-injection.remote-property-injection
message: Bracket object notation with user input is present, this might allow an
attacker to access all properties of the object and even it's prototype. Use literal
values for object properties.
metadata:
confidence: LOW
owasp:
- A02:2017 - Broken Authentication
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
cwe:
- 'CWE-522: Insufficiently Protected Credentials'
category: security
technology:
- express
references:
- https://github.com/nodesecurity/eslint-plugin-security/blob/3c7522ca1be800353513282867a1034c795d9eb4/docs/the-dangers-of-square-bracket-notation.md
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/javascript.express.security.audit.remote-property-injection.remote-property-injection
shortlink: https://sg.run/Z4gn
semgrep.dev:
rule:
r_id: 13579
rv_id: 1263148
rule_id: JDUL1B
version_id: 44TEjGX
url: https://semgrep.dev/playground/r/44TEjGX/javascript.express.security.audit.remote-property-injection.remote-property-injection
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern-inside: $OBJ[...] = ...
- pattern-not-inside: $OBJ["..."] = ...
- pattern-not-inside: $OBJ[...] = "..."
- pattern: $INDEX
- pattern-not: |
"..." + $INDEX
- pattern-not: |
$INDEX + "..."
pattern-sanitizers:
- patterns:
- pattern: var $X = ...
- pattern-not: var $X = $REQ.$ANY
- id: javascript.express.security.cors-misconfiguration.cors-misconfiguration
message: By letting user input control CORS parameters, there is a risk that software
does not properly verify that the source of data or communication is valid. Use
literal values for CORS settings.
metadata:
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe:
- 'CWE-346: Origin Validation Error'
category: security
references:
- https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
technology:
- express
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/javascript.express.security.cors-misconfiguration.cors-misconfiguration
shortlink: https://sg.run/nKXO
semgrep.dev:
rule:
r_id: 13580
rv_id: 1263162
rule_id: 5rULJQ
version_id: YDTZe8Y
url: https://semgrep.dev/playground/r/YDTZe8Y/javascript.express.security.cors-misconfiguration.cors-misconfiguration
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern-either:
- pattern: $RES.set($HEADER, $X)
- pattern: $RES.header($HEADER, $X)
- pattern: $RES.setHeader($HEADER, $X)
- pattern: |
$RES.set({$HEADER: $X}, ...)
- pattern: |
$RES.writeHead($STATUS, {$HEADER: $X}, ...)
- focus-metavariable: $X
- metavariable-regex:
metavariable: $HEADER
regex: .*(Access-Control-Allow-Origin|access-control-allow-origin).*
- id: javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration
message: By letting user input control `X-Frame-Options` header, there is a risk
that software does not properly verify whether or not a browser should be allowed
to render a page in an `iframe`.
metadata:
references:
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
owasp:
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
cwe:
- 'CWE-451: User Interface (UI) Misrepresentation of Critical Information'
category: security
technology:
- express
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration
shortlink: https://sg.run/EvjA
semgrep.dev:
rule:
r_id: 13581
rv_id: 1263178
rule_id: GdUrLy
version_id: xyTjz3D
url: https://semgrep.dev/playground/r/xyTjz3D/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern-either:
- pattern: $RES.set($HEADER, ...)
- pattern: $RES.header($HEADER, ...)
- pattern: $RES.setHeader($HEADER, ...)
- pattern: |
$RES.set({$HEADER: ...}, ...)
- pattern: |
$RES.writeHead($STATUS, {$HEADER: ...}, ...)
- metavariable-regex:
metavariable: $HEADER
regex: .*(X-Frame-Options|x-frame-options).*
- id: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring
message: Detected string concatenation with a non-literal variable in a util.format
/ console.log function. If an attacker injects a format specifier in the string,
it will forge the log message. Try to use constant values for the format string.
metadata:
cwe:
- 'CWE-134: Use of Externally-Controlled Format String'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
category: security
technology:
- javascript
subcategory:
- audit
likelihood: MEDIUM
impact: LOW
confidence: LOW
references:
- https://cwe.mitre.org/data/definitions/134.html
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring
shortlink: https://sg.run/7Y5R
semgrep.dev:
rule:
r_id: 13582
rv_id: 1263211
rule_id: ReU3OJ
version_id: A8Tgdyq
url: https://semgrep.dev/playground/r/A8Tgdyq/javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring
origin: community
languages:
- javascript
- typescript
severity: INFO
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: $X + $Y
- pattern: $X.concat($Y)
- pattern: |
`...${...}...`
- pattern-not: |
"..." + "..."
- pattern-not: |
$X.concat("...")
pattern-sinks:
- patterns:
- focus-metavariable: $STR
- pattern-either:
- pattern: |
console.$LOG($STR,$PARAM,...)
- patterns:
- pattern-inside: |
$UTIL = require('util')
...
- pattern: |
$UTIL.format($STR,$PARAM,...)
- id: ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation
metadata:
shortDescription: Allowing an attacker to manipulate the session may lead to unintended
behavior.
tags:
- security
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-276: Incorrect Default Permissions'
references:
- https://brakemanscanner.org/docs/warning_types/session_manipulation/
category: security
technology:
- rails
help: |
## Remediation
Session manipulation can occur when an application allows user-input in session keys. Since sessions are typically considered a source of truth (e.g. to check the logged-in user or to match CSRF tokens), allowing an attacker to manipulate the session may lead to unintended behavior.
## References
[Session Manipulation](https://brakemanscanner.org/docs/warning_types/session_manipulation/)
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation
shortlink: https://sg.run/86q7
semgrep.dev:
rule:
r_id: 13584
rv_id: 1263621
rule_id: BYUdW6
version_id: qkTR76G
url: https://semgrep.dev/playground/r/qkTR76G/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation
origin: community
message: This gets data from session using user inputs. A malicious user may be
able to retrieve information from your session that you didn't intend them to.
Do not use user input as a session key.
languages:
- ruby
severity: WARNING
mode: taint
pattern-sources:
- pattern: params
- pattern: cookies
- pattern: request.env
pattern-sinks:
- pattern: session[...]
- id: ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access
metadata:
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
references:
- https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown
category: security
technology:
- rails
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access
shortlink: https://sg.run/gYln
semgrep.dev:
rule:
r_id: 13585
rv_id: 1263622
rule_id: DbU1dr
version_id: l4TJRkk
url: https://semgrep.dev/playground/r/l4TJRkk/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access
origin: community
message: Using user input when accessing files is potentially dangerous. A malicious
actor could use this to modify or access files they have no right to.
languages:
- ruby
severity: WARNING
mode: taint
pattern-sources:
- pattern: params
- pattern: cookies
- pattern: request.env
pattern-sinks:
- patterns:
- pattern-either:
- pattern: Dir.$X(...)
- pattern: File.$X(...)
- pattern: IO.$X(...)
- pattern: Kernel.$X(...)
- pattern: PStore.$X(...)
- pattern: Pathname.$X(...)
- metavariable-pattern:
metavariable: $X
patterns:
- pattern-either:
- pattern: chdir
- pattern: chroot
- pattern: delete
- pattern: entries
- pattern: foreach
- pattern: glob
- pattern: install
- pattern: lchmod
- pattern: lchown
- pattern: link
- pattern: load
- pattern: load_file
- pattern: makedirs
- pattern: move
- pattern: new
- pattern: open
- pattern: read
- pattern: readlines
- pattern: rename
- pattern: rmdir
- pattern: safe_unlink
- pattern: symlink
- pattern: syscopy
- pattern: sysopen
- pattern: truncate
- pattern: unlink
- id: ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call
metadata:
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
references:
- https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown
category: security
technology:
- rails
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call
shortlink: https://sg.run/Q9gP
semgrep.dev:
rule:
r_id: 13586
rv_id: 1263623
rule_id: WAUyzp
version_id: YDTZeWL
url: https://semgrep.dev/playground/r/YDTZeWL/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call
origin: community
message: Using user input when accessing files is potentially dangerous. A malicious
actor could use this to modify or access files they have no right to.
languages:
- ruby
severity: WARNING
mode: taint
pattern-sources:
- pattern: params
- pattern: cookies
- pattern: request.env
pattern-sinks:
- pattern-either:
- pattern: Net::FTP.$X(...)
- patterns:
- pattern-inside: |
$FTP = Net::FTP.$OPEN(...)
...
$FTP.$METHOD(...)
- pattern: $FTP.$METHOD(...)
- id: ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request
metadata:
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
references:
- https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown
category: security
technology:
- rails
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request
shortlink: https://sg.run/3rLb
semgrep.dev:
rule:
r_id: 13587
rv_id: 1263624
rule_id: 0oU2x3
version_id: 6xT29nN
url: https://semgrep.dev/playground/r/6xT29nN/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request
origin: community
message: Using user input when accessing files is potentially dangerous. A malicious
actor could use this to modify or access files they have no right to.
languages:
- ruby
severity: WARNING
mode: taint
pattern-sources:
- pattern: params
- pattern: cookies
- pattern: request.env
pattern-sinks:
- pattern-either:
- patterns:
- pattern: Net::HTTP::$METHOD.new(...)
- metavariable-pattern:
metavariable: $METHOD
patterns:
- pattern-either:
- pattern: Copy
- pattern: Delete
- pattern: Get
- pattern: Head
- pattern: Lock
- pattern: Mkcol
- pattern: Move
- pattern: Options
- pattern: Patch
- pattern: Post
- pattern: Propfind
- pattern: Proppatch
- pattern: Put
- pattern: Trace
- pattern: Unlock
- patterns:
- pattern: Net::HTTP.$X(...)
- metavariable-pattern:
metavariable: $X
patterns:
- pattern-either:
- pattern: get
- pattern: get2
- pattern: head
- pattern: head2
- pattern: options
- pattern: patch
- pattern: post
- pattern: post2
- pattern: post_form
- pattern: put
- pattern: request
- pattern: request_get
- pattern: request_head
- pattern: request_post
- pattern: send_request
- pattern: trace
- pattern: get_print
- pattern: get_response
- pattern: start
- id: ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
references:
- https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown
category: security
technology:
- rails
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call
shortlink: https://sg.run/4e8E
semgrep.dev:
rule:
r_id: 13588
rv_id: 1263625
rule_id: KxU72k
version_id: o5TbDq8
url: https://semgrep.dev/playground/r/o5TbDq8/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call
origin: community
message: Using user input when accessing files is potentially dangerous. A malicious
actor could use this to modify or access files they have no right to.
languages:
- ruby
severity: ERROR
mode: taint
pattern-sources:
- pattern-either:
- pattern: params[...]
- pattern: cookies
- pattern: request.env
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: Kernel.$X(...)
- patterns:
- pattern-either:
- pattern: Shell.$X(...)
- patterns:
- pattern-inside: |
$SHELL = Shell.$ANY(...)
...
$SHELL.$X(...)
- pattern: $SHELL.$X(...)
- metavariable-pattern:
metavariable: $X
patterns:
- pattern-either:
- pattern: cat
- pattern: chdir
- pattern: chroot
- pattern: delete
- pattern: entries
- pattern: exec
- pattern: foreach
- pattern: glob
- pattern: install
- pattern: lchmod
- pattern: lchown
- pattern: link
- pattern: load
- pattern: load_file
- pattern: makedirs
- pattern: move
- pattern: new
- pattern: open
- pattern: read
- pattern: readlines
- pattern: rename
- pattern: rmdir
- pattern: safe_unlink
- pattern: symlink
- pattern: syscopy
- pattern: sysopen
- pattern: system
- pattern: truncate
- pattern: unlink
- id: ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes
metadata:
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-276: Incorrect Default Permissions'
references:
- https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/default_routes/index.markdown
category: security
technology:
- rails
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes
shortlink: https://sg.run/Pbrq
semgrep.dev:
rule:
r_id: 13589
rv_id: 1263630
rule_id: qNUXYy
version_id: jQTn5dx
url: https://semgrep.dev/playground/r/jQTn5dx/ruby.rails.security.audit.xss.avoid-default-routes.avoid-default-routes
origin: community
message: Default routes are enabled in this routes file. This means any public method
on a controller can be called as an action. It is very easy to accidentally expose
a method you didn't mean to. Instead, remove this line and explicitly include
all routes you intend external users to follow.
languages:
- ruby
severity: WARNING
patterns:
- pattern-either:
- pattern: map.connect ":controller/:action/:id"
- pattern: match ':controller(/:action(/:id(.:format)))'
paths:
include:
- '*routes.rb'
- id: ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to
metadata:
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_link_to.rb
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://brakemanscanner.org/docs/warning_types/link_to/
- https://brakemanscanner.org/docs/warning_types/link_to_href/
category: security
technology:
- rails
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to
shortlink: https://sg.run/JxXQ
semgrep.dev:
rule:
r_id: 13590
rv_id: 1263632
rule_id: lBU8Qj
version_id: 9lT4brj
url: https://semgrep.dev/playground/r/9lT4brj/ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to
origin: community
message: This code includes user input in `link_to`. In Rails 2.x, the body of `link_to`
is not escaped. This means that user input which reaches the body will be executed
when the HTML is rendered. Even in other versions, values starting with `javascript:`
or `data:` are not escaped. It is better to create and use a safer function which
checks the body argument.
languages:
- ruby
severity: WARNING
mode: taint
pattern-sources:
- pattern: params
- pattern: cookies
- pattern: request.env
- pattern-either:
- pattern: $MODEL.url(...)
- pattern: $MODEL.uri(...)
- pattern: $MODEL.link(...)
- pattern: $MODEL.page(...)
- pattern: $MODEL.site(...)
pattern-sinks:
- pattern: link_to(...)
pattern-sanitizers:
- patterns:
- pattern: |
"...#{...}..."
- pattern-not: |
"#{...}..."
- id: ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect
metadata:
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')'
references:
- https://brakemanscanner.org/docs/warning_types/redirect/
category: security
technology:
- rails
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Open Redirect
source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect
shortlink: https://sg.run/5DY3
semgrep.dev:
rule:
r_id: 13591
rv_id: 1263634
rule_id: YGUDqJ
version_id: rxTAKdY
url: https://semgrep.dev/playground/r/rxTAKdY/ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect
origin: community
message: When a redirect uses user input, a malicious user can spoof a website under
a trusted URL or access restricted parts of a site. When using user-supplied values,
sanitize the value before using it for the redirect.
languages:
- ruby
severity: WARNING
mode: taint
pattern-sources:
- pattern: params
- pattern: cookies
- pattern: request.env
- patterns:
- pattern: $MODEL.$X(...)
- pattern-not: $MODEL.$X("...")
- metavariable-pattern:
metavariable: $X
pattern-either:
- pattern: all
- pattern: create
- pattern: create!
- pattern: find
- pattern: find_by_sql
- pattern: first
- pattern: last
- pattern: new
- pattern: from
- pattern: group
- pattern: having
- pattern: joins
- pattern: lock
- pattern: order
- pattern: reorder
- pattern: select
- pattern: where
- pattern: find_by
- pattern: find_by!
- pattern: take
pattern-sinks:
- pattern: redirect_to(...)
pattern-sanitizers:
- pattern: params.merge(:only_path => true)
- pattern: params.merge(:host => ...)
- id: ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path
metadata:
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
references:
- https://brakemanscanner.org/docs/warning_types/dynamic_render_paths/
category: security
technology:
- rails
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path
shortlink: https://sg.run/GO2n
semgrep.dev:
rule:
r_id: 13592
rv_id: 1263635
rule_id: 6JU1bL
version_id: bZT53p0
url: https://semgrep.dev/playground/r/bZT53p0/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path
origin: community
message: Avoid rendering user input. It may be possible for a malicious user to
input a path that lets them access a template they shouldn't. To prevent this,
check dynamic template paths against a predefined allowlist to make sure it's
an allowed template.
languages:
- ruby
severity: WARNING
mode: taint
pattern-sources:
- pattern: params
- pattern: cookies
- pattern: request.env
pattern-sinks:
- patterns:
- pattern-inside: render($X => $INPUT, ...)
- pattern: $INPUT
- metavariable-pattern:
metavariable: $X
pattern-either:
- pattern: action
- pattern: template
- pattern: partial
- pattern: file
- id: python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
languages:
- python
severity: WARNING
metadata:
category: security
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-276: Incorrect Default Permissions'
technology:
- python
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
shortlink: https://sg.run/AXY4
semgrep.dev:
rule:
r_id: 13594
rv_id: 1263482
rule_id: zdUYqR
version_id: O9Tpxqr
url: https://semgrep.dev/playground/r/O9Tpxqr/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
origin: community
message: These permissions `$BITS` are widely permissive and grant access to more
people than may be necessary. A good default is `0o644` which gives read and write
access to yourself and read access to everyone else.
patterns:
- pattern-inside: os.$METHOD(...)
- metavariable-pattern:
metavariable: $METHOD
patterns:
- pattern-either:
- pattern: chmod
- pattern: lchmod
- pattern: fchmod
- pattern-either:
- patterns:
- pattern: os.$METHOD($FILE, $BITS, ...)
- metavariable-comparison:
metavariable: $BITS
comparison: $BITS >= 0o650 and $BITS < 0o100000
- patterns:
- pattern: os.$METHOD($FILE, $BITS)
- metavariable-comparison:
metavariable: $BITS
comparison: $BITS >= 0o100650
- patterns:
- pattern: os.$METHOD($FILE, $BITS, ...)
- metavariable-pattern:
metavariable: $BITS
patterns:
- pattern-either:
- pattern: <... stat.S_IWGRP ...>
- pattern: <... stat.S_IXGRP ...>
- pattern: <... stat.S_IWOTH ...>
- pattern: <... stat.S_IXOTH ...>
- pattern: <... stat.S_IRWXO ...>
- pattern: <... stat.S_IRWXG ...>
- patterns:
- pattern: os.$METHOD($FILE, $EXPR | $MOD, ...)
- metavariable-comparison:
metavariable: $MOD
comparison: $MOD == 0o111
- id: csharp.lang.security.ssrf.http-client.ssrf
severity: ERROR
languages:
- csharp
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
category: security
technology:
- .net
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/csharp.lang.security.ssrf.http-client.ssrf
shortlink: https://sg.run/4eB9
semgrep.dev:
rule:
r_id: 13700
rv_id: 1262649
rule_id: 10UdbE
version_id: A8Tgde1
url: https://semgrep.dev/playground/r/A8Tgde1/csharp.lang.security.ssrf.http-client.ssrf
origin: community
message: SSRF is an attack vector that abuses an application to interact with the
internal/external network or the machine itself.
patterns:
- pattern-inside: |
using System.Net.Http;
...
- pattern-either:
- pattern: |
$T $F(..., $X, ...)
{
...
HttpClient $Y = new HttpClient();
...
... $Y.GetAsync(<... $X ...>, ...);
}
- pattern: |
$T $F(..., $X, ...)
{
...
$A $B = <... $X ...>;
...
HttpClient $Y = new HttpClient();
...
... $Y.GetAsync($B, ...);
}
- pattern: |
$T $F(..., $X, ...)
{
...
HttpClient $Y = new HttpClient();
...
... $Y.GetStringAsync(<... $X ...>);
}
- pattern: |
$T $F(..., $X, ...)
{
...
$A $B = <... $X ...>;
...
HttpClient $Y = new HttpClient();
...
... $Y.GetStringAsync($B);
}
- id: csharp.lang.security.ssrf.rest-client.ssrf
severity: ERROR
languages:
- csharp
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
category: security
technology:
- .net
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/csharp.lang.security.ssrf.rest-client.ssrf
shortlink: https://sg.run/Pb9v
semgrep.dev:
rule:
r_id: 13701
rv_id: 1262650
rule_id: 9AURoq
version_id: BjTkZzn
url: https://semgrep.dev/playground/r/BjTkZzn/csharp.lang.security.ssrf.rest-client.ssrf
origin: community
message: SSRF is an attack vector that abuses an application to interact with the
internal/external network or the machine itself.
patterns:
- pattern-inside: |
using RestSharp;
...
- pattern-either:
- pattern: |
$T $F(..., $X, ...)
{
...
... new RestClient(<... $X ...>);
}
- pattern: |
$T $F(..., $X, ...)
{
...
$A $B = <... $X ...>;
...
... new RestClient($B);
}
- id: csharp.lang.security.ssrf.web-client.ssrf
severity: ERROR
languages:
- csharp
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
category: security
technology:
- .net
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/csharp.lang.security.ssrf.web-client.ssrf
shortlink: https://sg.run/JxqP
semgrep.dev:
rule:
r_id: 13702
rv_id: 1262651
rule_id: yyUPBe
version_id: DkTRbxP
url: https://semgrep.dev/playground/r/DkTRbxP/csharp.lang.security.ssrf.web-client.ssrf
origin: community
message: SSRF is an attack vector that abuses an application to interact with the
internal/external network or the machine itself.
patterns:
- pattern-inside: |
using System.Net;
...
- pattern-either:
- pattern: |
$T $F(..., $X, ...)
{
...
WebClient $Y = new WebClient();
...
... $Y.OpenRead(<... $X ...>);
}
- pattern: |
$T $F(..., $X, ...)
{
...
$A $B = <... $X ...>;
...
WebClient $Y = new WebClient();
...
... $Y.OpenRead($B);
}
- pattern: |
$T $F(..., $X, ...)
{
...
WebClient $Y = new WebClient();
...
... $Y.OpenReadAsync(<... $X ...>, ...);
}
- pattern: |
$T $F(..., $X, ...)
{
...
$A $B = <... $X ...>;
...
WebClient $Y = new WebClient();
...
... $Y.OpenReadAsync($B, ...);
}
- pattern: |
$T $F(..., $X, ...)
{
...
WebClient $Y = new WebClient();
...
... $Y.DownloadString(<... $X ...>);
}
- pattern: |
$T $F(..., $X, ...)
{
...
$A $B = <... $X ...>;
...
WebClient $Y = new WebClient();
...
... $Y.DownloadString($B);
}
- id: csharp.lang.security.ssrf.web-request.ssrf
severity: ERROR
languages:
- csharp
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://cwe.mitre.org/data/definitions/918.html
- https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
category: security
technology:
- .net
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/csharp.lang.security.ssrf.web-request.ssrf
shortlink: https://sg.run/5DWj
semgrep.dev:
rule:
r_id: 13703
rv_id: 1262652
rule_id: r6UwoG
version_id: WrTqKND
url: https://semgrep.dev/playground/r/WrTqKND/csharp.lang.security.ssrf.web-request.ssrf
origin: community
message: The web server receives a URL or similar request from an upstream component
and retrieves the contents of this URL, but it does not sufficiently ensure that
the request is being sent to the expected destination. Many different options
exist to fix this issue depending the use case (Application can send request only
to identified and trusted applications, Application can send requests to ANY external
IP address or domain name).
patterns:
- pattern-inside: |
using System.Net;
...
- pattern-either:
- pattern: |
$T $F(..., $X, ...)
{
...
... WebRequest.Create(<... $X ...>);
}
- pattern: |
$T $F($X)
{
...
$A $B = <... $X ...>;
...
... WebRequest.Create($B);
}
- pattern: |
$T $F($X)
{
...
$A $B = <... $X ...>;
...
$C $D = <... $B ...>;
...
... WebRequest.Create($D);
}
- id: html.security.audit.missing-integrity.missing-integrity
metadata:
category: security
technology:
- html
cwe:
- 'CWE-353: Missing Support for Integrity Check'
owasp:
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
confidence: LOW
references:
- https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/html.security.audit.missing-integrity.missing-integrity
shortlink: https://sg.run/krXA
semgrep.dev:
rule:
r_id: 13728
rv_id: 1262975
rule_id: AbUQzj
version_id: w8TRopQ
url: https://semgrep.dev/playground/r/w8TRopQ/html.security.audit.missing-integrity.missing-integrity
origin: community
patterns:
- pattern-either:
- pattern: <script $...A >...</script>
- pattern: <link $...A >
- metavariable-pattern:
metavariable: $...A
patterns:
- pattern-either:
- pattern: src='... :// ...'
- pattern: src="... :// ..."
- pattern: href='... :// ...'
- pattern: href="... :// ..."
- pattern: src='//...'
- pattern: src="//..."
- pattern: href='//...'
- pattern: href="//..."
- pattern-not-regex: (?is).*integrity=.*
- pattern-not-regex: (google-analytics\.com|fonts\.googleapis\.com|fonts\.gstatic\.com|googletagmanager\.com)
- pattern-not-regex: .*rel\s*=\s*['"]?preconnect.*
paths:
include:
- '*.html'
message: "This tag is missing an 'integrity' subresource integrity attribute. The
'integrity' attribute allows for the browser to verify that externally hosted
files (for example from a CDN) are delivered without unexpected manipulation.
Without this attribute, if an attacker can modify the externally hosted resource,
this could lead to XSS and other types of attacks. To prevent this, include the
base64-encoded cryptographic hash of the resource (file) you\u2019re telling the
browser to fetch in the 'integrity' attribute for all externally hosted files."
severity: WARNING
languages:
- generic
- id: php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query
languages:
- php
message: Detected string concatenation with a non-literal variable in a Doctrine
DBAL query method. This could lead to SQL injection if the variable is user-controlled
and not properly sanitized. In order to prevent SQL injection, use parameterized
queries or prepared statements instead.
metadata:
category: security
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/security.html
- https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
technology:
- doctrine
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query
shortlink: https://sg.run/KXWn
semgrep.dev:
rule:
r_id: 13799
rv_id: 1263270
rule_id: X5UdZj
version_id: jQTn5pd
url: https://semgrep.dev/playground/r/jQTn5pd/php.doctrine.security.audit.doctrine-dbal-dangerous-query.doctrine-dbal-dangerous-query
origin: community
patterns:
- pattern-either:
- pattern: $CONNECTION->prepare($QUERY,...)
- pattern: $CONNECTION->createQuery($QUERY,...)
- pattern: $CONNECTION->executeQuery($QUERY,...)
- pattern-either:
- pattern-inside: |
use Doctrine\DBAL\Connection;
...
- pattern-inside: |
$CONNECTION = $SMTH->getConnection(...);
...
- pattern-not: $CONNECTION->prepare("...",...)
- pattern-not: $CONNECTION->createQuery("...",...)
- pattern-not: $CONNECTION->executeQuery("...",...)
severity: WARNING
- id: php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect
patterns:
- pattern: $this->redirect(...)
- pattern-not: $this->redirect("...")
- pattern-not: $this->redirect()
message: The `redirect()` method does not check its destination in any way. If you
redirect to a URL provided by end-users, your application may be open to the unvalidated
redirects security vulnerability. Consider using literal values or an allowlist
to validate URLs.
languages:
- php
metadata:
references:
- https://symfony.com/doc/current/controller.html#redirecting
- https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')'
category: security
technology:
- symfony
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Open Redirect
source: https://semgrep.dev/r/php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect
shortlink: https://sg.run/4ey5
semgrep.dev:
rule:
r_id: 13800
rv_id: 1263316
rule_id: j2U3q8
version_id: 0bTKz0j
url: https://semgrep.dev/playground/r/0bTKz0j/php.symfony.security.audit.symfony-non-literal-redirect.symfony-non-literal-redirect
origin: community
severity: WARNING
- id: php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query
languages:
- php
message: '`$QUERY` Detected string concatenation with a non-literal variable in
a Doctrine QueryBuilder method. This could lead to SQL injection if the variable
is user-controlled and not properly sanitized. In order to prevent SQL injection,
use parameterized queries or prepared statements instead.'
metadata:
category: security
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/query-builder.html#security-safely-preventing-sql-injection
- https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
technology:
- doctrine
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query
shortlink: https://sg.run/jwDJ
semgrep.dev:
rule:
r_id: 13965
rv_id: 1263271
rule_id: kxUw23
version_id: 1QTypnG
url: https://semgrep.dev/playground/r/1QTypnG/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query
origin: community
mode: taint
pattern-sinks:
- patterns:
- focus-metavariable: $SINK
- pattern-either:
- pattern: $QUERY->add(...,$SINK,...)
- pattern: $QUERY->select(...,$SINK,...)
- pattern: $QUERY->addSelect(...,$SINK,...)
- pattern: $QUERY->delete(...,$SINK,...)
- pattern: $QUERY->update(...,$SINK,...)
- pattern: $QUERY->insert(...,$SINK,...)
- pattern: $QUERY->from(...,$SINK,...)
- pattern: $QUERY->join(...,$SINK,...)
- pattern: $QUERY->innerJoin(...,$SINK,...)
- pattern: $QUERY->leftJoin(...,$SINK,...)
- pattern: $QUERY->rightJoin(...,$SINK,...)
- pattern: $QUERY->where(...,$SINK,...)
- pattern: $QUERY->andWhere(...,$SINK,...)
- pattern: $QUERY->orWhere(...,$SINK,...)
- pattern: $QUERY->groupBy(...,$SINK,...)
- pattern: $QUERY->addGroupBy(...,$SINK,...)
- pattern: $QUERY->having(...,$SINK,...)
- pattern: $QUERY->andHaving(...,$SINK,...)
- pattern: $QUERY->orHaving(...,$SINK,...)
- pattern: $QUERY->orderBy(...,$SINK,...)
- pattern: $QUERY->addOrderBy(...,$SINK,...)
- pattern: $QUERY->set($SINK,...)
- pattern: $QUERY->setValue($SINK,...)
- pattern-either:
- pattern-inside: |
$Q = $X->createQueryBuilder();
...
- pattern-inside: |
$Q = new QueryBuilder(...);
...
pattern-sources:
- patterns:
- pattern-either:
- pattern: sprintf(...)
- pattern: |
"...".$SMTH
severity: WARNING
- id: php.lang.security.ldap-bind-without-password.ldap-bind-without-password
patterns:
- pattern-either:
- pattern: ldap_bind($LDAP, $DN, NULL)
- pattern: ldap_bind($LDAP, $DN, '')
- patterns:
- pattern: ldap_bind(...)
- pattern-not: ldap_bind($LDAP, $DN, $PASSWORD)
message: Detected anonymous LDAP bind. This permits anonymous users to execute LDAP
statements. Consider enforcing authentication for LDAP.
metadata:
references:
- https://www.php.net/manual/en/function.ldap-bind.php
cwe:
- 'CWE-287: Improper Authentication'
owasp:
- A02:2017 - Broken Authentication
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
category: security
technology:
- php
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/php.lang.security.ldap-bind-without-password.ldap-bind-without-password
shortlink: https://sg.run/18Rv
semgrep.dev:
rule:
r_id: 13966
rv_id: 1263292
rule_id: wdUjA5
version_id: 3ZT4X56
url: https://semgrep.dev/playground/r/3ZT4X56/php.lang.security.ldap-bind-without-password.ldap-bind-without-password
origin: community
languages:
- php
severity: WARNING
- id: php.lang.security.php-permissive-cors.php-permissive-cors
patterns:
- pattern: header($VALUE,...)
- pattern-either:
- pattern: header("...",...)
- pattern-inside: |
$VALUE = "...";
...
- metavariable-regex:
metavariable: $VALUE
regex: (\'|\")\s*(Access-Control-Allow-Origin|access-control-allow-origin)\s*:\s*(\*)\s*(\'|\")
message: Access-Control-Allow-Origin response header is set to "*". This will disable
CORS Same Origin Policy restrictions.
metadata:
references:
- https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe:
- 'CWE-346: Origin Validation Error'
category: security
technology:
- php
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/php.lang.security.php-permissive-cors.php-permissive-cors
shortlink: https://sg.run/y1XR
semgrep.dev:
rule:
r_id: 13968
rv_id: 1263296
rule_id: OrU6JZ
version_id: 5PTo1KA
url: https://semgrep.dev/playground/r/5PTo1KA/php.lang.security.php-permissive-cors.php-permissive-cors
origin: community
languages:
- php
severity: WARNING
- id: php.lang.security.unlink-use.unlink-use
patterns:
- pattern: unlink(...)
- pattern-not: unlink("...",...)
message: Using user input when deleting files with `unlink()` is potentially dangerous.
A malicious actor could use this to modify or access files they have no right
to.
metadata:
references:
- https://www.php.net/manual/en/function.unlink
- https://owasp.org/www-project-top-ten/2017/A5_2017-Broken_Access_Control.html
category: security
technology:
- php
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/php.lang.security.unlink-use.unlink-use
shortlink: https://sg.run/rYeR
semgrep.dev:
rule:
r_id: 13969
rv_id: 1263301
rule_id: eqUzDE
version_id: DkTRbBX
url: https://semgrep.dev/playground/r/DkTRbBX/php.lang.security.unlink-use.unlink-use
origin: community
languages:
- php
severity: WARNING
- id: php.lang.security.unserialize-use.unserialize-use
patterns:
- pattern: unserialize(...)
- pattern-not: unserialize("...",...)
message: Calling `unserialize()` with user input in the pattern can lead to arbitrary
code execution. Consider using JSON or structured data approaches (e.g. Google
Protocol Buffers).
metadata:
references:
- https://www.php.net/manual/en/function.unserialize.php
- https://owasp.org/www-project-top-ten/2017/A8_2017-Insecure_Deserialization.html
category: security
technology:
- php
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/php.lang.security.unserialize-use.unserialize-use
shortlink: https://sg.run/b24E
semgrep.dev:
rule:
r_id: 13970
rv_id: 1263302
rule_id: v8U9OJ
version_id: WrTqKeJ
url: https://semgrep.dev/playground/r/WrTqKeJ/php.lang.security.unserialize-use.unserialize-use
origin: community
languages:
- php
severity: WARNING
- id: php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled
patterns:
- pattern-either:
- pattern: $X->createForm($TYPE, $TASK, [..., 'csrf_protection' => false, ...],
...)
- pattern: $X->prependExtensionConfig('framework', [..., 'csrf_protection' =>
false, ...], ...)
- pattern: $X->loadFromExtension('framework', [..., 'csrf_protection' => false,
...], ...)
- pattern: $X->setDefaults([..., 'csrf_protection' => false, ...], ...)
- patterns:
- pattern-either:
- pattern: $X->createForm($TYPE, $TASK, [..., 'csrf_protection' => $VAL, ...],
...)
- pattern: $X->prependExtensionConfig('framework', [..., 'csrf_protection'
=> $VAL, ...], ...)
- pattern: $X->loadFromExtension('framework', [..., 'csrf_protection' => $VAL,
...], ...)
- pattern: $X->setDefaults([..., 'csrf_protection' => $VAL, ...], ...)
- pattern-inside: |
$VAL = false;
...
message: CSRF protection is disabled for this configuration. This is a security
risk. Make sure that it is safe or consider setting `csrf_protection` property
to `true`.
metadata:
references:
- https://symfony.com/doc/current/security/csrf.html
cwe:
- 'CWE-352: Cross-Site Request Forgery (CSRF)'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
category: security
technology:
- symfony
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site Request Forgery (CSRF)
source: https://semgrep.dev/r/php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled
shortlink: https://sg.run/N1gz
semgrep.dev:
rule:
r_id: 13971
rv_id: 1263315
rule_id: d8UeKO
version_id: WrTqKeL
url: https://semgrep.dev/playground/r/WrTqKeL/php.symfony.security.audit.symfony-csrf-protection-disabled.symfony-csrf-protection-disabled
origin: community
languages:
- php
severity: WARNING
- id: php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors
patterns:
- pattern-inside: |
use Symfony\Component\HttpFoundation\Response;
...
- pattern-either:
- patterns:
- pattern-either:
- pattern: |
new Symfony\Component\HttpFoundation\Response($X, $Y, $HEADERS, ...)
- pattern: new Response($X, $Y, $HEADERS, ...)
- pattern-either:
- pattern: new $R($X, $Y, [$KEY => $VALUE], ...)
- pattern-inside: |
$HEADERS = [$KEY => $VALUE];
...
- patterns:
- pattern: $RES->headers->set($KEY, $VALUE)
- metavariable-regex:
metavariable: $KEY
regex: (\'|\")\s*(Access-Control-Allow-Origin|access-control-allow-origin)\s*(\'|\")
- metavariable-regex:
metavariable: $VALUE
regex: (\'|\")\s*(\*)\s*(\'|\")
message: Access-Control-Allow-Origin response header is set to "*". This will disable
CORS Same Origin Policy restrictions.
metadata:
references:
- https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe:
- 'CWE-346: Origin Validation Error'
category: security
technology:
- symfony
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors
shortlink: https://sg.run/kr92
semgrep.dev:
rule:
r_id: 13972
rv_id: 1263317
rule_id: ZqUOlR
version_id: K3TKkAW
url: https://semgrep.dev/playground/r/K3TKkAW/php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors
origin: community
languages:
- php
severity: WARNING
- id: trailofbits.go.missing-unlock-before-return.missing-unlock-before-return
message: Missing mutex unlock (`$T` variable) before returning from a function. This
could result in panics resulting from double lock operations
languages:
- go
severity: ERROR
metadata:
category: security
cwe: 'CWE-667: Improper Locking'
subcategory:
- vuln
confidence: MEDIUM
likelihood: HIGH
impact: MEDIUM
technology:
- --no-technology--
description: Missing `mutex` unlock before returning from a function
references:
- https://pkg.go.dev/sync#Mutex
- https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/
license: AGPL-3.0 license
vulnerability_class:
- Other
source: https://semgrep.dev/r/trailofbits.go.missing-unlock-before-return.missing-unlock-before-return
shortlink: https://sg.run/18Bk
semgrep.dev:
rule:
r_id: 14222
rv_id: 937959
rule_id: L1U5Gz
version_id: O9TXj4X
url: https://semgrep.dev/playground/r/O9TXj4X/trailofbits.go.missing-unlock-before-return.missing-unlock-before-return
origin: community
patterns:
- pattern-either:
- pattern: panic(...)
- pattern: return ...
- metavariable-pattern:
metavariable: $T
patterns:
- pattern: |
($T : sync.Mutex)
- pattern-inside: |
$T.Lock()
...
- pattern-not-inside: |
$T.Unlock()
...
- pattern-not-inside: |
defer $T.Unlock()
...
- pattern-not-inside: |
defer func(...) {
...
$T.Unlock()
...
}(...)
...
- pattern-not-inside: "$FOO(..., ..., func(...) { \n ... \n})\n"
- pattern-not-inside: |
return func(...) {
...
$T.Unlock()
...
}
- id: trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex
message: Missing `RUnlock` on an `RWMutex` (`$T` variable) lock before returning
from a function
languages:
- go
severity: ERROR
metadata:
category: security
cwe: 'CWE-667: Improper Locking'
subcategory:
- vuln
confidence: MEDIUM
likelihood: HIGH
impact: MEDIUM
technology:
- --no-technology--
description: Missing `RUnlock` on an `RWMutex` lock before returning from a function
references:
- https://pkg.go.dev/sync#RWMutex
- https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/
license: AGPL-3.0 license
vulnerability_class:
- Other
source: https://semgrep.dev/r/trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex
shortlink: https://sg.run/9r40
semgrep.dev:
rule:
r_id: 14223
rv_id: 937958
rule_id: 8GUzNK
version_id: xyTqL9d
url: https://semgrep.dev/playground/r/xyTqL9d/trailofbits.go.missing-runlock-on-rwmutex.missing-runlock-on-rwmutex
origin: community
patterns:
- pattern-either:
- pattern: panic(...)
- pattern: return ...
- metavariable-pattern:
metavariable: $T
patterns:
- pattern: |
($T : sync.RWMutex)
- pattern-inside: |
$T.RLock()
...
- pattern-not-inside: |
$T.RUnlock()
...
- pattern-not-inside: |
defer $T.RUnlock()
...
- pattern-not-inside: |
defer func(...) {
...
$T.RUnlock()
...
}(...)
...
- pattern-not-inside: "$FOO(..., ..., func(...) { \n ... \n})\n"
- pattern-not-inside: |
return func(...) {
...
$T.RUnlock()
...
}
- id: python.django.security.injection.raw-html-format.raw-html-format
languages:
- python
severity: WARNING
message: Detected user input flowing into a manually constructed HTML string. You
may be accidentally bypassing secure methods of rendering HTML by manually constructing
HTML and this could create a cross-site scripting vulnerability, which could let
attackers steal sensitive user data. To be sure this is safe, check that the HTML
is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which
will safely render HTML instead.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- django
references:
- https://docs.djangoproject.com/en/3.2/topics/http/shortcuts/#render
- https://docs.djangoproject.com/en/3.2/topics/security/#cross-site-scripting-xss-protection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format
shortlink: https://sg.run/oYj1
semgrep.dev:
rule:
r_id: 14360
rv_id: 1263397
rule_id: 2ZUPER
version_id: 5PTo100
url: https://semgrep.dev/playground/r/5PTo100/python.django.security.injection.raw-html-format.raw-html-format
origin: community
mode: taint
pattern-sanitizers:
- pattern: django.utils.html.escape(...)
pattern-sources:
- patterns:
- pattern: request.$ANYTHING
- pattern-not: request.build_absolute_uri
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: '"$HTMLSTR" % ...'
- pattern: '"$HTMLSTR".format(...)'
- pattern: '"$HTMLSTR" + ...'
- pattern: f"$HTMLSTR{...}..."
- patterns:
- pattern-inside: |
$HTML = "$HTMLSTR"
...
- pattern-either:
- pattern: $HTML % ...
- pattern: $HTML.format(...)
- pattern: $HTML + ...
- metavariable-pattern:
metavariable: $HTMLSTR
language: generic
pattern: <$TAG ...
- id: python.flask.security.injection.raw-html-concat.raw-html-format
languages:
- python
severity: WARNING
message: Detected user input flowing into a manually constructed HTML string. You
may be accidentally bypassing secure methods of rendering HTML by manually constructing
HTML and this could create a cross-site scripting vulnerability, which could let
attackers steal sensitive user data. To be sure this is safe, check that the HTML
is rendered safely. Otherwise, use templates (`flask.render_template`) which will
safely render HTML instead.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- flask
references:
- https://flask.palletsprojects.com/en/2.0.x/security/#cross-site-scripting-xss
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.flask.security.injection.raw-html-concat.raw-html-format
shortlink: https://sg.run/Pb7e
semgrep.dev:
rule:
r_id: 14389
rv_id: 1409401
rule_id: GdUrJv
version_id: RGTEN1l
url: https://semgrep.dev/playground/r/RGTEN1l/python.flask.security.injection.raw-html-concat.raw-html-format
origin: community
mode: taint
pattern-sanitizers:
- pattern: jinja2.escape(...)
- pattern: flask.escape(...)
- patterns:
- pattern: flask.render_template($TPL, ...)
- metavariable-regex:
metavariable: $TPL
regex: .*\.html
pattern-sources:
- patterns:
- pattern-either:
- pattern: flask.request.$ANYTHING
- patterns:
- pattern-inside: |
@$APP.route(...)
def $FUNC(..., $ROUTEVAR, ...):
...
- pattern: $ROUTEVAR
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: '"$HTMLSTR" % ...'
- pattern: '"$HTMLSTR".format(...)'
- pattern: '"$HTMLSTR" + ...'
- pattern: f"$HTMLSTR{...}..."
- patterns:
- pattern-inside: |
$HTML = "$HTMLSTR"
...
- pattern-either:
- pattern: $HTML % ...
- pattern: $HTML.format(...)
- pattern: $HTML + ...
- metavariable-pattern:
metavariable: $HTMLSTR
language: generic
pattern: <$TAG ...
- id: go.lang.security.injection.tainted-url-host.tainted-url-host
languages:
- go
message: A request was found to be crafted from user-input `$REQUEST`. This can
lead to Server-Side Request Forgery (SSRF) vulnerabilities, potentially exposing
sensitive data. It is recommend where possible to not allow user-input to craft
the base request, but to be treated as part of the path or query parameter. When
user-input is necessary to craft the request, it is recommended to follow OWASP
best practices to prevent abuse, including using an allowlist.
options:
interfile: true
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://goteleport.com/blog/ssrf-attacks/
category: security
technology:
- go
confidence: HIGH
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host
shortlink: https://sg.run/5DjW
semgrep.dev:
rule:
r_id: 14391
rv_id: 1262970
rule_id: AbUQLr
version_id: yeTxpOj
url: https://semgrep.dev/playground/r/yeTxpOj/go.lang.security.injection.tainted-url-host.tainted-url-host
origin: community
mode: taint
pattern-sources:
- label: INPUT
patterns:
- pattern-either:
- pattern: |
($REQUEST : *http.Request).$ANYTHING
- pattern: |
($REQUEST : http.Request).$ANYTHING
- metavariable-regex:
metavariable: $ANYTHING
regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
- label: CLEAN
requires: INPUT
patterns:
- pattern-either:
- pattern: |
"$URLSTR" + $INPUT
- patterns:
- pattern-either:
- pattern: fmt.Fprintf($F, "$URLSTR", $INPUT, ...)
- pattern: fmt.Sprintf("$URLSTR", $INPUT, ...)
- pattern: fmt.Printf("$URLSTR", $INPUT, ...)
- metavariable-regex:
metavariable: $URLSTR
regex: .*//[a-zA-Z0-10]+\..*
pattern-sinks:
- requires: INPUT and not CLEAN
patterns:
- pattern-either:
- patterns:
- pattern-either:
- patterns:
- pattern-inside: |
$CLIENT := &http.Client{...}
...
- pattern: $CLIENT.$METHOD($URL, ...)
- pattern: http.$METHOD($URL, ...)
- metavariable-regex:
metavariable: $METHOD
regex: ^(Get|Head|Post|PostForm)$
- patterns:
- pattern: |
http.NewRequest("$METHOD", $URL, ...)
- metavariable-regex:
metavariable: $METHOD
regex: ^(GET|HEAD|POST|POSTFORM)$
- focus-metavariable: $URL
severity: WARNING
- id: javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport
message: If user input reaches `HoverProvider` while `supportHml` is set to `true`
it may introduce an XSS vulnerability. Do not produce HTML for hovers with dynamically
generated input.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://github.com/microsoft/monaco-editor/issues/801
category: security
technology:
- monaco
- monaco-editor
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport
shortlink: https://sg.run/Jx7R
semgrep.dev:
rule:
r_id: 14402
rv_id: 1263221
rule_id: zdUYQb
version_id: o5TbDWj
url: https://semgrep.dev/playground/r/o5TbDWj/javascript.monaco-editor.security.audit.monaco-hover-htmlsupport.monaco-hover-htmlsupport
origin: community
languages:
- typescript
- javascript
severity: WARNING
patterns:
- pattern-either:
- pattern-inside: |
import "monaco-editor"
...
- pattern-inside: |
require("monaco-editor")
...
- pattern-either:
- pattern: |
{value: $VAL, supportHtml: true}
- pattern: |
{value: $VAL, isTrusted: true}
- pattern-inside: |
{range: $R, contents: [...]}
- pattern-not: |
{..., value: "...", ...}
- id: go.lang.security.injection.raw-html-format.raw-html-format
languages:
- go
severity: WARNING
message: Detected user input flowing into a manually constructed HTML string. You
may be accidentally bypassing secure methods of rendering HTML by manually constructing
HTML and this could create a cross-site scripting vulnerability, which could let
attackers steal sensitive user data. Use the `html/template` package which will
safely render HTML instead, or inspect that the HTML is rendered safely.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- go
references:
- https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format
shortlink: https://sg.run/3r1G
semgrep.dev:
rule:
r_id: 14443
rv_id: 1262968
rule_id: PeUonQ
version_id: 1QTyp2p
url: https://semgrep.dev/playground/r/1QTyp2p/go.lang.security.injection.raw-html-format.raw-html-format
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
($REQUEST : *http.Request).$ANYTHING
- pattern: |
($REQUEST : http.Request).$ANYTHING
- metavariable-regex:
metavariable: $ANYTHING
regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
pattern-sanitizers:
- pattern: html.EscapeString(...)
pattern-sinks:
- patterns:
- pattern-either:
- pattern: fmt.Printf("$HTMLSTR", ...)
- pattern: fmt.Sprintf("$HTMLSTR", ...)
- pattern: fmt.Fprintf($W, "$HTMLSTR", ...)
- pattern: '"$HTMLSTR" + ...'
- metavariable-pattern:
metavariable: $HTMLSTR
language: generic
pattern: <$TAG ...
- id: ruby.rails.security.injection.raw-html-format.raw-html-format
languages:
- ruby
severity: WARNING
message: Detected user input flowing into a manually constructed HTML string. You
may be accidentally bypassing secure methods of rendering HTML by manually constructing
HTML and this could create a cross-site scripting vulnerability, which could let
attackers steal sensitive user data. Use the `render template` and make template
files which will safely render HTML instead, or inspect that the HTML is absolutely
rendered safely with a function like `sanitize`.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- rails
references:
- https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/
- https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/ruby.rails.security.injection.raw-html-format.raw-html-format
shortlink: https://sg.run/b2JQ
semgrep.dev:
rule:
r_id: 14470
rv_id: 1409408
rule_id: kxUwZX
version_id: qkTvgYY
url: https://semgrep.dev/playground/r/qkTvgYY/ruby.rails.security.injection.raw-html-format.raw-html-format
origin: community
mode: taint
pattern-sanitizers:
- pattern-either:
- pattern: sanitize(...)
- pattern: strip_tags(...)
pattern-sources:
- patterns:
- pattern-either:
- pattern: params
- pattern: request
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: |
$HTMLSTR
- pattern-regex: <\w+.*
- patterns:
- pattern-either:
- pattern: Kernel::sprintf("$HTMLSTR", ...)
- pattern: |
"$HTMLSTR" + $EXPR
- pattern: |
"$HTMLSTR" % $EXPR
- metavariable-pattern:
metavariable: $HTMLSTR
language: generic
pattern: <$TAG ...
- id: bash.curl.security.curl-eval.curl-eval
severity: WARNING
languages:
- bash
message: Data is being eval'd from a `curl` command. An attacker with control of
the server in the `curl` command could inject malicious code into the `eval`,
resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If
you must do this, consider checking the SHA sum of the content returned by the
server to verify its integrity.
metadata:
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
category: security
technology:
- bash
- curl
confidence: MEDIUM
references:
- https://owasp.org/Top10/A03_2021-Injection
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/bash.curl.security.curl-eval.curl-eval
shortlink: https://sg.run/0yqJ
semgrep.dev:
rule:
r_id: 14554
rv_id: 1262601
rule_id: KxU7Rq
version_id: JdTzxL2
url: https://semgrep.dev/playground/r/JdTzxL2/bash.curl.security.curl-eval.curl-eval
origin: community
mode: taint
pattern-sources:
- pattern: |
$(curl ...)
- pattern: |
`curl ...`
pattern-sinks:
- pattern: eval ...
- id: bash.curl.security.curl-pipe-bash.curl-pipe-bash
languages:
- bash
severity: WARNING
message: Data is being piped into `bash` from a `curl` command. An attacker with
control of the server in the `curl` command could inject malicious code into the
pipe, resulting in a system compromise. Avoid piping untrusted data into `bash`
or any other shell if you can. If you must do this, consider checking the SHA
sum of the content returned by the server to verify its integrity.
metadata:
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
category: security
technology:
- bash
- curl
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/bash.curl.security.curl-pipe-bash.curl-pipe-bash
shortlink: https://sg.run/KXz6
semgrep.dev:
rule:
r_id: 14555
rv_id: 1262602
rule_id: qNUXrw
version_id: 5PTo1Lx
url: https://semgrep.dev/playground/r/5PTo1Lx/bash.curl.security.curl-pipe-bash.curl-pipe-bash
origin: community
patterns:
- pattern-either:
- pattern: curl ... | ... bash ...
- pattern: curl ... | ... /bin/bash ...
- pattern: '... bash <(curl ...)'
- pattern: '... /bin/bash <(curl ...)'
- pattern: '... bash -c "$(curl ...)"'
- pattern: '... /bin/bash -c "$(curl ...)"'
- id: python.flask.security.injection.tainted-url-host.tainted-url-host
languages:
- python
message: User data flows into the host portion of this manually-constructed URL.
This could allow an attacker to send data to their own server, potentially exposing
sensitive data such as cookies or authorization information sent with this request.
They could also probe internal servers or other resources that the server running
this code can access. (This is called server-side request forgery, or SSRF.) Do
not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or
hardcode the correct host.
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
category: security
technology:
- flask
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host
shortlink: https://sg.run/RXpK
semgrep.dev:
rule:
r_id: 14649
rv_id: 1409403
rule_id: ReU3Wb
version_id: BjTy42w
url: https://semgrep.dev/playground/r/BjTy42w/python.flask.security.injection.tainted-url-host.tainted-url-host
origin: community
mode: taint
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: '"$URLSTR" % ...'
- metavariable-pattern:
metavariable: $URLSTR
language: generic
patterns:
- pattern-either:
- pattern: $SCHEME://%s
- pattern: $SCHEME://%r
- patterns:
- pattern: '"$URLSTR".format(...)'
- metavariable-pattern:
metavariable: $URLSTR
language: generic
pattern: $SCHEME:// { ... }
- patterns:
- pattern: '"$URLSTR" + ...'
- metavariable-regex:
metavariable: $URLSTR
regex: .*://$
- patterns:
- pattern: f"$URLSTR{...}..."
- metavariable-regex:
metavariable: $URLSTR
regex: .*://$
- patterns:
- pattern-inside: |
$URL = "$URLSTR"
...
- pattern: $URL += ...
- metavariable-regex:
metavariable: $URLSTR
regex: .*://$
pattern-sources:
- patterns:
- pattern-either:
- pattern: flask.request.$ANYTHING
- patterns:
- pattern-inside: |
@$APP.route(...)
def $FUNC(..., $ROUTEVAR, ...):
...
- pattern: $ROUTEVAR
severity: WARNING
- id: go.lang.security.audit.md5-used-as-password.md5-used-as-password
languages:
- go
severity: WARNING
message: It looks like MD5 is used as a password hash. MD5 is not considered a secure
password hash because it can be cracked by an attacker in a short amount of time.
Use a suitable password hashing function such as bcrypt. You can use the `golang.org/x/crypto/bcrypt`
package.
options:
interfile: true
metadata:
category: security
technology:
- md5
references:
- https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html
- https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords
- https://github.com/returntocorp/semgrep-rules/issues/1609
- https://pkg.go.dev/golang.org/x/crypto/bcrypt
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
confidence: MEDIUM
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/go.lang.security.audit.md5-used-as-password.md5-used-as-password
shortlink: https://sg.run/4eOE
semgrep.dev:
rule:
r_id: 14688
rv_id: 1262938
rule_id: 4bU1Wj
version_id: nWT2L9r
url: https://semgrep.dev/playground/r/nWT2L9r/go.lang.security.audit.md5-used-as-password.md5-used-as-password
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: md5.New
- pattern: md5.Sum
pattern-sinks:
- patterns:
- pattern: $FUNCTION(...)
- metavariable-regex:
metavariable: $FUNCTION
regex: (?i)(.*password.*)
- id: go.lang.security.injection.tainted-sql-string.tainted-sql-string
languages:
- go
message: User data flows into this manually-constructed SQL string. User data can
be safely inserted into SQL strings using prepared statements or an object-relational
mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL
injection, which could let an attacker steal or manipulate data from the database.
Instead, use prepared statements (`db.Query("SELECT * FROM t WHERE id = ?", id)`)
or a safe library.
options:
interfile: true
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://golang.org/doc/database/sql-injection
- https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/
category: security
technology:
- go
confidence: HIGH
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string
shortlink: https://sg.run/PbEq
semgrep.dev:
rule:
r_id: 14689
rv_id: 1409388
rule_id: PeUoqy
version_id: nWTQ5qD
url: https://semgrep.dev/playground/r/nWTQ5qD/go.lang.security.injection.tainted-sql-string.tainted-sql-string
origin: community
mode: taint
severity: ERROR
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
($REQUEST : *http.Request).$ANYTHING
- pattern: |
($REQUEST : http.Request).$ANYTHING
- metavariable-regex:
metavariable: $ANYTHING
regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: |
"$SQLSTR" + ...
- patterns:
- pattern-inside: |
$VAR = "$SQLSTR";
...
- pattern: $VAR += ...
- patterns:
- pattern-inside: |
var $SB strings.Builder
...
- pattern-inside: |
$SB.WriteString("$SQLSTR")
...
$SB.String(...)
- pattern: |
$SB.WriteString(...)
- metavariable-regex:
metavariable: $SQLSTR
regex: (?i)(select|delete|insert|create|update|alter|drop).*
- patterns:
- pattern-either:
- pattern: fmt.Fprintf($F, "$SQLSTR", ...)
- pattern: fmt.Sprintf("$SQLSTR", ...)
- pattern: fmt.Printf("$SQLSTR", ...)
- metavariable-regex:
metavariable: $SQLSTR
regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).*
pattern-sanitizers:
- pattern-either:
- pattern: strconv.Atoi(...)
- pattern: |
($X: bool)
- id: java.lang.security.audit.md5-used-as-password.md5-used-as-password
languages:
- java
severity: WARNING
message: It looks like MD5 is used as a password hash. MD5 is not considered a secure
password hash because it can be cracked by an attacker in a short amount of time.
Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use
`javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1")`
or, if using Spring, `org.springframework.security.crypto.bcrypt`.
metadata:
category: security
technology:
- java
- md5
references:
- https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html
- https://github.com/returntocorp/semgrep-rules/issues/1609
- https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory
- https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.html
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.md5-used-as-password.md5-used-as-password
shortlink: https://sg.run/JxEQ
semgrep.dev:
rule:
r_id: 14690
rv_id: 1263029
rule_id: JDULAW
version_id: bZT53QB
url: https://semgrep.dev/playground/r/bZT53QB/java.lang.security.audit.md5-used-as-password.md5-used-as-password
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern-inside: |
$TYPE $MD = MessageDigest.getInstance("MD5");
...
- pattern: $MD.digest(...);
pattern-sinks:
- patterns:
- pattern: $MODEL.$METHOD(...);
- metavariable-regex:
metavariable: $METHOD
regex: (?i)(.*password.*)
- id: javascript.express.security.injection.raw-html-format.raw-html-format
message: User data flows into the host portion of this manually-constructed HTML.
This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from
user-provided input. Consider using a sanitization library such as DOMPurify to
sanitize the HTML within.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
category: security
technology:
- express
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format
shortlink: https://sg.run/5DO3
semgrep.dev:
rule:
r_id: 14691
rv_id: 1263175
rule_id: 5rUL0X
version_id: NdTzyQv
url: https://semgrep.dev/playground/r/NdTzyQv/javascript.express.security.injection.raw-html-format.raw-html-format
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- label: EXPRESS
patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- label: EXPRESSTS
patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
- label: CLEAN
by-side-effect: true
patterns:
- pattern-either:
- pattern: $A($SOURCE)
- pattern: $SANITIZE. ... .$A($SOURCE)
- pattern: $A. ... .$SANITIZE($SOURCE)
- focus-metavariable: $SOURCE
- metavariable-regex:
metavariable: $A
regex: (?i)(.*valid|.*sanitiz)
pattern-sinks:
- requires: (EXPRESS and not CLEAN) or (EXPRESSTS and not CLEAN)
patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: '"$HTMLSTR" + $EXPR'
- pattern: '"$HTMLSTR".concat(...)'
- pattern: util.format($HTMLSTR, ...)
- metavariable-pattern:
metavariable: $HTMLSTR
language: generic
pattern: <$TAG ...
- patterns:
- pattern: |
`...`
- pattern-regex: |
.*<\w+.*
- id: javascript.lang.security.audit.md5-used-as-password.md5-used-as-password
message: It looks like MD5 is used as a password hash. MD5 is not considered a secure
password hash because it can be cracked by an attacker in a short amount of time.
Use a suitable password hashing function such as bcrypt. You can use the `bcrypt`
node.js package.
metadata:
category: security
technology:
- crypto
- md5
references:
- https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html
- https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords
- https://github.com/returntocorp/semgrep-rules/issues/1609
- https://www.npmjs.com/package/bcrypt
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/javascript.lang.security.audit.md5-used-as-password.md5-used-as-password
shortlink: https://sg.run/GOEn
semgrep.dev:
rule:
r_id: 14692
rv_id: 1263200
rule_id: GdUr5G
version_id: DkTRb3p
url: https://semgrep.dev/playground/r/DkTRb3p/javascript.lang.security.audit.md5-used-as-password.md5-used-as-password
origin: community
languages:
- javascript
severity: WARNING
mode: taint
pattern-sources:
- pattern: $CRYPTO.createHash("md5")
pattern-sinks:
- patterns:
- pattern: $FUNCTION(...);
- metavariable-regex:
metavariable: $FUNCTION
regex: (?i)(.*password.*)
- id: kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#DEFAULT_HTTP_CLIENT
asvs:
section: V9 Communications Verification Requirements
control_id: 9.1.3 Weak TLS
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v91-client-communications-security-requirements
version: '4'
category: security
technology:
- kotlin
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated
shortlink: https://sg.run/RXEK
semgrep.dev:
rule:
r_id: 14693
rv_id: 1263262
rule_id: ReU3Yb
version_id: l4TJRYY
url: https://semgrep.dev/playground/r/l4TJRYY/kotlin.lang.security.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated
origin: community
message: DefaultHttpClient is deprecated. Further, it does not support connections
using TLS1.2, which makes using DefaultHttpClient a security hazard. Use SystemDefaultHttpClient
instead, which supports TLS1.2.
severity: WARNING
languages:
- kt
pattern: DefaultHttpClient(...)
fix-regex:
regex: DefaultHttpClient
replacement: SystemDefaultHttpClient
- id: kotlin.lang.security.ecb-cipher.ecb-cipher
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#ECB_MODE
category: security
technology:
- kotlin
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/kotlin.lang.security.ecb-cipher.ecb-cipher
shortlink: https://sg.run/DzLj
semgrep.dev:
rule:
r_id: 14696
rv_id: 1263263
rule_id: DbU1Zd
version_id: YDTZexg
url: https://semgrep.dev/playground/r/YDTZexg/kotlin.lang.security.ecb-cipher.ecb-cipher
origin: community
message: Cipher in ECB mode is detected. ECB mode produces the same output for the
same input each time which allows an attacker to intercept and replay the data.
Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY.
severity: WARNING
languages:
- kt
patterns:
- pattern-either:
- pattern: |
val $VAR : Cipher = $CIPHER.getInstance($MODE)
- pattern: |
var $VAR : Cipher = $CIPHER.getInstance($MODE)
- pattern: |
val $VAR = $CIPHER.getInstance($MODE)
- pattern: |
var $VAR = $CIPHER.getInstance($MODE)
- metavariable-regex:
metavariable: $MODE
regex: .*ECB.*
- id: kotlin.lang.security.gcm-detection.gcm-detection
metadata:
category: security
cwe:
- 'CWE-323: Reusing a Nonce, Key Pair in Encryption'
references:
- https://cwe.mitre.org/data/definitions/323.html
technology:
- kotlin
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/kotlin.lang.security.gcm-detection.gcm-detection
shortlink: https://sg.run/WpPA
semgrep.dev:
rule:
r_id: 14697
rv_id: 1263264
rule_id: WAUyAW
version_id: 6xT29k7
url: https://semgrep.dev/playground/r/6xT29k7/kotlin.lang.security.gcm-detection.gcm-detection
origin: community
languages:
- kt
message: GCM detected, please check that IV/nonce is not reused, an Initialization
Vector (IV) is a nonce used to randomize the encryption, so that even if multiple
messages with identical plaintext are encrypted, the generated corresponding ciphertexts
are different.Unlike the Key, the IV usually does not need to be secret, rather
it is important that it is random and unique. Certain encryption schemes the IV
is exchanged in public as part of the ciphertext. Reusing same Initialization
Vector with the same Key to encrypt multiple plaintext blocks allows an attacker
to compare the ciphertexts and then, with some assumptions on the content of the
messages, to gain important information about the data being encrypted.
patterns:
- pattern-either:
- pattern: $METHOD.getInstance("AES/GCM/NoPadding",...)
- pattern: GCMParameterSpec(...)
severity: INFO
- id: kotlin.lang.security.no-null-cipher.no-null-cipher
pattern: NullCipher(...)
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#NULL_CIPHER
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.5 Insecure Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
category: security
technology:
- kotlin
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/kotlin.lang.security.no-null-cipher.no-null-cipher
shortlink: https://sg.run/0ywb
semgrep.dev:
rule:
r_id: 14698
rv_id: 1263265
rule_id: 0oU2Yy
version_id: o5TbDPj
url: https://semgrep.dev/playground/r/o5TbDPj/kotlin.lang.security.no-null-cipher.no-null-cipher
origin: community
message: 'NullCipher was detected. This will not encrypt anything; the cipher text
will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING").
See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for
more information.'
severity: WARNING
languages:
- kt
- scala
- id: kotlin.lang.security.unencrypted-socket.unencrypted-socket
metadata:
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNENCRYPTED_SOCKET
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.5 Insecure Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
category: security
technology:
- kotlin
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/kotlin.lang.security.unencrypted-socket.unencrypted-socket
shortlink: https://sg.run/KXZd
semgrep.dev:
rule:
r_id: 14699
rv_id: 1413421
rule_id: KxU76z
version_id: w8TWBzA
url: https://semgrep.dev/playground/r/w8TWBzA/kotlin.lang.security.unencrypted-socket.unencrypted-socket
origin: community
message: This socket is not encrypted. The traffic could be read by an attacker
intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory'
or 'SSLServerSocketFactory' instead
severity: WARNING
languages:
- kt
patterns:
- pattern-either:
- pattern: ServerSocket(...)
- pattern: Socket(...)
- pattern-not-inside: |
fun $FN(...): Int {
...
val $SS = ServerSocket(0)
...
$SS.close()
...
}
- pattern-not-inside: |
fun $FN(...): Int {
...
val $SS = ServerSocket(0)
...
$SS.localPort
...
$SS.close()
...
}
- id: kotlin.lang.security.use-of-md5.use-of-md5
message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision
resistant and is therefore not suitable as a cryptographic signature. Use SHA256
or SHA3 instead.
languages:
- kt
severity: WARNING
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-328: Use of Weak Hash'
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_MD5
category: security
technology:
- kotlin
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/kotlin.lang.security.use-of-md5.use-of-md5
shortlink: https://sg.run/4eQx
semgrep.dev:
rule:
r_id: 14700
rv_id: 1263267
rule_id: qNUXPj
version_id: pZT03Jd
url: https://semgrep.dev/playground/r/pZT03Jd/kotlin.lang.security.use-of-md5.use-of-md5
origin: community
pattern-either:
- pattern: |
java.security.MessageDigest.getInstance("MD5")
- pattern: |
org.apache.commons.codec.digest.DigestUtils.getMd5Digest()
- id: python.django.security.injection.tainted-sql-string.tainted-sql-string
message: Detected user input used to manually construct a SQL string. This is usually
bad practice because manual construction could accidentally result in a SQL injection.
An attacker could use a SQL injection to steal or modify contents of the database.
Instead, use a parameterized query which is available by default in most database
engines. Alternatively, consider using the Django object-relational mappers (ORM)
instead of raw SQL queries.
metadata:
cwe:
- 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object
Attributes'
owasp:
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
references:
- https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection
category: security
technology:
- django
subcategory:
- audit
impact: LOW
likelihood: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mass Assignment
source: https://semgrep.dev/r/python.django.security.injection.tainted-sql-string.tainted-sql-string
shortlink: https://sg.run/PbZp
semgrep.dev:
rule:
r_id: 14701
rv_id: 1263408
rule_id: lBU8Ad
version_id: YDTZeje
url: https://semgrep.dev/playground/r/YDTZeje/python.django.security.injection.tainted-sql-string.tainted-sql-string
origin: community
severity: ERROR
languages:
- python
mode: taint
pattern-sources:
- patterns:
- pattern: request.$ANYTHING
- pattern-not: request.build_absolute_uri
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
"$SQLSTR" + ...
- pattern: |
"$SQLSTR" % ...
- pattern: |
"$SQLSTR".format(...)
- pattern: |
f"$SQLSTR{...}..."
- metavariable-regex:
metavariable: $SQLSTR
regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*
- id: python.flask.security.injection.tainted-sql-string.tainted-sql-string
message: Detected user input used to manually construct a SQL string. This is usually
bad practice because manual construction could accidentally result in a SQL injection.
An attacker could use a SQL injection to steal or modify contents of the database.
Instead, use a parameterized query which is available by default in most database
engines. Alternatively, consider using an object-relational mapper (ORM) such
as SQLAlchemy which will protect your queries.
metadata:
cwe:
- 'CWE-704: Incorrect Type Conversion or Cast'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql
- https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm
- https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column
category: security
technology:
- sqlalchemy
- flask
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string
shortlink: https://sg.run/JxZj
semgrep.dev:
rule:
r_id: 14702
rv_id: 1409402
rule_id: YGUDKQ
version_id: A8TEvb4
url: https://semgrep.dev/playground/r/A8TEvb4/python.flask.security.injection.tainted-sql-string.tainted-sql-string
origin: community
severity: ERROR
languages:
- python
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: flask.request.$ANYTHING
- patterns:
- pattern-inside: |
@$APP.route(...)
def $FUNC(..., $ROUTEVAR, ...):
...
- pattern: $ROUTEVAR
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
"$SQLSTR" + ...
- pattern: |
"$SQLSTR" % ...
- pattern: |
"$SQLSTR".format(...)
- pattern: |
f"$SQLSTR{...}..."
- metavariable-regex:
metavariable: $SQLSTR
regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*
- id: python.lang.security.audit.md5-used-as-password.md5-used-as-password
severity: WARNING
message: It looks like MD5 is used as a password hash. MD5 is not considered a secure
password hash because it can be cracked by an attacker in a short amount of time.
Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`.
languages:
- python
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://tools.ietf.org/html/rfc6151
- https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision
- https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
- https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords
- https://github.com/returntocorp/semgrep-rules/issues/1609
- https://docs.python.org/3/library/hashlib.html#hashlib.scrypt
category: security
technology:
- pycryptodome
- hashlib
- md5
subcategory:
- vuln
likelihood: HIGH
impact: LOW
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.lang.security.audit.md5-used-as-password.md5-used-as-password
shortlink: https://sg.run/5DwD
semgrep.dev:
rule:
r_id: 14703
rv_id: 1263504
rule_id: 6JU1w1
version_id: WrTqKDz
url: https://semgrep.dev/playground/r/WrTqKDz/python.lang.security.audit.md5-used-as-password.md5-used-as-password
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: hashlib.md5
- pattern: hashlib.new(..., name="MD5", ...)
- pattern: Cryptodome.Hash.MD5
- pattern: Crypto.Hash.MD5
- pattern: cryptography.hazmat.primitives.hashes.MD5
pattern-sinks:
- patterns:
- pattern: $FUNCTION(...)
- metavariable-regex:
metavariable: $FUNCTION
regex: (?i)(.*password.*)
- id: ruby.lang.security.md5-used-as-password.md5-used-as-password
languages:
- ruby
severity: WARNING
message: It looks like MD5 is used as a password hash. MD5 is not considered a secure
password hash because it can be cracked by an attacker in a short amount of time.
Instead, use a suitable password hashing function such as bcrypt. You can use
the `bcrypt` gem.
metadata:
category: security
technology:
- md5
references:
- https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html
- https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords
- https://github.com/returntocorp/semgrep-rules/issues/1609
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/ruby.lang.security.md5-used-as-password.md5-used-as-password
shortlink: https://sg.run/GOZy
semgrep.dev:
rule:
r_id: 14704
rv_id: 1263611
rule_id: oqU4p2
version_id: JdTzx0e
url: https://semgrep.dev/playground/r/JdTzx0e/ruby.lang.security.md5-used-as-password.md5-used-as-password
origin: community
mode: taint
pattern-sources:
- pattern: Digest::MD5
pattern-sinks:
- patterns:
- pattern: $FUNCTION(...);
- metavariable-regex:
metavariable: $FUNCTION
regex: (?i)(.*password.*)
- id: ruby.rails.security.injection.tainted-url-host.tainted-url-host
languages:
- ruby
severity: WARNING
message: User data flows into the host portion of this manually-constructed URL.
This could allow an attacker to send data to their own server, potentially exposing
sensitive data such as cookies or authorization information sent with this request.
They could also probe internal servers or other resources that the server running
this code can access. (This is called server-side request forgery, or SSRF.) Do
not allow arbitrary hosts. Use the `ssrf_filter` gem and guard the url construction
with `SsrfFilter(...)`, or create an allowlist for approved hosts.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- rails
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
- https://github.com/arkadiyt/ssrf_filter
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/ruby.rails.security.injection.tainted-url-host.tainted-url-host
shortlink: https://sg.run/RX3g
semgrep.dev:
rule:
r_id: 14705
rv_id: 1263668
rule_id: zdUY0W
version_id: 6xT29BN
url: https://semgrep.dev/playground/r/6xT29BN/ruby.rails.security.injection.tainted-url-host.tainted-url-host
origin: community
mode: taint
pattern-sanitizers:
- pattern: SsrfFilter
pattern-sources:
- patterns:
- pattern-either:
- pattern: params
- pattern: request
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: |
$URLSTR
- pattern-regex: \w+:\/\/#{.*}
- patterns:
- pattern-either:
- pattern: Kernel::sprintf("$URLSTR", ...)
- pattern: |
"$URLSTR" + $EXPR
- pattern: |
"$URLSTR" % $EXPR
- metavariable-pattern:
metavariable: $URLSTR
language: generic
pattern: $SCHEME:// ...
- id: ruby.rails.security.injection.tainted-sql-string.tainted-sql-string
languages:
- ruby
severity: ERROR
message: Detected user input used to manually construct a SQL string. This is usually
bad practice because manual construction could accidentally result in a SQL injection.
An attacker could use a SQL injection to steal or modify contents of the database.
Instead, use a parameterized query which is available by default in most database
engines. Alternatively, consider using an object-relational mapper (ORM) such
as ActiveRecord which will protect your queries.
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- rails
references:
- https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/ruby.rails.security.injection.tainted-sql-string.tainted-sql-string
shortlink: https://sg.run/Y85o
semgrep.dev:
rule:
r_id: 14714
rv_id: 1263667
rule_id: bwU8gl
version_id: YDTZeLL
url: https://semgrep.dev/playground/r/YDTZeLL/ruby.rails.security.injection.tainted-sql-string.tainted-sql-string
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: params
- pattern: request
pattern-sanitizers:
- pattern: |
$PARAMS.slice(...)
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- patterns:
- pattern: |
$RECORD.where($X,...)
- pattern: |
$RECORD.find(..., :conditions => $X,...)
- focus-metavariable: $X
- patterns:
- pattern: |
"$SQLVERB#{$EXPR}..."
- pattern-not-inside: |
$FUNC("...", "...#{$EXPR}...",...)
- focus-metavariable: $SQLVERB
- pattern-regex: (?i)(select|delete|insert|create|update|alter|drop)\b
- patterns:
- pattern-either:
- pattern: Kernel::sprintf("$SQLSTR", $EXPR)
- pattern: |
"$SQLSTR" + $EXPR
- pattern: |
"$SQLSTR" % $EXPR
- pattern-not-inside: |
$FUNC("...", "...#{$EXPR}...",...)
- focus-metavariable: $EXPR
- metavariable-regex:
metavariable: $SQLSTR
regex: (?i)(select|delete|insert|create|update|alter|drop)\b
- id: generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key
pattern-regex: k2sk_v[0-9]_[0-9a-zA-Z]{24}
languages:
- regex
message: Kolide API Key detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
category: security
technology:
- secrets
- kolide
confidence: LOW
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key
shortlink: https://sg.run/d2YQ
semgrep.dev:
rule:
r_id: 14734
rv_id: 1262880
rule_id: JDULYW
version_id: ZRTKApA
url: https://semgrep.dev/playground/r/ZRTKApA/generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key
origin: community
- id: php.lang.security.injection.tainted-sql-string.tainted-sql-string
languages:
- php
severity: ERROR
message: User data flows into this manually-constructed SQL string. User data can
be safely inserted into SQL strings using prepared statements or an object-relational
mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL
injection, which could let an attacker steal or manipulate data from the database.
Instead, use prepared statements (`$mysqli->prepare("INSERT INTO test(id, label)
VALUES (?, ?)");`) or a safe library.
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/www-community/attacks/SQL_Injection
category: security
technology:
- php
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/php.lang.security.injection.tainted-sql-string.tainted-sql-string
shortlink: https://sg.run/lZYG
semgrep.dev:
rule:
r_id: 14757
rv_id: 1263290
rule_id: qNUXdL
version_id: gETB7vY
url: https://semgrep.dev/playground/r/gETB7vY/php.lang.security.injection.tainted-sql-string.tainted-sql-string
origin: community
mode: taint
pattern-sanitizers:
- pattern-either:
- pattern: mysqli_real_escape_string(...)
- pattern: real_escape_string(...)
- pattern: $MYSQLI->real_escape_string(...)
pattern-sources:
- patterns:
- pattern-either:
- pattern: $_GET
- pattern: $_POST
- pattern: $_COOKIE
- pattern: $_REQUEST
pattern-sinks:
- pattern-either:
- patterns:
- pattern: |
sprintf($SQLSTR, ...)
- metavariable-regex:
metavariable: $SQLSTR
regex: (?is).*\b(select|delete|insert|create|update|alter|drop)\b.*
- patterns:
- pattern: |
"...$EXPR..."
- metavariable-regex:
metavariable: $EXPR
regex: (?is).*\b(select|delete|insert|create|update|alter|drop)\b.*
- patterns:
- pattern: |
"$SQLSTR".$EXPR
- metavariable-regex:
metavariable: $SQLSTR
regex: (?is).*\b(select|delete|insert|create|update|alter|drop)\b.*
- id: php.lang.security.injection.tainted-url-host.tainted-url-host
languages:
- php
severity: WARNING
message: User data flows into the host portion of this manually-constructed URL.
This could allow an attacker to send data to their own server, potentially exposing
sensitive data such as cookies or authorization information sent with this request.
They could also probe internal servers or other resources that the server running
this code can access. (This is called server-side request forgery, or SSRF.) Do
not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or
hardcode the correct host.
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
category: security
technology:
- php
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/php.lang.security.injection.tainted-url-host.tainted-url-host
shortlink: https://sg.run/Y8no
semgrep.dev:
rule:
r_id: 14758
rv_id: 1263291
rule_id: lBU8K1
version_id: QkTGqRd
url: https://semgrep.dev/playground/r/QkTGqRd/php.lang.security.injection.tainted-url-host.tainted-url-host
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: $_GET
- pattern: $_POST
- pattern: $_COOKIE
- pattern: $_REQUEST
pattern-sinks:
- pattern-either:
- patterns:
- pattern: |
sprintf($URLSTR, ...)
- metavariable-pattern:
metavariable: $URLSTR
language: generic
pattern: $SCHEME://%s
- patterns:
- pattern: |
"...{$EXPR}..."
- pattern-regex: |
.*://\{.*
- patterns:
- pattern: |
"...$EXPR..."
- pattern-regex: |
.*://\$.*
- patterns:
- pattern: |
"...".$EXPR
- pattern-regex: |
.*://["'].*
- id: php.lang.security.md5-used-as-password.md5-used-as-password
severity: WARNING
message: It looks like MD5 is used as a password hash. MD5 is not considered a secure
password hash because it can be cracked by an attacker in a short amount of time.
Use a suitable password hashing function such as bcrypt. You can use `password_hash($PASSWORD,
PASSWORD_BCRYPT, $OPTIONS);`.
languages:
- php
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://tools.ietf.org/html/rfc6151
- https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision
- https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords
- https://github.com/returntocorp/semgrep-rules/issues/1609
- https://www.php.net/password_hash
category: security
technology:
- md5
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/php.lang.security.md5-used-as-password.md5-used-as-password
shortlink: https://sg.run/66YL
semgrep.dev:
rule:
r_id: 14759
rv_id: 1263294
rule_id: YGUD1O
version_id: PkTR37j
url: https://semgrep.dev/playground/r/PkTR37j/php.lang.security.md5-used-as-password.md5-used-as-password
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: md5(...)
- pattern: hash('md5', ...)
pattern-sinks:
- patterns:
- pattern: $FUNCTION(...)
- metavariable-regex:
metavariable: $FUNCTION
regex: (?i)(.*password.*)
- id: python.django.security.injection.tainted-url-host.tainted-url-host
languages:
- python
message: User data flows into the host portion of this manually-constructed URL.
This could allow an attacker to send data to their own server, potentially exposing
sensitive data such as cookies or authorization information sent with this request.
They could also probe internal servers or other resources that the server running
this code can access. (This is called server-side request forgery, or SSRF.) Do
not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or
hardcode the correct host.
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
category: security
technology:
- flask
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
impact: MEDIUM
likelihood: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/python.django.security.injection.tainted-url-host.tainted-url-host
shortlink: https://sg.run/oYz6
semgrep.dev:
rule:
r_id: 14760
rv_id: 1263409
rule_id: 6JU1l0
version_id: JdTzxAj
url: https://semgrep.dev/playground/r/JdTzxAj/python.django.security.injection.tainted-url-host.tainted-url-host
origin: community
mode: taint
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: '"$URLSTR" % ...'
- metavariable-pattern:
metavariable: $URLSTR
language: generic
patterns:
- pattern-either:
- pattern: $SCHEME://%s
- pattern: $SCHEME://%r
- patterns:
- pattern: '"$URLSTR".format(...)'
- metavariable-pattern:
metavariable: $URLSTR
language: generic
pattern: $SCHEME:// { ... }
- patterns:
- pattern: '"$URLSTR" + ...'
- metavariable-regex:
metavariable: $URLSTR
regex: .*://$
- patterns:
- pattern: f"$URLSTR{...}..."
- metavariable-regex:
metavariable: $URLSTR
regex: .*://$
- patterns:
- pattern-inside: |
$URL = "$URLSTR"
...
- pattern: $URL += ...
- metavariable-regex:
metavariable: $URLSTR
regex: .*://$
pattern-sources:
- patterns:
- pattern: request.$ANYTHING
- pattern-not: request.build_absolute_uri
severity: WARNING
- id: java.spring.security.injection.tainted-sql-string.tainted-sql-string
languages:
- java
severity: ERROR
message: User data flows into this manually-constructed SQL string. User data can
be safely inserted into SQL strings using prepared statements or an object-relational
mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL
injection, which could let an attacker steal or manipulate data from the database.
Instead, use prepared statements (`connection.PreparedStatement`) or a safe library.
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html
category: security
technology:
- spring
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/java.spring.security.injection.tainted-sql-string.tainted-sql-string
shortlink: https://sg.run/9rzz
semgrep.dev:
rule:
r_id: 14767
rv_id: 1409396
rule_id: 10UdRR
version_id: 44TbKvr
url: https://semgrep.dev/playground/r/44TbKvr/java.spring.security.injection.tainted-sql-string.tainted-sql-string
origin: community
options:
taint_assume_safe_numbers: true
taint_assume_safe_booleans: true
interfile: true
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
$METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {
...
}
- pattern-inside: |
$METHODNAME(..., @$REQ $TYPE $SOURCE,...) {
...
}
- metavariable-regex:
metavariable: $REQ
regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue)
- metavariable-regex:
metavariable: $TYPE
regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean))
- focus-metavariable: $SOURCE
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
"$SQLSTR" + ...
- pattern: |
"$SQLSTR".concat(...)
- patterns:
- pattern-inside: |
StringBuilder $SB = new StringBuilder("$SQLSTR");
...
- pattern: $SB.append(...)
- patterns:
- pattern-inside: |
$VAR = "$SQLSTR";
...
- pattern: $VAR += ...
- pattern: String.format("$SQLSTR", ...)
- patterns:
- pattern-inside: |
String $VAR = "$SQLSTR";
...
- pattern: String.format($VAR, ...)
- pattern-not-inside: System.out.println(...)
- pattern-not-inside: $LOG.info(...)
- pattern-not-inside: $LOG.warn(...)
- pattern-not-inside: $LOG.warning(...)
- pattern-not-inside: $LOG.debug(...)
- pattern-not-inside: $LOG.debugging(...)
- pattern-not-inside: $LOG.error(...)
- pattern-not-inside: new Exception(...)
- pattern-not-inside: throw ...;
- metavariable-regex:
metavariable: $SQLSTR
regex: (?i)(select|delete|insert|create|update|alter|drop)\b
- id: bash.lang.security.ifs-tampering.ifs-tampering
languages:
- bash
severity: WARNING
message: The special variable IFS affects how splitting takes place when expanding
unquoted variables. Don't set it globally. Prefer a dedicated utility such as
'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS
locally using e.g. 'IFS="," read -a my_array'.
pattern: IFS=...
metadata:
cwe:
- 'CWE-20: Improper Input Validation'
category: security
technology:
- bash
confidence: LOW
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/bash.lang.security.ifs-tampering.ifs-tampering
shortlink: https://sg.run/Q9pq
semgrep.dev:
rule:
r_id: 14842
rv_id: 1262603
rule_id: WAUy9q
version_id: GxTkerb
url: https://semgrep.dev/playground/r/GxTkerb/bash.lang.security.ifs-tampering.ifs-tampering
origin: community
- id: generic.unicode.security.bidi.contains-bidirectional-characters
patterns:
- pattern-either:
- pattern-regex: "\u202A"
- pattern-regex: "\u202B"
- pattern-regex: "\u202D"
- pattern-regex: "\u202E"
- pattern-regex: "\u2066"
- pattern-regex: "\u2067"
- pattern-regex: "\u2068"
- pattern-regex: "\u202C"
- pattern-regex: "\u2069"
message: This code contains bidirectional (bidi) characters. While this is useful
for support of right-to-left languages such as Arabic or Hebrew, it can also be
used to trick language parsers into executing code in a manner that is different
from how it is displayed in code editing and review tools. If this is not what
you were expecting, please review this code in an editor that can reveal hidden
Unicode characters.
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
category: security
technology:
- unicode
references:
- https://trojansource.codes/
confidence: LOW
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/generic.unicode.security.bidi.contains-bidirectional-characters
shortlink: https://sg.run/nK4r
semgrep.dev:
rule:
r_id: 14880
rv_id: 1262904
rule_id: d8UeX4
version_id: JdTzxzn
url: https://semgrep.dev/playground/r/JdTzxzn/generic.unicode.security.bidi.contains-bidirectional-characters
origin: community
languages:
- bash
- c
- csharp
- go
- java
- javascript
- json
- kotlin
- lua
- ocaml
- php
- python
- ruby
- rust
- scala
- sh
- typescript
- yaml
severity: WARNING
- id: terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version
patterns:
- pattern-either:
- patterns:
- pattern: ssl_policy = $ANYTHING
- pattern-not-regex: ELBSecurityPolicy-TLS13-1-[23]-[(Res)0-9-]+
- pattern-not-regex: ELBSecurityPolicy-FS-1-2-[(Res)0-9-]+
- patterns:
- pattern: protocol = "HTTP"
- pattern-not-inside: |
resource $ANYTHING $NAME {
...
default_action {
...
redirect {
...
protocol = "HTTPS"
...
}
...
}
...
}
- pattern-inside: |
resource $RESOURCE $X {
...
}
- metavariable-pattern:
metavariable: $RESOURCE
patterns:
- pattern-either:
- pattern: |
"aws_lb_listener"
- pattern: |
"aws_alb_listener"
message: Detected an AWS load balancer with an insecure TLS version. TLS versions
less than 1.2 are considered insecure because they can be broken. To fix this,
set your `ssl_policy` to `"ELBSecurityPolicy-TLS13-1-2-Res-2021-06"`, or include
a default action to redirect to HTTPS.
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-326: Inadequate Encryption Strength'
references:
- https://www.ietf.org/rfc/rfc5246.txt
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version
shortlink: https://sg.run/187G
semgrep.dev:
rule:
r_id: 14966
rv_id: 1263747
rule_id: 2ZUP9K
version_id: ExTEx0y
url: https://semgrep.dev/playground/r/ExTEx0y/terraform.aws.security.insecure-load-balancer-tls-version.insecure-load-balancer-tls-version
origin: community
languages:
- hcl
severity: WARNING
- id: yaml.github-actions.security.curl-eval.curl-eval
languages:
- yaml
message: Data is being eval'd from a `curl` command. An attacker with control of
the server in the `curl` command could inject malicious code into the `eval`,
resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If
you must do this, consider checking the SHA sum of the content returned by the
server to verify its integrity.
metadata:
category: security
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
technology:
- github-actions
- bash
- curl
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/yaml.github-actions.security.curl-eval.curl-eval
shortlink: https://sg.run/9r7r
semgrep.dev:
rule:
r_id: 14967
rv_id: 1263926
rule_id: X5Udrd
version_id: YDTZe7K
url: https://semgrep.dev/playground/r/YDTZe7K/yaml.github-actions.security.curl-eval.curl-eval
origin: community
patterns:
- pattern-inside: 'steps: [...]'
- pattern-inside: |
- run: ...
...
- pattern: 'run: $SHELL'
- metavariable-pattern:
language: bash
metavariable: $SHELL
patterns:
- pattern: |
$DATA=<... curl ...>
...
eval <... $DATA ...>
severity: ERROR
- id: csharp.lang.security.sqli.csharp-sqli.csharp-sqli
mode: taint
pattern-sources:
- patterns:
- pattern: |
(string $X)
- pattern-not: |
"..."
pattern-propagators:
- pattern: (StringBuilder $B).$ANY(...,(string $X),...)
from: $X
to: $B
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: |
new $PATTERN($CMD,...)
- focus-metavariable: $CMD
- patterns:
- pattern: |
$CMD.$PATTERN = $VALUE;
- focus-metavariable: $VALUE
- metavariable-regex:
metavariable: $PATTERN
regex: ^(SqlCommand|CommandText|OleDbCommand|OdbcCommand|OracleCommand)$
pattern-sanitizers:
- pattern-either:
- pattern: |
$CMD.Parameters.Add(...)
- pattern: |
$CMD.Parameters.AddRange(...)
- pattern: |
$CMD.Parameters.AddWithValue(...)
- pattern: |
$CMD.Parameters[$IDX].Value = ...
by-side-effect: true
message: Detected a formatted string in a SQL statement. This could lead to SQL
injection if variables in the SQL statement are not properly sanitized. Use a
prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand'
and 'SqlParameter'.
metadata:
category: security
technology:
- csharp
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
confidence: MEDIUM
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/csharp.lang.security.sqli.csharp-sqli.csharp-sqli
shortlink: https://sg.run/d2Xd
semgrep.dev:
rule:
r_id: 15078
rv_id: 1262648
rule_id: x8UxeP
version_id: RGT0LqW
url: https://semgrep.dev/playground/r/RGT0LqW/csharp.lang.security.sqli.csharp-sqli.csharp-sqli
origin: community
languages:
- csharp
severity: ERROR
- id: scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret
languages:
- scala
message: 'Hardcoded JWT secret or private key is used. This is a Insufficiently
Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html
Consider using an appropriate security mechanism to protect the credentials (e.g.
keeping secrets in environment variables)'
metadata:
category: security
cwe:
- 'CWE-522: Insufficiently Protected Credentials'
owasp:
- A02:2017 - Broken Authentication
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
technology:
- jwt
confidence: HIGH
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
cwe2021-top25: true
subcategory:
- audit
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret
shortlink: https://sg.run/Z40o
semgrep.dev:
rule:
r_id: 15079
rv_id: 1263691
rule_id: OrU6W1
version_id: 7ZTE3kr
url: https://semgrep.dev/playground/r/7ZTE3kr/scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret
origin: community
pattern-either:
- pattern: |
com.auth0.jwt.algorithms.Algorithm.HMAC256("...");
- pattern: |
$SECRET = "...";
...
com.auth0.jwt.algorithms.Algorithm.HMAC256($SECRET);
- pattern: |
class $CLASS {
...
$DECL $SECRET = "...";
...
def $FUNC (...): $RETURNTYPE = {
...
com.auth0.jwt.algorithms.Algorithm.HMAC256($SECRET);
...
}
...
}
- pattern: |
com.auth0.jwt.algorithms.Algorithm.HMAC384("...");
- pattern: |
$SECRET = "...";
...
com.auth0.jwt.algorithms.Algorithm.HMAC384($SECRET);
- pattern: |
class $CLASS {
...
$DECL $SECRET = "...";
...
def $FUNC (...): $RETURNTYPE = {
...
com.auth0.jwt.algorithms.Algorithm.HMAC384($SECRET);
...
}
...
}
- pattern: |
com.auth0.jwt.algorithms.Algorithm.HMAC512("...");
- pattern: |
$SECRET = "...";
...
com.auth0.jwt.algorithms.Algorithm.HMAC512($SECRET);
- pattern: |
class $CLASS {
...
$DECL $SECRET = "...";
...
def $FUNC (...): $RETURNTYPE = {
...
com.auth0.jwt.algorithms.Algorithm.HMAC512($SECRET);
...
}
...
}
severity: ERROR
- id: terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered
message: Registering the identity used by an App with AD allows it to interact with
other services without using username and password. Set the `identity` block in
your appservice.
patterns:
- pattern: resource
- pattern-not-inside: |
resource "azurerm_app_service" "..." {
...
identity {
type = "..."
identity_ids = "..."
}
...
}
- pattern-not-inside: |
resource "azurerm_app_service" "..." {
...
identity {
type = "SystemAssigned"
}
...
}
- pattern-inside: |
resource "azurerm_app_service" "..." {
...
}
metadata:
category: security
owasp:
- A02:2017 - Broken Authentication
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe:
- 'CWE-287: Improper Authentication'
technology:
- terraform
- azure
references:
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#identity
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered
shortlink: https://sg.run/PbXY
semgrep.dev:
rule:
r_id: 15101
rv_id: 1263754
rule_id: WAUynd
version_id: 44TEj04
url: https://semgrep.dev/playground/r/44TEj04/terraform.azure.security.appservice.appservice-account-identity-registered.appservice-account-identity-registered
origin: community
languages:
- hcl
severity: INFO
- id: terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled
message: Enabling authentication ensures that all communications in the application
are authenticated. The `auth_settings` block needs to be filled out with the appropriate
auth backend settings
patterns:
- pattern: resource
- pattern-not-inside: |
resource "azurerm_app_service" "..." {
...
auth_settings {
...
enabled = true
...
}
...
}
- pattern-either:
- pattern-inside: |
resource "azurerm_app_service" "..." {
...
}
- pattern-inside: |
resource "azurerm_app_service" "..." {
...
auth_settings {
...
enabled = false
...
}
...
}
metadata:
cwe:
- 'CWE-287: Improper Authentication'
category: security
technology:
- terraform
- azure
references:
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#auth_settings
owasp:
- A02:2017 - Broken Authentication
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled
shortlink: https://sg.run/JxYw
semgrep.dev:
rule:
r_id: 15102
rv_id: 1263755
rule_id: 0oU23p
version_id: PkTR3P8
url: https://semgrep.dev/playground/r/PkTR3P8/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled
origin: community
languages:
- hcl
severity: ERROR
- id: terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2
message: Use the latest version of HTTP to ensure you are benefiting from security
fixes. Add `http2_enabled = true` to your appservice resource block
patterns:
- pattern: resource
- pattern-not-inside: |
resource "azurerm_app_service" "..." {
...
site_config {
...
http2_enabled = true
...
}
...
}
- pattern-either:
- pattern-inside: |
resource "azurerm_app_service" "..." {
...
}
- pattern-inside: |
resource "azurerm_app_service" "..." {
...
site_config {
...
http2_enabled = false
...
}
...
}
metadata:
cwe:
- 'CWE-444: Inconsistent Interpretation of HTTP Requests (''HTTP Request/Response
Smuggling'')'
category: security
technology:
- terraform
- azure
references:
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#http2_enabled
owasp:
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2
shortlink: https://sg.run/5DkA
semgrep.dev:
rule:
r_id: 15103
rv_id: 1263756
rule_id: KxU7LJ
version_id: JdTzx98
url: https://semgrep.dev/playground/r/JdTzx98/terraform.azure.security.appservice.appservice-enable-http2.appservice-enable-http2
origin: community
languages:
- hcl
severity: INFO
- id: terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only
message: By default, clients can connect to App Service by using both HTTP or HTTPS.
HTTP should be disabled enabling the HTTPS Only setting.
patterns:
- pattern: resource
- pattern-not-inside: |
resource "azurerm_app_service" "..." {
...
https_only = true
...
}
- pattern-either:
- pattern-inside: |
resource "azurerm_app_service" "..." {
...
}
- pattern-inside: |
resource "azurerm_app_service" "..." {
...
https_only = false
...
}
metadata:
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
category: security
technology:
- terraform
- azure
references:
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#https_only
- https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-bindings#enforce-https
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only
shortlink: https://sg.run/GOKp
semgrep.dev:
rule:
r_id: 15104
rv_id: 1263757
rule_id: qNUXwx
version_id: 5PTo1gg
url: https://semgrep.dev/playground/r/5PTo1gg/terraform.azure.security.appservice.appservice-enable-https-only.appservice-enable-https-only
origin: community
languages:
- hcl
severity: ERROR
- id: terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert
message: Detected an AppService that was not configured to use a client certificate.
Add `client_cert_enabled = true` in your resource block.
patterns:
- pattern: resource
- pattern-not-inside: |
resource "azurerm_app_service" "..." {
...
client_cert_enabled = true
...
}
- pattern-either:
- pattern-inside: |
resource "azurerm_app_service" "..." {
...
}
- pattern-inside: |
resource "azurerm_app_service" "..." {
...
client_cert_enabled = false
...
}
metadata:
cwe:
- 'CWE-295: Improper Certificate Validation'
category: security
technology:
- terraform
- azure
references:
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#client_cert_enabled
owasp:
- A03:2017 - Sensitive Data Exposure
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert
shortlink: https://sg.run/RX1O
semgrep.dev:
rule:
r_id: 15105
rv_id: 1263758
rule_id: lBU8D6
version_id: GxTkedE
url: https://semgrep.dev/playground/r/GxTkedE/terraform.azure.security.appservice.appservice-require-client-cert.appservice-require-client-cert
origin: community
languages:
- hcl
severity: INFO
- id: terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy
message: Detected an AppService that was not configured to use TLS 1.2. Add `site_config.min_tls_version
= "1.2"` in your resource block.
patterns:
- pattern: min_tls_version = $ANYTHING
- pattern-inside: |
resource "azurerm_app_service" "$NAME" {
...
}
- pattern-not-inside: min_tls_version = "1.2"
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
category: security
technology:
- terraform
- azure
references:
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#min_tls_version
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy
shortlink: https://sg.run/AXRp
semgrep.dev:
rule:
r_id: 15106
rv_id: 1263759
rule_id: YGUDbZ
version_id: RGT0L4x
url: https://semgrep.dev/playground/r/RGT0L4x/terraform.azure.security.appservice.appservice-use-secure-tls-policy.appservice-use-secure-tls-policy
origin: community
languages:
- hcl
severity: ERROR
- id: terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled
message: Enabling authentication ensures that all communications in the application
are authenticated. The `auth_settings` block needs to be filled out with the appropriate
auth backend settings
patterns:
- pattern: resource
- pattern-not-inside: |
resource "azurerm_function_app" "..." {
...
auth_settings {
...
enabled = true
...
}
...
}
- pattern-either:
- pattern-inside: |
resource "azurerm_function_app" "..." {
...
}
- pattern-inside: |
resource "azurerm_function_app" "..." {
...
auth_settings {
...
enabled = false
...
}
...
}
metadata:
cwe:
- 'CWE-287: Improper Authentication'
category: security
technology:
- terraform
- azure
references:
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#enabled
owasp:
- A02:2017 - Broken Authentication
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled
shortlink: https://sg.run/B6AW
semgrep.dev:
rule:
r_id: 15107
rv_id: 1263800
rule_id: 6JU1X8
version_id: JdTzxr8
url: https://semgrep.dev/playground/r/JdTzxr8/terraform.azure.security.functionapp.functionapp-authentication-enabled.functionapp-authentication-enabled
origin: community
languages:
- hcl
severity: INFO
- id: terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2
message: Use the latest version of HTTP to ensure you are benefiting from security
fixes. Add `http2_enabled = true` to your function app resource block
patterns:
- pattern: resource
- pattern-not-inside: |
resource "azurerm_function_app" "..." {
...
site_config {
...
http2_enabled = true
...
}
...
}
- pattern-either:
- pattern-inside: |
resource "azurerm_function_app" "..." {
...
}
- pattern-inside: |
resource "azurerm_function_app" "..." {
...
site_config {
...
http2_enabled = false
...
}
...
}
metadata:
cwe:
- 'CWE-444: Inconsistent Interpretation of HTTP Requests (''HTTP Request/Response
Smuggling'')'
category: security
technology:
- terraform
- azure
references:
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#http2_enabled
owasp:
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2
shortlink: https://sg.run/DzDY
semgrep.dev:
rule:
r_id: 15108
rv_id: 1263801
rule_id: oqU41L
version_id: 5PTo1Dg
url: https://semgrep.dev/playground/r/5PTo1Dg/terraform.azure.security.functionapp.functionapp-enable-http2.functionapp-enable-http2
origin: community
languages:
- hcl
severity: INFO
- id: terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny
message: Detected a Storage that was not configured to deny action by default. Add
`default_action = "Deny"` in your resource block.
patterns:
- pattern: resource
- pattern-not-inside: |
resource "azurerm_storage_account_network_rules" "..." {
...
default_action = "Deny"
...
}
- pattern-inside: |
resource "azurerm_storage_account_network_rules" "..." {
...
default_action = "Allow"
...
}
metadata:
cwe:
- 'CWE-16: CWE CATEGORY: Configuration'
category: security
technology:
- terraform
- azure
references:
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#default_action
- https://docs.microsoft.com/en-us/azure/firewall/rule-processing
owasp:
- A06:2017 - Security Misconfiguration
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny
shortlink: https://sg.run/WpN4
semgrep.dev:
rule:
r_id: 15109
rv_id: 1263804
rule_id: zdUY3N
version_id: A8Tgd7d
url: https://semgrep.dev/playground/r/A8Tgd7d/terraform.azure.security.storage.storage-default-action-deny.storage-default-action-deny
origin: community
languages:
- hcl
severity: ERROR
- id: terraform.azure.security.storage.storage-enforce-https.storage-enforce-https
message: Detected a Storage that was not configured to deny action by default. Add
`enable_https_traffic_only = true` in your resource block.
patterns:
- pattern-not-inside: |
resource "azurerm_storage_account" "..." {
...
enable_https_traffic_only = true
...
}
- pattern-inside: |
resource "azurerm_storage_account" "..." {
...
enable_https_traffic_only = false
...
}
metadata:
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
category: security
technology:
- terraform
- azure
references:
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#enable_https_traffic_only
- https://docs.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/terraform.azure.security.storage.storage-enforce-https.storage-enforce-https
shortlink: https://sg.run/0y9v
semgrep.dev:
rule:
r_id: 15110
rv_id: 1263805
rule_id: pKUpDA
version_id: BjTkZ0A
url: https://semgrep.dev/playground/r/BjTkZ0A/terraform.azure.security.storage.storage-enforce-https.storage-enforce-https
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted
patterns:
- pattern-not-inside: |
resource "aws_backup_vault" $BACKUP {
...
kms_key_arn = ...
...
}
- pattern: resource "aws_backup_vault" $BACKUP {...}
message: The AWS Backup vault is unencrypted. The AWS KMS encryption key protects
backups in the Backup vault. To create your own, create a aws_kms_key resource
or use the ARN string of a key in your account.
languages:
- hcl
severity: WARNING
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
technology:
- aws
- terraform
category: security
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted
shortlink: https://sg.run/18yw
semgrep.dev:
rule:
r_id: 15122
rv_id: 946662
rule_id: x8UxrP
version_id: GxTP79j
url: https://semgrep.dev/playground/r/GxTP79j/terraform.aws.security.aws-backup-vault-unencrypted.aws-backup-vault-unencrypted
origin: community
- id: kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind
metadata:
cwe:
- 'CWE-287: Improper Authentication'
owasp:
- A02:2017 - Broken Authentication
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#LDAP_ANONYMOUS
category: security
technology:
- kotlin
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind
shortlink: https://sg.run/rY2n
semgrep.dev:
rule:
r_id: 15125
rv_id: 1263258
rule_id: v8U9Q7
version_id: WrTqKgJ
url: https://semgrep.dev/playground/r/WrTqKgJ/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind
origin: community
message: Detected anonymous LDAP bind. This permits anonymous users to execute LDAP
statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html
for more information.
severity: WARNING
pattern: |
$ENV.put($CTX.SECURITY_AUTHENTICATION, "none")
...
$DCTX = InitialDirContext($ENV, ...)
languages:
- kt
- id: kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion
metadata:
cwe:
- 'CWE-704: Incorrect Type Conversion or Cast'
owasp: A03:2017 - Sensitive Data Exposure
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#BAD_HEXA_CONVERSION
category: security
technology:
- kotlin
references:
- https://cwe.mitre.org/data/definitions/704.html
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion
shortlink: https://sg.run/b25p
semgrep.dev:
rule:
r_id: 15126
rv_id: 945937
rule_id: d8UegG
version_id: xyTqnDy
url: https://semgrep.dev/playground/r/xyTqnDy/kotlin.lang.security.bad-hexa-conversion.bad-hexa-conversion
origin: community
message: '''Integer.toHexString()'' strips leading zeroes from each byte if read
byte-by-byte. This mistake weakens the hash value computed since it introduces
more collisions. Use ''String.format("%02X", ...)'' instead.'
severity: WARNING
languages:
- kt
pattern: |-
fun $METHOD(...) {
...
val $MD: MessageDigest = ...
...
$MD.digest(...)
...
Integer.toHexString(...)
}
- id: kotlin.lang.security.use-of-sha1.use-of-sha1
message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not
collision resistant and is therefore not suitable as a cryptographic signature.
Use SHA256 or SHA3 instead.
languages:
- kt
severity: WARNING
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_SHA1
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.5 Insecure Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
category: security
technology:
- kotlin
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/kotlin.lang.security.use-of-sha1.use-of-sha1
shortlink: https://sg.run/N1pp
semgrep.dev:
rule:
r_id: 15127
rv_id: 1263268
rule_id: ZqUOdd
version_id: 2KTv2XZ
url: https://semgrep.dev/playground/r/2KTv2XZ/kotlin.lang.security.use-of-sha1.use-of-sha1
origin: community
pattern-either:
- patterns:
- pattern: |
$VAR = $MD.getInstance("$ALGO")
- metavariable-regex:
metavariable: $ALGO
regex: (SHA1|SHA-1)
- pattern: |
$DU.getSha1Digest().digest(...)
- id: kotlin.lang.security.weak-rsa.use-of-weak-rsa-key
message: RSA keys should be at least 2048 bits based on NIST recommendation.
languages:
- kt
severity: WARNING
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#RSA_KEY_SIZE
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.5 Insecure Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms
category: security
technology:
- kotlin
subcategory:
- audit
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/kotlin.lang.security.weak-rsa.use-of-weak-rsa-key
shortlink: https://sg.run/krq7
semgrep.dev:
rule:
r_id: 15128
rv_id: 1263269
rule_id: nJUZNL
version_id: X0TzypE
url: https://semgrep.dev/playground/r/X0TzypE/kotlin.lang.security.weak-rsa.use-of-weak-rsa-key
origin: community
patterns:
- pattern-either:
- pattern: |
$KEY = $G.getInstance("RSA")
...
$KEY.initialize($BITS)
- metavariable-comparison:
metavariable: $BITS
comparison: $BITS < 2048
- id: terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret
message: Key vault Secret should have a content type set
patterns:
- pattern: resource
- pattern-not-inside: |
resource "azurerm_key_vault_secret" "..." {
...
content_type = "..."
...
}
- pattern-inside: |
resource "azurerm_key_vault_secret" "..." {
...
}
metadata:
category: correctness
technology:
- terraform
- azure
references:
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#content_type
- https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret
shortlink: https://sg.run/eoAb
semgrep.dev:
rule:
r_id: 15132
rv_id: 946862
rule_id: 8GUzld
version_id: JdTDP3Y
url: https://semgrep.dev/playground/r/JdTDP3Y/terraform.azure.security.keyvault.keyvault-content-type-for-secret.keyvault-content-type-for-secret
origin: community
languages:
- hcl
severity: INFO
- id: terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires
message: Ensure that the expiration date is set on all keys
patterns:
- pattern: resource
- pattern-not-inside: |
resource "azurerm_key_vault_key" "..." {
...
expiration_date = "..."
...
}
- pattern-inside: |
resource "azurerm_key_vault_key" "..." {
...
}
metadata:
cwe:
- 'CWE-262: Not Using Password Aging'
category: security
technology:
- terraform
- azure
references:
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key#expiration_date
- https://docs.microsoft.com/en-us/powershell/module/az.keyvault/update-azkeyvaultkey?view=azps-5.8.0#example-1--modify-a-key-to-enable-it--and-set-the-expiration-date-and-tags
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires
shortlink: https://sg.run/vq9A
semgrep.dev:
rule:
r_id: 15133
rv_id: 946863
rule_id: gxUgXq
version_id: 5PT94PR
url: https://semgrep.dev/playground/r/5PT94PR/terraform.azure.security.keyvault.keyvault-ensure-key-expires.keyvault-ensure-key-expires
origin: community
languages:
- hcl
severity: INFO
- id: terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires
message: Ensure that the expiration date is set on all secrets
patterns:
- pattern: resource
- pattern-not-inside: |
resource "azurerm_key_vault_secret" "..." {
...
expiration_date = "..."
...
}
- pattern-not-inside: |
resource "azurerm_key_vault_secret" "..." {
...
expiration_date = ...
...
}
- pattern-inside: |
resource "azurerm_key_vault_secret" "..." {
...
}
metadata:
cwe:
- 'CWE-262: Not Using Password Aging'
category: security
technology:
- terraform
- azure
references:
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#expiration_date
- https://docs.microsoft.com/en-us/azure/key-vault/secrets/about-secrets
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires
shortlink: https://sg.run/d2RZ
semgrep.dev:
rule:
r_id: 15134
rv_id: 1028693
rule_id: QrUdNy
version_id: 0bTl7og
url: https://semgrep.dev/playground/r/0bTl7og/terraform.azure.security.keyvault.keyvault-ensure-secret-expires.keyvault-ensure-secret-expires
origin: community
languages:
- hcl
severity: INFO
- id: terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled
message: Key vault should have purge protection enabled
patterns:
- pattern: resource
- pattern-not-inside: |
resource "azurerm_key_vault" "..." {
...
purge_protection_enabled = true
...
}
- pattern-either:
- pattern-inside: |
resource "azurerm_key_vault" "..." {
...
}
- pattern-inside: |
resource "azurerm_key_vault" "..." {
...
purge_protection_enabled = false
...
}
metadata:
cwe:
- 'CWE-693: Protection Mechanism Failure'
category: security
technology:
- terraform
- azure
references:
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#purge_protection_enabled
- https://docs.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview#purge-protection
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled
shortlink: https://sg.run/Z4xD
semgrep.dev:
rule:
r_id: 15135
rv_id: 946865
rule_id: 3qUjw9
version_id: RGTAPQ7
url: https://semgrep.dev/playground/r/RGTAPQ7/terraform.azure.security.keyvault.keyvault-purge-enabled.keyvault-purge-enabled
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl
message: Network ACLs allow you to reduce your exposure to risk by limiting what
can access your key vault. The default action of the Network ACL should be set
to deny for when IPs are not matched. Azure services can be allowed to bypass.
patterns:
- pattern: resource
- pattern-not-inside: |
resource "azurerm_key_vault" "..." {
...
network_acls {
...
default_action = "Deny"
...
}
...
}
- pattern-either:
- pattern-inside: |
resource "azurerm_key_vault" "..." {
...
}
- pattern-inside: |
resource "azurerm_key_vault" "..." {
...
network_acls {
...
default_action = "Allow"
...
}
...
}
metadata:
cwe:
- 'CWE-1220: Insufficient Granularity of Access Control'
category: security
technology:
- terraform
- azure
references:
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#network_acls
- https://docs.microsoft.com/en-us/azure/key-vault/general/network-security
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl
shortlink: https://sg.run/nKgX
semgrep.dev:
rule:
r_id: 15136
rv_id: 1263802
rule_id: 4bU1jy
version_id: GxTkeEE
url: https://semgrep.dev/playground/r/GxTkeEE/terraform.azure.security.keyvault.keyvault-specify-network-acl.keyvault-specify-network-acl
origin: community
languages:
- hcl
severity: ERROR
- id: json.aws.security.wildcard-assume-role.wildcard-assume-role
patterns:
- pattern-inside: |
"Statement": [...]
- pattern-inside: |
{..., "Effect": "Allow", ..., "Action": "sts:AssumeRole", ...}
- pattern: |
"Principal": {..., "AWS": "*", ...}
message: 'Detected wildcard access granted to sts:AssumeRole. This means anyone
with your AWS account ID and the name of the role can assume the role. Instead,
limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`.'
metadata:
cwe:
- 'CWE-250: Execution with Unnecessary Privileges'
category: security
technology:
- aws
references:
- https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/
owasp:
- A06:2017 - Security Misconfiguration
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/json.aws.security.wildcard-assume-role.wildcard-assume-role
shortlink: https://sg.run/7YEZ
semgrep.dev:
rule:
r_id: 15138
rv_id: 1263256
rule_id: JDULx5
version_id: BjTkZoy
url: https://semgrep.dev/playground/r/BjTkZoy/json.aws.security.wildcard-assume-role.wildcard-assume-role
origin: community
languages:
- json
severity: ERROR
- id: terraform.aws.security.wildcard-assume-role.wildcard-assume-role
patterns:
- pattern-inside: |
resource "aws_iam_role" $NAME {
...
}
- pattern: assume_role_policy = "$STATEMENT"
- metavariable-pattern:
metavariable: $STATEMENT
language: json
patterns:
- pattern-inside: |
{..., "Effect": "Allow", ..., "Action": "sts:AssumeRole", ...}
- pattern: |
"Principal": {..., "AWS": "*", ...}
message: 'Detected wildcard access granted to sts:AssumeRole. This means anyone
with your AWS account ID and the name of the role can assume the role. Instead,
limit to a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`.'
metadata:
cwe:
- 'CWE-250: Execution with Unnecessary Privileges'
category: security
technology:
- aws
references:
- https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/
owasp:
- A06:2017 - Security Misconfiguration
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/terraform.aws.security.wildcard-assume-role.wildcard-assume-role
shortlink: https://sg.run/LXWr
semgrep.dev:
rule:
r_id: 15139
rv_id: 1263749
rule_id: 5rUL1P
version_id: LjTkg8D
url: https://semgrep.dev/playground/r/LjTkg8D/terraform.aws.security.wildcard-assume-role.wildcard-assume-role
origin: community
languages:
- hcl
severity: ERROR
- id: terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass
message: Some Microsoft services that interact with storage accounts operate from
networks that can't be granted access through network rules. To help this type
of service work as intended, allow the set of trusted Microsoft services to bypass
the network rules
patterns:
- pattern-not-inside: |
resource "azurerm_storage_account" "..." {
...
network_rules {
...
bypass = ["...", "AzureServices"]
...
}
...
}
- pattern-not-inside: |
resource "azurerm_storage_account_network_rules" "..." {
...
bypass = ["...", "AzureServices"]
...
}
- pattern-either:
- pattern-inside: |
resource "azurerm_storage_account_network_rules" "..." {
...
bypass = [$ANYTHING]
...
}
- pattern-inside: |
resource "azurerm_storage_account" "..." {
...
network_rules {
...
bypass = [$ANYTHING]
...
}
...
}
metadata:
cwe:
- 'CWE-1220: Insufficient Granularity of Access Control'
category: security
technology:
- terraform
- azure
references:
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#bypass
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#bypass
- https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security#trusted-microsoft-services
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass
shortlink: https://sg.run/WpX4
semgrep.dev:
rule:
r_id: 15153
rv_id: 1263803
rule_id: GdUreY
version_id: RGT0LGx
url: https://semgrep.dev/playground/r/RGT0LGx/terraform.azure.security.storage.storage-allow-microsoft-service-bypass.storage-allow-microsoft-service-bypass
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging
message: Storage Analytics logs detailed information about successful and failed
requests to a storage service. This information can be used to monitor individual
requests and to diagnose issues with a storage service. Requests are logged on
a best-effort basis.
patterns:
- pattern-either:
- pattern-inside: |
resource "azurerm_storage_account" "..." {
...
queue_properties {
...
}
...
}
- pattern-inside: |
resource "azurerm_storage_account" "..." {
...
}
- pattern-not-inside: |
resource "azurerm_storage_account" "..." {
...
queue_properties {
...
logging {
...
}
...
}
...
}
metadata:
cwe:
- 'CWE-778: Insufficient Logging'
category: security
technology:
- terraform
- azure
references:
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#logging
- https://docs.microsoft.com/en-us/azure/storage/common/storage-analytics-logging?tabs=dotnet
owasp:
- A10:2017 - Insufficient Logging & Monitoring
- A09:2021 - Security Logging and Monitoring Failures
- A09:2025 - Security Logging & Alerting Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insufficient Logging
source: https://semgrep.dev/r/terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging
shortlink: https://sg.run/0yEv
semgrep.dev:
rule:
r_id: 15154
rv_id: 1263806
rule_id: ReU3L9
version_id: DkTRb05
url: https://semgrep.dev/playground/r/DkTRb05/terraform.azure.security.storage.storage-queue-services-logging.storage-queue-services-logging
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy
message: 'Azure Storage currently supports three versions of the TLS protocol: 1.0,
1.1, and 1.2. Azure Storage uses TLS 1.2 on public HTTPS endpoints, but TLS 1.0
and TLS 1.1 are still supported for backward compatibility. This check will warn
if the minimum TLS is not set to TLS1_2.'
patterns:
- pattern-either:
- pattern-inside: |
resource "azurerm_storage_account" "..." {
...
min_tls_version = "$ANYTHING"
...
}
- pattern-inside: |
resource "azurerm_storage_account" "..." {
...
}
- pattern-not-inside: |
resource "azurerm_storage_account" "..." {
...
min_tls_version = "TLS1_2"
...
}
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
category: security
technology:
- terraform
- azure
references:
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#min_tls_version
- https://docs.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy
shortlink: https://sg.run/KXD7
semgrep.dev:
rule:
r_id: 15155
rv_id: 1263807
rule_id: AbUQdL
version_id: WrTqKpv
url: https://semgrep.dev/playground/r/WrTqKpv/terraform.azure.security.storage.storage-use-secure-tls-policy.storage-use-secure-tls-policy
origin: community
languages:
- hcl
severity: ERROR
- id: python.lang.security.audit.python-reverse-shell.python-reverse-shell
patterns:
- pattern-either:
- pattern: pty.spawn("$BINPATH",...)
- pattern: subprocess.call(["$BINPATH",...],...)
- metavariable-regex:
metavariable: $BINPATH
regex: /bin/.*?sh\b
- pattern-inside: |
import socket
...
$S = socket.socket(...)
...
$S.connect(($IP,$PORT),...)
...
message: Semgrep found a Python reverse shell using $BINPATH to $IP at $PORT
metadata:
cwe:
- 'CWE-553: Command Shell in Externally Accessible Directory'
category: security
technology:
- python
references:
- https://cwe.mitre.org/data/definitions/553.html
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.lang.security.audit.python-reverse-shell.python-reverse-shell
shortlink: https://sg.run/gYZJ
semgrep.dev:
rule:
r_id: 15185
rv_id: 946375
rule_id: nJUZRY
version_id: BjT1NZ4
url: https://semgrep.dev/playground/r/BjT1NZ4/python.lang.security.audit.python-reverse-shell.python-reverse-shell
origin: community
languages:
- python
severity: WARNING
- id: scala.lang.security.audit.insecure-random.insecure-random
metadata:
cwe:
- 'CWE-330: Use of Insufficiently Random Values'
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
category: security
technology:
- scala
- cryptography
resources:
- https://find-sec-bugs.github.io/bugs.htm
confidence: LOW
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/scala.lang.security.audit.insecure-random.insecure-random
shortlink: https://sg.run/JxAw
semgrep.dev:
rule:
r_id: 15190
rv_id: 1263674
rule_id: gxUgDk
version_id: jQTn5Px
url: https://semgrep.dev/playground/r/jQTn5Px/scala.lang.security.audit.insecure-random.insecure-random
origin: community
message: Flags the use of a predictable random value from `scala.util.Random`. This
can lead to vulnerabilities when used in security contexts, such as in a CSRF
token, password reset token, or any other secret value. To fix this, use java.security.SecureRandom
instead.
severity: WARNING
languages:
- scala
patterns:
- pattern: |
import scala.util.Random
- id: scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile
metadata:
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
category: security
technology:
- scala
resources:
- https://find-sec-bugs.github.io/bugs.htm
confidence: LOW
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile
shortlink: https://sg.run/5D1A
semgrep.dev:
rule:
r_id: 15191
rv_id: 1263676
rule_id: QrUdOZ
version_id: 9lT4bpj
url: https://semgrep.dev/playground/r/9lT4bpj/scala.lang.security.audit.path-traversal-fromfile.path-traversal-fromfile
origin: community
message: Flags cases of possible path traversal. If an unfiltered parameter is passed
into 'fromFile', file from an arbitrary filesystem location could be read. This
could lead to sensitive data exposure and other provles. Instead, sanitize the
user input instead of performing direct string concatenation.
severity: WARNING
languages:
- scala
patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
$FILENAME = "..." + $VAR
...
- pattern-inside: |
$FILENAME = $VAR + "..."
...
- pattern-inside: |
$FILENAME = $STR.concat($VAR)
...
- pattern-inside: |
$FILENAME = "...".format(..., $VAR, ...)
...
- pattern: Source.fromFile($FILENAME, ...)
- patterns:
- pattern-either:
- pattern: Source.fromFile("..." + $VAR, ...)
- pattern: Source.fromFile($VAR + "...", ...)
- pattern: Source.fromFile($STR.concat($VAR), ...)
- pattern: Source.fromFile("...".format(..., $VAR, ...), ...)
- pattern-inside: |
def $FUNC(..., $VAR: $TYPE, ...) = Action {
...
}
- id: scala.lang.security.audit.rsa-padding-set.rsa-padding-set
metadata:
cwe:
- 'CWE-780: Use of RSA Algorithm without OAEP'
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
category: security
technology:
- scala
- cryptography
resources:
- https://blog.codacy.com/9-scala-security-issues/
confidence: HIGH
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/scala.lang.security.audit.rsa-padding-set.rsa-padding-set
shortlink: https://sg.run/GO5p
semgrep.dev:
rule:
r_id: 15192
rv_id: 1263677
rule_id: 3qUj1Q
version_id: yeTxpoX
url: https://semgrep.dev/playground/r/yeTxpoX/scala.lang.security.audit.rsa-padding-set.rsa-padding-set
origin: community
message: Usage of RSA without OAEP (Optimal Asymmetric Encryption Padding) may weaken
encryption. This could lead to sensitive data exposure. Instead, use RSA with
`OAEPWithMD5AndMGF1Padding` instead.
severity: WARNING
languages:
- scala
patterns:
- pattern: |
$VAR = $CIPHER.getInstance($MODE)
- metavariable-regex:
metavariable: $MODE
regex: .*RSA/.*/NoPadding.*
- id: typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption
message: 'Add "encryption: $Y.BucketEncryption.KMS_MANAGED" or "encryption: $Y.BucketEncryption.S3_MANAGED"
to the bucket props for Bucket construct $X'
metadata:
cwe:
- 'CWE-311: Missing Encryption of Sensitive Data'
category: security
technology:
- AWS-CDK
references:
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html
owasp:
- A03:2017 - Sensitive Data Exposure
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption
shortlink: https://sg.run/eowX
semgrep.dev:
rule:
r_id: 15276
rv_id: 1263903
rule_id: bwU8qz
version_id: GxTkeRx
url: https://semgrep.dev/playground/r/GxTkeRx/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption
origin: community
languages:
- typescript
severity: ERROR
pattern-either:
- patterns:
- pattern-inside: |
import {Bucket} from '@aws-cdk/aws-s3'
...
- pattern: const $X = new Bucket(...)
- pattern-not: |
const $X = new Bucket(..., {..., encryption: BucketEncryption.KMS_MANAGED, ...})
- pattern-not: |
const $X = new Bucket(..., {..., encryption: BucketEncryption.KMS, ...})
- pattern-not: |
const $X = new Bucket(..., {..., encryption: BucketEncryption.S3_MANAGED, ...})
- patterns:
- pattern-inside: |
import * as $Y from '@aws-cdk/aws-s3'
...
- pattern: const $X = new $Y.Bucket(...)
- pattern-not: |
const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.KMS_MANAGED, ...})
- pattern-not: |
const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.KMS, ...})
- pattern-not: |
const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.S3_MANAGED, ...})
- id: typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl
message: Bucket $X is not set to enforce encryption-in-transit, if not explictly
setting this on the bucket policy - the property "enforceSSL" should be set to
true
metadata:
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
category: security
technology:
- AWS-CDK
references:
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl
shortlink: https://sg.run/vqBX
semgrep.dev:
rule:
r_id: 15277
rv_id: 1263904
rule_id: NbUN8B
version_id: RGT0Llg
url: https://semgrep.dev/playground/r/RGT0Llg/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl
origin: community
languages:
- ts
severity: ERROR
pattern-either:
- patterns:
- pattern-inside: |
import {Bucket} from '@aws-cdk/aws-s3';
...
- pattern: const $X = new Bucket(...)
- pattern-not: |
const $X = new Bucket(..., {enforceSSL: true}, ...)
- patterns:
- pattern-inside: |
import * as $Y from '@aws-cdk/aws-s3';
...
- pattern: const $X = new $Y.Bucket(...)
- pattern-not: |
const $X = new $Y.Bucket(..., {..., enforceSSL: true, ...})
- id: typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue
message: 'Queue $X is missing encryption at rest. Add "encryption: $Y.QueueEncryption.KMS"
or "encryption: $Y.QueueEncryption.KMS_MANAGED" to the queue props to enable encryption
at rest for the queue.'
metadata:
category: security
cwe:
- 'CWE-311: Missing Encryption of Sensitive Data'
technology:
- AWS-CDK
references:
- https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-data-protection.html
owasp:
- A03:2017 - Sensitive Data Exposure
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue
shortlink: https://sg.run/d23P
semgrep.dev:
rule:
r_id: 15278
rv_id: 1263905
rule_id: kxUwqO
version_id: A8Tgd2W
url: https://semgrep.dev/playground/r/A8Tgd2W/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue
origin: community
languages:
- ts
severity: WARNING
pattern-either:
- patterns:
- pattern-inside: |
import {Queue} from '@aws-cdk/aws-sqs'
...
- pattern: const $X = new Queue(...)
- pattern-not: |
const $X = new Queue(..., {..., encryption: QueueEncryption.KMS_MANAGED, ...})
- pattern-not: |
const $X = new Queue(..., {..., encryption: QueueEncryption.KMS, ...})
- patterns:
- pattern-inside: |
import * as $Y from '@aws-cdk/aws-sqs'
...
- pattern: const $X = new $Y.Queue(...)
- pattern-not: |
const $X = new $Y.Queue(..., {..., encryption: $Y.QueueEncryption.KMS_MANAGED, ...})
- pattern-not: |
const $X = new $Y.Queue(..., {..., encryption: $Y.QueueEncryption.KMS, ...})
- id: typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod
message: Using the GrantPublicAccess method on bucket contruct $X will make the
objects in the bucket world accessible. Verify if this is intentional.
metadata:
cwe:
- 'CWE-306: Missing Authentication for Critical Function'
category: security
technology:
- AWS-CDK
references:
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod
shortlink: https://sg.run/Z4p7
semgrep.dev:
rule:
r_id: 15279
rv_id: 1263906
rule_id: wdUjZK
version_id: BjTkZA7
url: https://semgrep.dev/playground/r/BjTkZA7/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod
origin: community
languages:
- ts
severity: WARNING
pattern-either:
- patterns:
- pattern-inside: |
import {Bucket} from '@aws-cdk/aws-s3'
...
- pattern: |
const $X = new Bucket(...)
...
$X.grantPublicAccess(...)
- patterns:
- pattern-inside: |
import * as $Y from '@aws-cdk/aws-s3'
...
- pattern: |
const $X = new $Y.Bucket(...)
...
$X.grantPublicAccess(...)
- id: typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public
message: CodeBuild Project $X is set to have a public URL. This will make the build
results, logs, artifacts publically accessible, including builds prior to the
project being public. Ensure this is acceptable for the project.
metadata:
category: security
cwe:
- 'CWE-306: Missing Authentication for Critical Function'
technology:
- AWS-CDK
references:
- https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public
shortlink: https://sg.run/nK7G
semgrep.dev:
rule:
r_id: 15280
rv_id: 1263907
rule_id: x8UxXZ
version_id: DkTRbj1
url: https://semgrep.dev/playground/r/DkTRbj1/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public
origin: community
languages:
- ts
severity: WARNING
pattern-either:
- patterns:
- pattern-inside: |
import {Project} from '@aws-cdk/aws-codebuild'
...
- pattern: |
const $X = new Project(..., {..., badge: true, ...})
- patterns:
- pattern-inside: |
import * as $Y from '@aws-cdk/aws-codebuild'
...
- pattern: |
const $X = new $Y.Project(..., {..., badge: true, ...})
- id: python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text
mode: taint
pattern-sinks:
- pattern: |
sqlalchemy.text(...)
pattern-sources:
- patterns:
- pattern: |
$X + $Y
- metavariable-type:
metavariable: $X
type: string
- patterns:
- pattern: |
$X + $Y
- metavariable-type:
metavariable: $Y
type: string
- patterns:
- pattern: |
f"..."
- patterns:
- pattern: |
$X.format(...)
- metavariable-type:
metavariable: $X
type: string
- patterns:
- pattern: |
$X % $Y
- metavariable-type:
metavariable: $X
type: string
message: sqlalchemy.text passes the constructed SQL statement to the database mostly
unchanged. This means that the usual SQL injection protections are not applied
and this function is vulnerable to SQL injection if user input can reach here.
Use normal SQLAlchemy operators (such as `or_()`, `and_()`, etc.) to construct
SQL.
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
category: security
technology:
- sqlalchemy
confidence: MEDIUM
references:
- https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text
shortlink: https://sg.run/yP1O
semgrep.dev:
rule:
r_id: 15824
rv_id: 1263577
rule_id: r6U2wE
version_id: rxTAKqq
url: https://semgrep.dev/playground/r/rxTAKqq/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text
origin: community
languages:
- python
severity: ERROR
- id: terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption
patterns:
- pattern: resource "aws_athena_workgroup" $ANYTHING {...}
- pattern-not-inside: |
resource "aws_athena_workgroup" $ANYTHING {
...
encryption_configuration {...}
...
}
message: 'The AWS Athena Workgroup is unencrypted. Encryption protects query results
in your workgroup. To enable, add: `encryption_configuration { encryption_option
= "SSE_KMS" kms_key_arn = aws_kms_key.example.arn }` within `result_configuration
{ }` in your resource block, where `encryption_option` is your chosen encryption
method and `kms_key_arn` is your KMS key ARN.'
languages:
- hcl
severity: WARNING
metadata:
technology:
- aws
- terraform
category: security
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption
shortlink: https://sg.run/kzro
semgrep.dev:
rule:
r_id: 15828
rv_id: 946736
rule_id: wdUljO
version_id: jQTzqko
url: https://semgrep.dev/playground/r/jQTzqko/terraform.aws.security.missing-athena-workgroup-encryption.missing-athena-workgroup-encryption
origin: community
- id: terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging
patterns:
- pattern: |
name = ...
- pattern-inside: |
resource "aws_eks_cluster" "..." {
...
}
- pattern-not-inside: |
resource "aws_eks_cluster" "..." {
...
enabled_cluster_log_types = [..., "api", ..., "audit", ...]
...
}
- pattern-not-inside: |
resource "aws_eks_cluster" "..." {
...
enabled_cluster_log_types = [..., "audit", ..., "api", ...]
...
}
languages:
- hcl
message: Missing EKS control plane logging. It is recommended to enable at least
Kubernetes API server component logs ("api") and audit logs ("audit") of the EKS
control plane through the enabled_cluster_log_types attribute.
severity: WARNING
metadata:
references:
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_cluster#enabling-control-plane-logging
- https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html
category: security
cwe:
- 'CWE-778: Insufficient Logging'
technology:
- terraform
- aws
owasp:
- A10:2017 - Insufficient Logging & Monitoring
- A09:2021 - Security Logging and Monitoring Failures
- A09:2025 - Security Logging & Alerting Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insufficient Logging
source: https://semgrep.dev/r/terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging
shortlink: https://sg.run/wZ3n
semgrep.dev:
rule:
r_id: 15829
rv_id: 1263886
rule_id: x8UGx7
version_id: O9Tpxxw
url: https://semgrep.dev/playground/r/O9Tpxxw/terraform.lang.security.eks-insufficient-control-plane-logging.eks-insufficient-control-plane-logging
origin: community
- id: terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code
pattern-either:
- patterns:
- pattern: password = "..."
- pattern-inside: |
resource "aws_db_instance" "..." {
...
}
- patterns:
- pattern: master_password = "..."
- pattern-inside: |
resource "aws_rds_cluster" "..." {
...
}
languages:
- hcl
severity: WARNING
message: RDS instance or cluster with hardcoded credentials in source code. It is
recommended to pass the credentials at runtime, or generate random credentials
using the random_password resource.
metadata:
references:
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#master_password
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#master_password
- https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password
cwe:
- 'CWE-522: Insufficiently Protected Credentials'
category: security
technology:
- terraform
- aws
- secrets
owasp:
- A02:2017 - Broken Authentication
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code
shortlink: https://sg.run/x4qA
semgrep.dev:
rule:
r_id: 15830
rv_id: 1263896
rule_id: OrUl6W
version_id: gETB77b
url: https://semgrep.dev/playground/r/gETB77b/terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code
origin: community
- id: terraform.lang.security.rds-public-access.rds-public-access
patterns:
- pattern: publicly_accessible = true
- pattern-inside: |
resource "aws_db_instance" "..." {
...
}
languages:
- hcl
severity: WARNING
message: RDS instance accessible from the Internet detected.
metadata:
references:
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#publicly_accessible
- https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html#USER_VPC.Hiding
cwe:
- 'CWE-1220: Insufficient Granularity of Access Control'
category: security
technology:
- terraform
- aws
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/terraform.lang.security.rds-public-access.rds-public-access
shortlink: https://sg.run/Oye2
semgrep.dev:
rule:
r_id: 15831
rv_id: 1263897
rule_id: eqUrzK
version_id: QkTGqqJ
url: https://semgrep.dev/playground/r/QkTGqqJ/terraform.lang.security.rds-public-access.rds-public-access
origin: community
- id: generic.ci.security.bash-reverse-shell.bash_reverse_shell
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
category: security
technology:
- ci
confidence: HIGH
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
subcategory:
- audit
likelihood: MEDIUM
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/generic.ci.security.bash-reverse-shell.bash_reverse_shell
shortlink: https://sg.run/4l9l
semgrep.dev:
rule:
r_id: 16200
rv_id: 1262664
rule_id: gxUJrJ
version_id: jQTn5QE
url: https://semgrep.dev/playground/r/jQTn5QE/generic.ci.security.bash-reverse-shell.bash_reverse_shell
origin: community
message: Semgrep found a bash reverse shell
severity: ERROR
languages:
- generic
pattern-either:
- pattern: |
sh -i >& /dev/udp/.../... 0>&1
- pattern: |
<...>/dev/tcp/.../...; sh <&... >&... 2>&
- pattern: |
<...>/dev/tcp/.../...; cat <&... | while read line; do $line 2>&... >&...;done
- pattern: |
sh -i ...<...> /dev/tcp/.../... ...<&... 1>&... 2>&
- id: ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection
pattern: skip_forgery_protection
message: This call turns off CSRF protection allowing CSRF attacks against the application
languages:
- ruby
severity: WARNING
metadata:
cwe:
- 'CWE-352: Cross-Site Request Forgery (CSRF)'
category: security
technology:
- rails
references:
- https://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#method-i-skip_forgery_protection
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site Request Forgery (CSRF)
source: https://semgrep.dev/r/ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection
shortlink: https://sg.run/PgwY
semgrep.dev:
rule:
r_id: 16201
rv_id: 1263627
rule_id: QrUnEk
version_id: pZT03ZD
url: https://semgrep.dev/playground/r/pZT03ZD/ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection
origin: community
- id: terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket
patterns:
- pattern: a
- pattern: b
languages:
- hcl
severity: INFO
message: This rule has been deprecated, as all s3 buckets are encrypted by default
with no way to disable it. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration
for more info.
metadata:
references:
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#server_side_encryption_configuration
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html
cwe:
- 'CWE-311: Missing Encryption of Sensitive Data'
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
deprecated: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket
shortlink: https://sg.run/Jezw
semgrep.dev:
rule:
r_id: 16202
rv_id: 1263901
rule_id: 3qU62L
version_id: JdTzxjN
url: https://semgrep.dev/playground/r/JdTzxjN/terraform.lang.security.s3-unencrypted-bucket.s3-unencrypted-bucket
origin: community
- id: php.lang.security.injection.tainted-filename.tainted-filename
severity: WARNING
message: File name based on user input risks server-side request forgery.
metadata:
technology:
- php
category: security
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/php.lang.security.injection.tainted-filename.tainted-filename
shortlink: https://sg.run/Ayqp
semgrep.dev:
rule:
r_id: 16250
rv_id: 1263287
rule_id: 5rUpro
version_id: 7ZTE3J1
url: https://semgrep.dev/playground/r/7ZTE3J1/php.lang.security.injection.tainted-filename.tainted-filename
origin: community
languages:
- php
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: $_GET
- pattern: $_POST
- pattern: $_COOKIE
- pattern: $_REQUEST
- pattern: $_SERVER
pattern-sanitizers:
- patterns:
- pattern-either:
- pattern-inside: basename($PATH, ...)
- pattern-inside: linkinfo($PATH, ...)
- pattern-inside: readlink($PATH, ...)
- pattern-inside: realpath($PATH, ...)
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: opcache_compile_file($FILENAME, ...)
- pattern-inside: opcache_invalidate($FILENAME, ...)
- pattern-inside: opcache_is_script_cached($FILENAME, ...)
- pattern-inside: runkit7_import($FILENAME, ...)
- pattern-inside: readline_read_history($FILENAME, ...)
- pattern-inside: readline_write_history($FILENAME, ...)
- pattern-inside: rar_open($FILENAME, ...)
- pattern-inside: zip_open($FILENAME, ...)
- pattern-inside: gzfile($FILENAME, ...)
- pattern-inside: gzopen($FILENAME, ...)
- pattern-inside: readgzfile($FILENAME, ...)
- pattern-inside: hash_file($ALGO, $FILENAME, ...)
- pattern-inside: hash_update_file($CONTEXT, $FILENAME, ...)
- pattern-inside: pg_trace($FILENAME, ...)
- pattern-inside: dio_open($FILENAME, ...)
- pattern-inside: finfo_file($FINFO, $FILENAME, ...)
- pattern-inside: mime_content_type($FILENAME, ...)
- pattern-inside: chgrp($FILENAME, ...)
- pattern-inside: chmod($FILENAME, ...)
- pattern-inside: chown($FILENAME, ...)
- pattern-inside: clearstatcache($CLEAR_REALPATH_CACHE, $FILENAME, ...)
- pattern-inside: file_exists($FILENAME, ...)
- pattern-inside: file_get_contents($FILENAME, ...)
- pattern-inside: file_put_contents($FILENAME, ...)
- pattern-inside: file($FILENAME, ...)
- pattern-inside: fileatime($FILENAME, ...)
- pattern-inside: filectime($FILENAME, ...)
- pattern-inside: filegroup($FILENAME, ...)
- pattern-inside: fileinode($FILENAME, ...)
- pattern-inside: filemtime($FILENAME, ...)
- pattern-inside: fileowner($FILENAME, ...)
- pattern-inside: fileperms($FILENAME, ...)
- pattern-inside: filesize($FILENAME, ...)
- pattern-inside: filetype($FILENAME, ...)
- pattern-inside: fnmatch($PATTERN, $FILENAME, ...)
- pattern-inside: fopen($FILENAME, ...)
- pattern-inside: is_dir($FILENAME, ...)
- pattern-inside: is_executable($FILENAME, ...)
- pattern-inside: is_file($FILENAME, ...)
- pattern-inside: is_link($FILENAME, ...)
- pattern-inside: is_readable($FILENAME, ...)
- pattern-inside: is_uploaded_file($FILENAME, ...)
- pattern-inside: is_writable($FILENAME, ...)
- pattern-inside: lchgrp($FILENAME, ...)
- pattern-inside: lchown($FILENAME, ...)
- pattern-inside: lstat($FILENAME, ...)
- pattern-inside: parse_ini_file($FILENAME, ...)
- pattern-inside: readfile($FILENAME, ...)
- pattern-inside: stat($FILENAME, ...)
- pattern-inside: touch($FILENAME, ...)
- pattern-inside: unlink($FILENAME, ...)
- pattern-inside: xattr_get($FILENAME, ...)
- pattern-inside: xattr_list($FILENAME, ...)
- pattern-inside: xattr_remove($FILENAME, ...)
- pattern-inside: xattr_set($FILENAME, ...)
- pattern-inside: xattr_supported($FILENAME, ...)
- pattern-inside: enchant_broker_request_pwl_dict($BROKER, $FILENAME, ...)
- pattern-inside: pspell_config_personal($CONFIG, $FILENAME, ...)
- pattern-inside: pspell_config_repl($CONFIG, $FILENAME, ...)
- pattern-inside: pspell_new_personal($FILENAME, ...)
- pattern-inside: exif_imagetype($FILENAME, ...)
- pattern-inside: getimagesize($FILENAME, ...)
- pattern-inside: image2wbmp($IMAGE, $FILENAME, ...)
- pattern-inside: imagecreatefromavif($FILENAME, ...)
- pattern-inside: imagecreatefrombmp($FILENAME, ...)
- pattern-inside: imagecreatefromgd2($FILENAME, ...)
- pattern-inside: imagecreatefromgd2part($FILENAME, ...)
- pattern-inside: imagecreatefromgd($FILENAME, ...)
- pattern-inside: imagecreatefromgif($FILENAME, ...)
- pattern-inside: imagecreatefromjpeg($FILENAME, ...)
- pattern-inside: imagecreatefrompng($FILENAME, ...)
- pattern-inside: imagecreatefromtga($FILENAME, ...)
- pattern-inside: imagecreatefromwbmp($FILENAME, ...)
- pattern-inside: imagecreatefromwebp($FILENAME, ...)
- pattern-inside: imagecreatefromxbm($FILENAME, ...)
- pattern-inside: imagecreatefromxpm($FILENAME, ...)
- pattern-inside: imageloadfont($FILENAME, ...)
- pattern-inside: imagexbm($IMAGE, $FILENAME, ...)
- pattern-inside: iptcembed($IPTC_DATA, $FILENAME, ...)
- pattern-inside: mailparse_msg_extract_part_file($MIMEMAIL, $FILENAME, ...)
- pattern-inside: mailparse_msg_extract_whole_part_file($MIMEMAIL, $FILENAME,
...)
- pattern-inside: mailparse_msg_parse_file($FILENAME, ...)
- pattern-inside: fdf_add_template($FDF_DOCUMENT, $NEWPAGE, $FILENAME, ...)
- pattern-inside: fdf_get_ap($FDF_DOCUMENT, $FIELD, $FACE, $FILENAME, ...)
- pattern-inside: fdf_open($FILENAME, ...)
- pattern-inside: fdf_save($FDF_DOCUMENT, $FILENAME, ...)
- pattern-inside: fdf_set_ap($FDF_DOCUMENT, $FIELD_NAME, $FACE, $FILENAME, ...)
- pattern-inside: ps_add_launchlink($PSDOC, $LLX, $LLY, $URX, $URY, $FILENAME,
...)
- pattern-inside: ps_add_pdflink($PSDOC, $LLX, $LLY, $URX, $URY, $FILENAME,
...)
- pattern-inside: ps_open_file($PSDOC, $FILENAME, ...)
- pattern-inside: ps_open_image_file($PSDOC, $TYPE, $FILENAME, ...)
- pattern-inside: posix_access($FILENAME, ...)
- pattern-inside: posix_mkfifo($FILENAME, ...)
- pattern-inside: posix_mknod($FILENAME, ...)
- pattern-inside: ftok($FILENAME, ...)
- pattern-inside: fann_cascadetrain_on_file($ANN, $FILENAME, ...)
- pattern-inside: fann_read_train_from_file($FILENAME, ...)
- pattern-inside: fann_train_on_file($ANN, $FILENAME, ...)
- pattern-inside: highlight_file($FILENAME, ...)
- pattern-inside: php_strip_whitespace($FILENAME, ...)
- pattern-inside: stream_resolve_include_path($FILENAME, ...)
- pattern-inside: swoole_async_read($FILENAME, ...)
- pattern-inside: swoole_async_readfile($FILENAME, ...)
- pattern-inside: swoole_async_write($FILENAME, ...)
- pattern-inside: swoole_async_writefile($FILENAME, ...)
- pattern-inside: swoole_load_module($FILENAME, ...)
- pattern-inside: tidy_parse_file($FILENAME, ...)
- pattern-inside: tidy_repair_file($FILENAME, ...)
- pattern-inside: get_meta_tags($FILENAME, ...)
- pattern-inside: yaml_emit_file($FILENAME, ...)
- pattern-inside: yaml_parse_file($FILENAME, ...)
- pattern-inside: curl_file_create($FILENAME, ...)
- pattern-inside: ftp_chmod($FTP, $PERMISSIONS, $FILENAME, ...)
- pattern-inside: ftp_delete($FTP, $FILENAME, ...)
- pattern-inside: ftp_mdtm($FTP, $FILENAME, ...)
- pattern-inside: ftp_size($FTP, $FILENAME, ...)
- pattern-inside: rrd_create($FILENAME, ...)
- pattern-inside: rrd_fetch($FILENAME, ...)
- pattern-inside: rrd_graph($FILENAME, ...)
- pattern-inside: rrd_info($FILENAME, ...)
- pattern-inside: rrd_last($FILENAME, ...)
- pattern-inside: rrd_lastupdate($FILENAME, ...)
- pattern-inside: rrd_tune($FILENAME, ...)
- pattern-inside: rrd_update($FILENAME, ...)
- pattern-inside: snmp_read_mib($FILENAME, ...)
- pattern-inside: ssh2_sftp_chmod($SFTP, $FILENAME, ...)
- pattern-inside: ssh2_sftp_realpath($SFTP, $FILENAME, ...)
- pattern-inside: ssh2_sftp_unlink($SFTP, $FILENAME, ...)
- pattern-inside: apache_lookup_uri($FILENAME, ...)
- pattern-inside: md5_file($FILENAME, ...)
- pattern-inside: sha1_file($FILENAME, ...)
- pattern-inside: simplexml_load_file($FILENAME, ...)
- pattern: $FILENAME
- id: php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation
languages:
- php
severity: WARNING
message: <- A new object is created where the class name is based on user input.
This could lead to remote code execution, as it allows to instantiate any class
in the application.
metadata:
cwe:
- 'CWE-470: Use of Externally-Controlled Input to Select Classes or Code (''Unsafe
Reflection'')'
category: security
technology:
- php
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation
shortlink: https://sg.run/7ndw
semgrep.dev:
rule:
r_id: 16438
rv_id: 1263288
rule_id: v8U4DA
version_id: LjTkgLy
url: https://semgrep.dev/playground/r/LjTkgLy/php.lang.security.injection.tainted-object-instantiation.tainted-object-instantiation
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: $_GET
- pattern: $_POST
- pattern: $_COOKIE
- pattern: $_REQUEST
- pattern: $_SERVER
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: new $SINK(...)
- pattern: $SINK
- id: terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials
patterns:
- pattern-inside: |
provider "aws" {
...
secret_key = "$SECRET"
}
- focus-metavariable: $SECRET
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
languages:
- hcl
severity: WARNING
metadata:
technology:
- secrets
- aws
- terraform
category: security
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials
shortlink: https://sg.run/L3kn
semgrep.dev:
rule:
r_id: 16439
rv_id: 1263735
rule_id: d8U4n0
version_id: rxTAK76
url: https://semgrep.dev/playground/r/rxTAK76/terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials
origin: community
- id: ruby.rails.security.audit.detailed-exceptions.detailed-exceptions
metadata:
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_detailed_exceptions.rb
category: security
technology:
- rails
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/ruby.rails.security.audit.detailed-exceptions.detailed-exceptions
shortlink: https://sg.run/Je0d
semgrep.dev:
rule:
r_id: 16546
rv_id: 1263626
rule_id: 8GUAo4
version_id: zyTb2oJ
url: https://semgrep.dev/playground/r/zyTb2oJ/ruby.rails.security.audit.detailed-exceptions.detailed-exceptions
origin: community
message: Found that the setting for providing detailed exception reports in Rails
is set to true. This can lead to information exposure, where sensitive system
or internal information is displayed to the end user. Instead, turn this setting
off.
languages:
- ruby
severity: WARNING
patterns:
- pattern-either:
- patterns:
- pattern: |
config.consider_all_requests_local = true
- patterns:
- pattern-inside: |
class $CONTROLLER < ApplicationController
...
end
- pattern: |
def show_detailed_exceptions? (...)
...
return $RETURN
end
- metavariable-pattern:
metavariable: $RETURN
patterns:
- pattern-not: |
false
- id: php.laravel.security.laravel-sql-injection.laravel-sql-injection
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
category: security
technology:
- laravel
references:
- https://laravel.com/docs/8.x/queries
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/php.laravel.security.laravel-sql-injection.laravel-sql-injection
shortlink: https://sg.run/x40p
semgrep.dev:
rule:
r_id: 16830
rv_id: 1263313
rule_id: j2UQdp
version_id: BjTkZ45
url: https://semgrep.dev/playground/r/BjTkZ45/php.laravel.security.laravel-sql-injection.laravel-sql-injection
origin: community
severity: WARNING
message: Detected a SQL query based on user input. This could lead to SQL injection,
which could potentially result in sensitive data being exfiltrated by attackers.
Instead, use parameterized queries and prepared statements.
languages:
- php
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: $_GET
- pattern: $_POST
- pattern: $_COOKIE
- pattern: $_REQUEST
- pattern: $_SERVER
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: $SQL
- pattern-either:
- pattern-inside: DB::table(...)->whereRaw($SQL, ...)
- pattern-inside: DB::table(...)->orWhereRaw($SQL, ...)
- pattern-inside: DB::table(...)->groupByRaw($SQL, ...)
- pattern-inside: DB::table(...)->havingRaw($SQL, ...)
- pattern-inside: DB::table(...)->orHavingRaw($SQL, ...)
- pattern-inside: DB::table(...)->orderByRaw($SQL, ...)
- patterns:
- pattern: $EXPRESSION
- pattern-either:
- pattern-inside: DB::table(...)->selectRaw($EXPRESSION, ...)
- pattern-inside: DB::table(...)->fromRaw($EXPRESSION, ...)
- patterns:
- pattern: $COLUMNS
- pattern-either:
- pattern-inside: DB::table(...)->whereNull($COLUMNS, ...)
- pattern-inside: DB::table(...)->orWhereNull($COLUMN)
- pattern-inside: DB::table(...)->whereNotNull($COLUMNS, ...)
- pattern-inside: DB::table(...)->whereRowValues($COLUMNS, ...)
- pattern-inside: DB::table(...)->orWhereRowValues($COLUMNS, ...)
- pattern-inside: DB::table(...)->find($ID, $COLUMNS)
- pattern-inside: DB::table(...)->paginate($PERPAGE, $COLUMNS, ...)
- pattern-inside: DB::table(...)->simplePaginate($PERPAGE, $COLUMNS, ...)
- pattern-inside: DB::table(...)->cursorPaginate($PERPAGE, $COLUMNS, ...)
- pattern-inside: DB::table(...)->getCountForPagination($COLUMNS)
- pattern-inside: DB::table(...)->aggregate($FUNCTION, $COLUMNS)
- pattern-inside: DB::table(...)->numericAggregate($FUNCTION, $COLUMNS)
- pattern-inside: DB::table(...)->insertUsing($COLUMNS, ...)
- pattern-inside: DB::table(...)->select($COLUMNS)
- pattern-inside: DB::table(...)->get($COLUMNS)
- pattern-inside: DB::table(...)->count($COLUMNS)
- patterns:
- pattern: $COLUMN
- pattern-either:
- pattern-inside: DB::table(...)->whereIn($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereIn($COLUMN, ...)
- pattern-inside: DB::table(...)->whereNotIn($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereNotIn($COLUMN, ...)
- pattern-inside: DB::table(...)->whereIntegerInRaw($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereIntegerInRaw($COLUMN, ...)
- pattern-inside: DB::table(...)->whereIntegerNotInRaw($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereIntegerNotInRaw($COLUMN, ...)
- pattern-inside: DB::table(...)->whereBetweenColumns($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereBetween($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereBetweenColumns($COLUMN, ...)
- pattern-inside: DB::table(...)->whereNotBetween($COLUMN, ...)
- pattern-inside: DB::table(...)->whereNotBetweenColumns($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereNotBetween($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereNotBetweenColumns($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereNotNull($COLUMN)
- pattern-inside: DB::table(...)->whereDate($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereDate($COLUMN, ...)
- pattern-inside: DB::table(...)->whereTime($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereTime($COLUMN, ...)
- pattern-inside: DB::table(...)->whereDay($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereDay($COLUMN, ...)
- pattern-inside: DB::table(...)->whereMonth($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereMonth($COLUMN, ...)
- pattern-inside: DB::table(...)->whereYear($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereYear($COLUMN, ...)
- pattern-inside: DB::table(...)->whereJsonContains($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereJsonContains($COLUMN, ...)
- pattern-inside: DB::table(...)->whereJsonDoesntContain($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereJsonDoesntContain($COLUMN, ...)
- pattern-inside: DB::table(...)->whereJsonLength($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereJsonLength($COLUMN, ...)
- pattern-inside: DB::table(...)->having($COLUMN, ...)
- pattern-inside: DB::table(...)->orHaving($COLUMN, ...)
- pattern-inside: DB::table(...)->havingBetween($COLUMN, ...)
- pattern-inside: DB::table(...)->orderBy($COLUMN, ...)
- pattern-inside: DB::table(...)->orderByDesc($COLUMN)
- pattern-inside: DB::table(...)->latest($COLUMN)
- pattern-inside: DB::table(...)->oldest($COLUMN)
- pattern-inside: DB::table(...)->forPageBeforeId($PERPAGE, $LASTID, $COLUMN)
- pattern-inside: DB::table(...)->forPageAfterId($PERPAGE, $LASTID, $COLUMN)
- pattern-inside: DB::table(...)->value($COLUMN)
- pattern-inside: DB::table(...)->pluck($COLUMN, ...)
- pattern-inside: DB::table(...)->implode($COLUMN, ...)
- pattern-inside: DB::table(...)->min($COLUMN)
- pattern-inside: DB::table(...)->max($COLUMN)
- pattern-inside: DB::table(...)->sum($COLUMN)
- pattern-inside: DB::table(...)->avg($COLUMN)
- pattern-inside: DB::table(...)->average($COLUMN)
- pattern-inside: DB::table(...)->increment($COLUMN, ...)
- pattern-inside: DB::table(...)->decrement($COLUMN, ...)
- pattern-inside: DB::table(...)->where($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhere($COLUMN, ...)
- pattern-inside: DB::table(...)->addSelect($COLUMN)
- patterns:
- pattern: $QUERY
- pattern-inside: DB::unprepared($QUERY)
- id: trailofbits.python.automatic-memory-pinning.automatic-memory-pinning
message: If possible, it is better to rely on automatic pinning in PyTorch to avoid
undefined behavior and for efficiency
languages:
- python
severity: WARNING
metadata:
category: security
cwe: 'CWE-676: Use of Potentially Dangerous Function'
subcategory:
- audit
confidence: HIGH
likelihood: LOW
impact: LOW
technology:
- pytorch
description: '`PyTorch` memory not automatically pinned'
references:
- https://pytorch.org/docs/stable/data.html#memory-pinning
license: AGPL-3.0 license
vulnerability_class:
- Dangerous Method or Function
source: https://semgrep.dev/r/trailofbits.python.automatic-memory-pinning.automatic-memory-pinning
shortlink: https://sg.run/jz5N
semgrep.dev:
rule:
r_id: 17165
rv_id: 833289
rule_id: WAUN1Z
version_id: gETy20E
url: https://semgrep.dev/playground/r/gETy20E/trailofbits.python.automatic-memory-pinning.automatic-memory-pinning
origin: community
pattern-either:
- patterns:
- pattern: torch.utils.data.DataLoader(...)
- pattern-not: torch.utils.data.DataLoader(..., pin_memory=$VALUE, ...)
- pattern: torch.utils.data.DataLoader(..., pin_memory=False, ...)
- id: trailofbits.python.lxml-in-pandas.lxml-in-pandas
message: Found usage of the `$FLAVOR` library, which is vulnerable to attacks such
as XML external entity (XXE) attacks
languages:
- python
severity: ERROR
metadata:
category: security
cwe: 'CWE-611: Improper Restriction of XML External Entity Reference'
subcategory:
- vuln
confidence: HIGH
likelihood: MEDIUM
impact: MEDIUM
technology:
- pandas
description: Potential XXE attacks from loading `lxml` in pandas
references:
- https://lxml.de/FAQ.html
license: AGPL-3.0 license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/trailofbits.python.lxml-in-pandas.lxml-in-pandas
shortlink: https://sg.run/1z1G
semgrep.dev:
rule:
r_id: 17166
rv_id: 833290
rule_id: 0oUrdJ
version_id: QkTkr22
url: https://semgrep.dev/playground/r/QkTkr22/trailofbits.python.lxml-in-pandas.lxml-in-pandas
origin: community
pattern-either:
- patterns:
- pattern: pandas.read_html($IO)
- pattern-not: pandas.read_html(**$KWARGS)
- patterns:
- metavariable-pattern:
metavariable: $FLAVOR
patterns:
- pattern: '...'
- pattern-not: |
"bs4"
- pattern-not: |
"html5lib"
- pattern-either:
- pattern: pandas.read_html(..., flavor=$FLAVOR, ...)
- patterns:
- pattern-inside: |
$KWARGS = {..., "flavor": $FLAVOR, ...}
...
- pattern: |
pandas.read_html(**$KWARGS)
- id: trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules
message: Usage of NumPy library inside PyTorch `$MODULE` module was found. Avoid
mixing these libraries for efficiency and proper ONNX loading
languages:
- python
severity: WARNING
metadata:
category: performance
subcategory:
- audit
confidence: MEDIUM
technology:
- pytorch
- numpy
description: Uses of `NumPy` functions inside `PyTorch` modules
references:
- https://tanelp.github.io/posts/a-bug-that-plagues-thousands-of-open-source-ml-projects
license: AGPL-3.0 license
source: https://semgrep.dev/r/trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules
shortlink: https://sg.run/9vxr
semgrep.dev:
rule:
r_id: 17167
rv_id: 833295
rule_id: KxU507
version_id: 5PTyDEK
url: https://semgrep.dev/playground/r/5PTyDEK/trailofbits.python.numpy-in-pytorch-modules.numpy-in-pytorch-modules
origin: community
patterns:
- pattern-either:
- pattern: numpy.$FN(...)
- pattern: numpy. ... .$FN(...)
- pattern-inside: |
class $MODULE(torch.nn.Module):
...
- id: trailofbits.python.pickles-in-numpy.pickles-in-numpy
message: Functions reliant on pickle can result in arbitrary code execution. Consider
using fickling or switching to a safer serialization method
languages:
- python
severity: ERROR
metadata:
category: security
cwe: 'CWE-502: Deserialization of Untrusted Data'
subcategory:
- vuln
confidence: MEDIUM
likelihood: MEDIUM
impact: HIGH
technology:
- numpy
description: Potential arbitrary code execution from `NumPy` functions reliant
on pickling
references:
- https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/
license: AGPL-3.0 license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/trailofbits.python.pickles-in-numpy.pickles-in-numpy
shortlink: https://sg.run/ryKe
semgrep.dev:
rule:
r_id: 17169
rv_id: 833301
rule_id: lBUWjy
version_id: WrTdpJ9
url: https://semgrep.dev/playground/r/WrTdpJ9/trailofbits.python.pickles-in-numpy.pickles-in-numpy
origin: community
patterns:
- pattern: numpy.load(..., allow_pickle=$VALUE, ...)
- pattern-not: numpy.load("...", ...)
- pattern-not: numpy.load(..., file="...", ...)
- metavariable-pattern:
metavariable: $VALUE
patterns:
- pattern-not: |
False
- pattern-not: |
[]
- pattern-not: |
None
- pattern-not: |
""
- id: trailofbits.python.pickles-in-pandas.pickles-in-pandas
message: Functions reliant on pickle can result in arbitrary code execution. Consider
using fickling or switching to a safer serialization method
languages:
- python
severity: ERROR
metadata:
category: security
cwe: 'CWE-502: Deserialization of Untrusted Data'
subcategory:
- vuln
confidence: MEDIUM
likelihood: MEDIUM
impact: HIGH
technology:
- pandas
description: Potential arbitrary code execution from `Pandas` functions reliant
on pickling
references:
- https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/
license: AGPL-3.0 license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/trailofbits.python.pickles-in-pandas.pickles-in-pandas
shortlink: https://sg.run/bXQW
semgrep.dev:
rule:
r_id: 17170
rv_id: 833302
rule_id: PeU06j
version_id: 0bTwbqN
url: https://semgrep.dev/playground/r/0bTwbqN/trailofbits.python.pickles-in-pandas.pickles-in-pandas
origin: community
patterns:
- pattern-either:
- pattern: pandas.read_pickle(...)
- pattern: pandas.to_pickle(...)
- patterns:
- pattern-inside: |
import pandas
...
- pattern: $SMTH.to_pickle(...)
- pattern-not: pandas.read_pickle("...")
- pattern-not: pandas.to_pickle(..., "...")
- pattern-not: $SMTH.to_pickle("...")
- id: trailofbits.python.pickles-in-pytorch.pickles-in-pytorch
message: Functions reliant on pickle can result in arbitrary code execution. Consider
loading from `state_dict`, using fickling, or switching to a safer serialization
method like ONNX
languages:
- python
severity: ERROR
metadata:
category: security
cwe: 'CWE-502: Deserialization of Untrusted Data'
subcategory:
- vuln
confidence: MEDIUM
likelihood: MEDIUM
impact: HIGH
technology:
- pytorch
description: Potential arbitrary code execution from `PyTorch` functions reliant
on pickling
references:
- https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/
license: AGPL-3.0 license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/trailofbits.python.pickles-in-pytorch.pickles-in-pytorch
shortlink: https://sg.run/NwQy
semgrep.dev:
rule:
r_id: 17171
rv_id: 833304
rule_id: JDU6WD
version_id: qkTQnJ3
url: https://semgrep.dev/playground/r/qkTQnJ3/trailofbits.python.pickles-in-pytorch.pickles-in-pytorch
origin: community
patterns:
- pattern-either:
- pattern: torch.save(...)
- pattern: torch.load(...)
- pattern-not: torch.load("...")
- pattern-not: torch.save(..., "...")
- pattern-not: torch.save($M.state_dict(), ...)
- pattern-not-inside: $M.load_state_dict(...)
- pattern-not:
patterns:
- pattern: torch.save($STATE_DICT, ...)
- pattern-inside: |
$STATE_DICT = $M.state_dict()
...
- id: trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable
message: Variable `$X` is likely modified and later used on error. In some cases
this could result in panics due to a nil dereference
languages:
- go
severity: WARNING
metadata:
category: security
cwe: 'CWE-665: Improper Initialization'
subcategory:
- audit
confidence: HIGH
likelihood: MEDIUM
impact: MEDIUM
technology:
- --no-technology--
description: Possible unintentional assignment when an error occurs
references:
- https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/
license: AGPL-3.0 license
vulnerability_class:
- Other
source: https://semgrep.dev/r/trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable
shortlink: https://sg.run/WWQ2
semgrep.dev:
rule:
r_id: 17197
rv_id: 833265
rule_id: kxU6Xb
version_id: zyTWJNZ
url: https://semgrep.dev/playground/r/zyTWJNZ/trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable
origin: community
patterns:
- pattern: |
..., $X, ..., $ERR = ...
if $ERR != nil {
...
<... $X.$Y ...>
}
- pattern-not: |
..., $X, ..., $ERR = ...
if $ERR != nil {
...
$X, ... = ...
...
<... $X.$Y ...>
}
- pattern-not: |
..., $X, ..., $ERR = ...
if $ERR != nil {
...
$X = ...
...
<... $X.$Y ...>
}
- pattern-not: |
..., $X, ..., $ERR = ...
if $ERR != nil {
...
if $X != nil {
<... $X.$Y ...>
}
...
}
- pattern-not: |
..., $X, ..., $ERR := ...
if $ERR != nil {
...
if $X != nil && <... $X.$Y ...> {
...
}
...
}
- id: trailofbits.go.iterate-over-empty-map.iterate-over-empty-map
message: Iteration over a possibly empty map `$C`. This is likely a bug or redundant
code
languages:
- go
severity: WARNING
metadata:
category: security
cwe: 'CWE-665: Improper Initialization'
subcategory:
- audit
confidence: MEDIUM
likelihood: LOW
impact: LOW
technology:
- --no-technology--
description: Probably redundant iteration over an empty map
references:
- https://blog.trailofbits.com/2019/11/07/attacking-go-vr-ttps/
license: AGPL-3.0 license
vulnerability_class:
- Other
source: https://semgrep.dev/r/trailofbits.go.iterate-over-empty-map.iterate-over-empty-map
shortlink: https://sg.run/08jj
semgrep.dev:
rule:
r_id: 17198
rv_id: 1039527
rule_id: wdUlww
version_id: ExTNqnL
url: https://semgrep.dev/playground/r/ExTNqnL/trailofbits.go.iterate-over-empty-map.iterate-over-empty-map
origin: community
patterns:
- pattern: |
$C = make(map[$T1] $T2)
...
for $K := range $C { ... }
- pattern-not: |
$C = make(map[$T1] $T2, ...)
...
$C[$X] = $V
...
for $K := range $C { ... }
- pattern-not: |
$C = make(map[$T1] $T2, ...)
...
$C[$X]++
...
for $K := range $C { ... }
- pattern-not: |
$C = make(map[$T1] $T2, ...)
...
$C[$X]--
...
for $K := range $C { ... }
- pattern-not: |
$C = make(map[$T1] $T2, ...)
...
$CODEC.Unmarshal($BYTES, &$C)
...
for $K := range $C { ... }
- id: csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug
message: ASP.NET applications built with `debug` set to true in production may leak
debug information to attackers. Debug mode also affects performance and reliability.
Set `debug` to `false` or remove it from `<compilation ... />`
severity: WARNING
metadata:
likelihood: LOW
impact: LOW
confidence: LOW
category: security
cwe:
- 'CWE-11: ASP.NET Misconfiguration: Creating Debug Binary'
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
references:
- https://web.archive.org/web/20190919105353/https://blogs.msdn.microsoft.com/prashant_upadhyay/2011/07/14/why-debugfalse-in-asp-net-applications-in-production-environment/
- https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx
subcategory:
- audit
technology:
- .net
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Active Debug Code
source: https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug
shortlink: https://sg.run/yPWx
semgrep.dev:
rule:
r_id: 17324
rv_id: 1262620
rule_id: 0oUrvj
version_id: jQTn53E
url: https://semgrep.dev/playground/r/jQTn53E/csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug
origin: community
languages:
- generic
paths:
include:
- '*web.config*'
patterns:
- pattern: |
<compilation ... debug = "true" ... />
- pattern-inside: |
<system.web>
...
</system.web>
- id: java.lang.security.audit.crypto.use-of-md5.use-of-md5
message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision
resistant and is therefore not suitable as a cryptographic signature. Use HMAC
instead.
languages:
- java
severity: WARNING
metadata:
functional-categories:
- crypto::search::hash-algorithm::java.security
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-328: Use of Weak Hash'
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_MD5
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5.use-of-md5
shortlink: https://sg.run/ryJn
semgrep.dev:
rule:
r_id: 17325
rv_id: 1263013
rule_id: KxU5lW
version_id: 0bTKzGX
url: https://semgrep.dev/playground/r/0bTKzGX/java.lang.security.audit.crypto.use-of-md5.use-of-md5
origin: community
patterns:
- pattern: |
java.security.MessageDigest.getInstance($ALGO, ...);
- metavariable-regex:
metavariable: $ALGO
regex: (?i)(.MD5.)
- focus-metavariable: $ALGO
fix: |
"SHA-512"
- id: java.lang.security.audit.crypto.use-of-sha1.use-of-sha1
message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not
collision resistant and is therefore not suitable as a cryptographic signature.
Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function
applications.
languages:
- java
severity: WARNING
metadata:
functional-categories:
- crypto::search::hash-algorithm::javax.crypto
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-328: Use of Weak Hash'
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_SHA1
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.5 Insecure Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1
shortlink: https://sg.run/bXNp
semgrep.dev:
rule:
r_id: 17326
rv_id: 1263016
rule_id: qNUWNn
version_id: l4TJRpL
url: https://semgrep.dev/playground/r/l4TJRpL/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1
origin: community
pattern-either:
- patterns:
- pattern: |
java.security.MessageDigest.getInstance("$ALGO", ...);
- metavariable-regex:
metavariable: $ALGO
regex: (SHA1|SHA-1)
- pattern: |
$DU.getSha1Digest().digest(...)
- id: java.lang.security.audit.crypto.weak-random.weak-random
message: Detected use of the functions `Math.random()` or `java.util.Random()`.
These are both not cryptographically strong random number generators (RNGs). If
you are using these RNGs to create passwords or secret tokens, use `java.security.SecureRandom`
instead.
languages:
- java
severity: WARNING
metadata:
functional-categories:
- crypto::search::randomness::java.security
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-330: Use of Insufficiently Random Values'
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.weak-random.weak-random
shortlink: https://sg.run/NwBp
semgrep.dev:
rule:
r_id: 17327
rv_id: 1263018
rule_id: lBUW5D
version_id: 6xT29RK
url: https://semgrep.dev/playground/r/6xT29RK/java.lang.security.audit.crypto.weak-random.weak-random
origin: community
pattern-either:
- pattern: |
new java.util.Random(...).$FUNC(...)
- pattern: |
java.lang.Math.random(...)
- id: php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate
patterns:
- pattern: openssl_decrypt(...);
- pattern-not-inside: |
$DECRYPTED_STRING = openssl_decrypt(...);
...
if($DECRYPTED_STRING === false){
...
}
- pattern-not-inside: |
$DECRYPTED_STRING = openssl_decrypt(...);
...
if($DECRYPTED_STRING == false){
...
}
- pattern-not-inside: |
$DECRYPTED_STRING = openssl_decrypt(...);
...
if(false === $DECRYPTED_STRING){
...
}
- pattern-not-inside: |
$DECRYPTED_STRING = openssl_decrypt(...);
...
if(false == $DECRYPTED_STRING){
...
}
- pattern-not-inside: |
$DECRYPTED_STRING = openssl_decrypt(...);
...
assertTrue(false !== $DECRYPTED_STRING,...);
- pattern-not-inside: |
$DECRYPTED_STRING = openssl_decrypt(...);
...
assertTrue($DECRYPTED_STRING !== false,...);
- pattern-not-inside: |
$DECRYPTED_STRING = openssl_decrypt(...);
...
$REFERENCE::assertTrue(false !== $DECRYPTED_STRING,...);
- pattern-not-inside: |
$DECRYPTED_STRING = openssl_decrypt(...);
...
$REFERENCE::assertTrue($DECRYPTED_STRING !== false,...);
- pattern-not-inside: |
$DECRYPTED_STRING = openssl_decrypt(...);
...
assert(false !== $DECRYPTED_STRING,...);
- pattern-not-inside: |
$DECRYPTED_STRING = openssl_decrypt(...);
...
assert($DECRYPTED_STRING !== false,...);
message: The function `openssl_decrypt` returns either a string of the decrypted
data on success or `false` on failure. If the failure case is not handled, this
could lead to undefined behavior in your application. Please handle the case where
`openssl_decrypt` returns `false`.
languages:
- php
severity: WARNING
metadata:
references:
- https://www.php.net/manual/en/function.openssl-decrypt.php
cwe:
- 'CWE-252: Unchecked Return Value'
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
technology:
- php
- openssl
category: security
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate
shortlink: https://sg.run/kzn7
semgrep.dev:
rule:
r_id: 17328
rv_id: 1263274
rule_id: YGUAoe
version_id: rxTAKXz
url: https://semgrep.dev/playground/r/rxTAKXz/php.lang.security.audit.openssl-decrypt-validate.openssl-decrypt-validate
origin: community
- id: scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run
patterns:
- pattern-either:
- pattern: $X.!
- pattern: $X.!!
- pattern: $X.lazyLines
- pattern-inside: |
import sys.process
...
- pattern-not: |
"...".!
- pattern-not: |
"...".!!
- pattern-not: |
"...".lazyLines
- pattern-not: |
Seq(...).!
- pattern-not: |
Seq(...).!!
- pattern-not: |
Seq(...).lazyLines
- pattern-not-inside: |
val $X = "..."
...
- pattern-not-inside: |
val $X = Seq(...)
...
message: Found dynamic content used for the external process. This is dangerous
if arbitrary data can reach this function call because it allows a malicious actor
to execute commands. Use `Seq(...)` for dynamically generated commands.
languages:
- scala
severity: ERROR
metadata:
category: security
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
technology:
- scala
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run
shortlink: https://sg.run/wZBY
semgrep.dev:
rule:
r_id: 17329
rv_id: 1263679
rule_id: 6JUEeo
version_id: bZT53y0
url: https://semgrep.dev/playground/r/bZT53y0/scala.lang.security.audit.scala-dangerous-process-run.scala-dangerous-process-run
origin: community
- id: terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted
patterns:
- pattern: |
resource "aws_athena_workgroup" $ANYTHING {
...
configuration {
...
result_configuration {
...
}
...
}
...
}
- pattern-not-inside: |
resource "aws_athena_workgroup" $ANYTHING {
...
configuration {
...
result_configuration {
...
encryption_configuration {
...
}
...
}
...
}
...
}
message: The AWS Athena Work Group is unencrypted. The AWS KMS encryption key protects
backups in the work group. To create your own, create a aws_kms_key resource or
use the ARN string of a key in your account.
languages:
- hcl
severity: WARNING
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
cwe:
- 'CWE-311: Missing Encryption of Sensitive Data'
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted
shortlink: https://sg.run/gX7J
semgrep.dev:
rule:
r_id: 17341
rv_id: 1263699
rule_id: NbUXOA
version_id: JdTzx8e
url: https://semgrep.dev/playground/r/JdTzx8e/terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted
origin: community
- id: terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version
patterns:
- pattern: |
resource "aws_cloudfront_distribution" $ANYTHING {
...
viewer_certificate {
...
}
...
}
- pattern-not-inside: |
resource "aws_cloudfront_distribution" $ANYTHING {
...
viewer_certificate {
...
minimum_protocol_version = "TLSv1.2_2018"
...
}
...
}
- pattern-not-inside: |
resource "aws_cloudfront_distribution" $ANYTHING {
...
viewer_certificate {
...
minimum_protocol_version = "TLSv1.2_2019"
...
}
...
}
- pattern-not-inside: |
resource "aws_cloudfront_distribution" $ANYTHING {
...
viewer_certificate {
...
minimum_protocol_version = "TLSv1.2_2021"
...
}
...
}
- pattern-not-inside: |
resource "aws_cloudfront_distribution" $ANYTHING {
...
viewer_certificate {
...
minimum_protocol_version = "TLSv1.2_2025"
...
}
...
}
- pattern-not-inside: |
resource "aws_cloudfront_distribution" $ANYTHING {
...
viewer_certificate {
...
minimum_protocol_version = "TLSv1.3_2025"
...
}
...
}
message: Detected an AWS CloudFront Distribution with an insecure TLS version. TLS
versions less than 1.2 are considered insecure because they can be broken. To
fix this, set your `minimum_protocol_version` to `"TLSv1.2_2018", "TLSv1.2_2019",
"TLSv1.2_2021", "TLSv1.2_2025" or "TLSv1.3_2025"`.
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-326: Inadequate Encryption Strength'
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version
shortlink: https://sg.run/Q6o4
semgrep.dev:
rule:
r_id: 17342
rv_id: 1263700
rule_id: kxU6A8
version_id: 5PTo1bY
url: https://semgrep.dev/playground/r/5PTo1bY/terraform.aws.security.aws-cloudfront-insecure-tls.aws-insecure-cloudfront-distribution-tls-version
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk
patterns:
- pattern: |
resource "aws_cloudtrail" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_cloudtrail" $ANYTHING {
...
kms_key_id = ...
...
}
message: Ensure CloudTrail logs are encrypted at rest using KMS CMKs. CMKs gives
you control over the encryption key in terms of access and rotation.
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk
shortlink: https://sg.run/38kr
semgrep.dev:
rule:
r_id: 17343
rv_id: 946664
rule_id: wdUl2j
version_id: A8TJzbz
url: https://semgrep.dev/playground/r/A8TJzbz/terraform.aws.security.aws-cloudtrail-encrypted-with-cmk.aws-cloudtrail-encrypted-with-cmk
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention
patterns:
- pattern: |
resource "aws_cloudwatch_log_group" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_cloudwatch_log_group" $ANYTHING {
...
retention_in_days = ...
...
}
message: The AWS CloudWatch Log Group has no retention. Missing retention in log
groups can cause losing important event information.
languages:
- hcl
severity: WARNING
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
technology:
- aws
- terraform
category: security
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention
shortlink: https://sg.run/4lwl
semgrep.dev:
rule:
r_id: 17344
rv_id: 946665
rule_id: x8UGBG
version_id: BjT1N2B
url: https://semgrep.dev/playground/r/BjT1N2B/terraform.aws.security.aws-cloudwatch-log-group-no-retention.aws-cloudwatch-log-group-no-retention
origin: community
- id: terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted
patterns:
- pattern: |
resource "aws_cloudwatch_log_group" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_cloudwatch_log_group" $ANYTHING {
...
kms_key_id = ...
...
}
message: By default, AWS CloudWatch Log Group is encrypted using AWS-managed keys.
However, for added security, it's recommended to configure your own AWS KMS encryption
key to protect your log group in CloudWatch. You can either create a new aws_kms_key
resource or use the ARN of an existing key in your AWS account to do so.
languages:
- hcl
severity: WARNING
metadata:
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-732: Incorrect Permission Assignment for Critical Resource'
technology:
- aws
- terraform
category: security
references:
- https://cwe.mitre.org/data/definitions/732.html
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted
shortlink: https://sg.run/Pg6Y
semgrep.dev:
rule:
r_id: 17345
rv_id: 1263701
rule_id: OrUl0J
version_id: GxTkep4
url: https://semgrep.dev/playground/r/GxTkep4/terraform.aws.security.aws-cloudwatch-log-group-unencrypted.aws-cloudwatch-log-group-unencrypted
origin: community
- id: terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted
patterns:
- pattern: |
resource "aws_codebuild_project" $ANYTHING {
...
artifacts {
...
encryption_disabled = true
...
}
...
}
- pattern-not-inside: |
resource "aws_codebuild_project" $ANYTHING {
...
artifacts {
type = "NO_ARTIFACTS"
encryption_disabled = true
}
...
}
- pattern-not-inside: |
resource "aws_codebuild_project" $ANYTHING {
...
artifacts {
type = "NO_ARTIFACTS"
}
...
}
message: The AWS CodeBuild Project Artifacts are unencrypted. The AWS KMS encryption
key protects artifacts in the CodeBuild Projects. To create your own, create a
aws_kms_key resource or use the ARN string of a key in your account.
languages:
- hcl
severity: WARNING
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
technology:
- aws
- terraform
category: security
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted
shortlink: https://sg.run/JeWw
semgrep.dev:
rule:
r_id: 17346
rv_id: 946668
rule_id: eqUrdZ
version_id: 0bT15Wr
url: https://semgrep.dev/playground/r/0bT15Wr/terraform.aws.security.aws-codebuild-project-artifacts-unencrypted.aws-codebuild-project-artifacts-unencrypted
origin: community
- id: terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted
patterns:
- pattern: |
resource "aws_codebuild_project" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_codebuild_project" $ANYTHING {
...
encryption_key = ...
...
}
message: The AWS CodeBuild Project is unencrypted. The AWS KMS encryption key protects
projects in the CodeBuild. To create your own, create a aws_kms_key resource or
use the ARN string of a key in your account.
languages:
- hcl
severity: WARNING
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
technology:
- aws
- terraform
category: security
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted
shortlink: https://sg.run/5yxA
semgrep.dev:
rule:
r_id: 17347
rv_id: 946669
rule_id: v8U4kG
version_id: K3TJbNr
url: https://semgrep.dev/playground/r/K3TJbNr/terraform.aws.security.aws-codebuild-project-unencrypted.aws-codebuild-project-unencrypted
origin: community
- id: terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging
patterns:
- pattern: |
resource "aws_db_instance" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_db_instance" $ANYTHING {
...
enabled_cloudwatch_logs_exports = [$SOMETHING, ...]
...
}
message: Database instance has no logging. Missing logs can cause missing important
event information.
languages:
- hcl
severity: WARNING
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
cwe:
- 'CWE-311: Missing Encryption of Sensitive Data'
technology:
- aws
- terraform
category: security
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
subcategory:
- vuln
likelihood: MEDIUM
impact: LOW
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging
shortlink: https://sg.run/GyAp
semgrep.dev:
rule:
r_id: 17348
rv_id: 1263704
rule_id: d8U4RA
version_id: BjTkZ6j
url: https://semgrep.dev/playground/r/BjTkZ6j/terraform.aws.security.aws-db-instance-no-logging.aws-db-instance-no-logging
origin: community
- id: terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk
patterns:
- pattern: |
resource "aws_docdb_cluster" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_docdb_cluster" $ANYTHING {
...
kms_key_id = ...
...
}
message: Ensure DocDB is encrypted at rest using KMS CMKs. CMKs gives you control
over the encryption key in terms of access and rotation.
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk
shortlink: https://sg.run/RyzO
semgrep.dev:
rule:
r_id: 17349
rv_id: 946672
rule_id: ZqUGEp
version_id: YDTvRX2
url: https://semgrep.dev/playground/r/YDTvRX2/terraform.aws.security.aws-docdb-encrypted-with-cmk.aws-docdb-encrypted-with-cmk
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted
patterns:
- pattern: |
resource "aws_dynamodb_table" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_dynamodb_table" $ANYTHING {
...
server_side_encryption {
enabled = true
kms_key_arn = ...
}
...
}
message: By default, AWS DynamoDB Table is encrypted using AWS-managed keys. However,
for added security, it's recommended to configure your own AWS KMS encryption
key to protect your data in the DynamoDB table. You can either create a new aws_kms_key
resource or use the ARN of an existing key in your AWS account to do so.
languages:
- hcl
severity: WARNING
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-326: Inadequate Encryption Strength'
technology:
- aws
- terraform
category: security
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted
shortlink: https://sg.run/Ay4p
semgrep.dev:
rule:
r_id: 17350
rv_id: 1263707
rule_id: nJUGe2
version_id: 0bTKzj8
url: https://semgrep.dev/playground/r/0bTKzj8/terraform.aws.security.aws-dynamodb-table-unencrypted.aws-dynamodb-table-unencrypted
origin: community
- id: terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk
patterns:
- pattern: |
resource "aws_ebs_snapshot_copy" $ANYTHING {
...
encrypted = true
...
}
- pattern-not-inside: |
resource "aws_ebs_snapshot_copy" $ANYTHING {
...
encrypted = true
kms_key_id = ...
...
}
message: Ensure EBS Snapshot is encrypted at rest using KMS CMKs. CMKs gives you
control over the encryption key in terms of access and rotation.
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk
shortlink: https://sg.run/ByPW
semgrep.dev:
rule:
r_id: 17351
rv_id: 946677
rule_id: EwUqko
version_id: A8TJzb0
url: https://semgrep.dev/playground/r/A8TJzb0/terraform.aws.security.aws-ebs-snapshot-encrypted-with-cmk.aws-ebs-snapshot-encrypted-with-cmk
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted
patterns:
- pattern: |
resource "aws_ebs_encryption_by_default" $ANYTHING {
...
enabled = false
...
}
message: The AWS EBS is unencrypted. The AWS EBS encryption protects data in the
EBS.
languages:
- hcl
severity: WARNING
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
technology:
- aws
- terraform
category: security
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted
shortlink: https://sg.run/Dy5Y
semgrep.dev:
rule:
r_id: 17352
rv_id: 946678
rule_id: 7KUW7K
version_id: BjT1N2v
url: https://semgrep.dev/playground/r/BjT1N2v/terraform.aws.security.aws-ebs-unencrypted.aws-ebs-unencrypted
origin: community
- id: terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk
patterns:
- pattern: |
resource "aws_ebs_volume" $ANYTHING {
...
encrypted = true
...
}
- pattern-not-inside: |
resource "aws_ebs_volume" $ANYTHING {
...
encrypted = true
kms_key_id = ...
...
}
message: Ensure EBS Volume is encrypted at rest using KMS CMKs. CMKs gives you control
over the encryption key in terms of access and rotation.
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk
shortlink: https://sg.run/WW14
semgrep.dev:
rule:
r_id: 17353
rv_id: 946679
rule_id: L1UPY9
version_id: DkTNpzv
url: https://semgrep.dev/playground/r/DkTNpzv/terraform.aws.security.aws-ebs-volume-encrypted-with-cmk.aws-ebs-volume-encrypted-with-cmk
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip
patterns:
- pattern-either:
- pattern: |
resource "aws_instance" $ANYTHING {
...
associate_public_ip_address = true
...
}
- pattern: |
resource "aws_launch_template" $ANYTHING {
...
network_interfaces {
...
associate_public_ip_address = true
...
}
...
}
message: EC2 instances should not have a public IP address attached in order to
block public access to the instances. To fix this, set your `associate_public_ip_address`
to `"false"`.
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-1220: Insufficient Granularity of Access Control'
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip
shortlink: https://sg.run/08rv
semgrep.dev:
rule:
r_id: 17354
rv_id: 1263709
rule_id: 8GUA2n
version_id: qkTR73G
url: https://semgrep.dev/playground/r/qkTR73G/terraform.aws.security.aws-ec2-has-public-ip.aws-ec2-has-public-ip
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk
patterns:
- pattern: |
resource "aws_efs_file_system" $ANYTHING {
...
encrypted = true
...
}
- pattern-not-inside: |
resource "aws_efs_file_system" $ANYTHING {
...
encrypted = true
kms_key_id = ...
...
}
message: Ensure EFS filesystem is encrypted at rest using KMS CMKs. CMKs gives you
control over the encryption key in terms of access and rotation.
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk
shortlink: https://sg.run/Kk07
semgrep.dev:
rule:
r_id: 17355
rv_id: 946690
rule_id: gxUJ4n
version_id: 2KTYbWy
url: https://semgrep.dev/playground/r/2KTYbWy/terraform.aws.security.aws-efs-filesystem-encrypted-with-cmk.aws-efs-filesystem-encrypted-with-cmk
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled
patterns:
- pattern-either:
- pattern: |
resource "aws_elasticsearch_domain" $ANYTHING {
...
node_to_node_encryption {
...
enabled = false
...
}
...
}
- pattern: |
resource "aws_elasticsearch_domain" $ANYTHING {
...
cluster_config {
...
instance_count = $COUNT
...
}
}
- pattern-not-inside: |
resource "aws_elasticsearch_domain" $ANYTHING {
...
cluster_config {
...
instance_count = $COUNT
...
}
node_to_node_encryption {
...
enabled = true
...
}
}
- metavariable-comparison:
metavariable: $COUNT
comparison: $COUNT > 1
message: "Ensure all Elasticsearch has node-to-node encryption enabled.\t"
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-326: Inadequate Encryption Strength'
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled
shortlink: https://sg.run/lp3y
semgrep.dev:
rule:
r_id: 17357
rv_id: 1263719
rule_id: 3qU6J7
version_id: WrTqK0v
url: https://semgrep.dev/playground/r/WrTqK0v/terraform.aws.security.aws-elasticsearch-nodetonode-encryption.aws-elasticsearch-nodetonode-encryption-not-enabled
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled
patterns:
- pattern-either:
- pattern: |
resource "aws_lb" $ANYTHING {
...
}
- pattern: |
resource "aws_alb" $ANYTHING {
...
}
- pattern-not-inside: |
resource $ANYLB $ANYTHING {
...
access_logs {
...
enabled = true
...
}
...
}
- pattern-not-inside: "resource $ANYLB $ANYTHING {\n ...\n subnet_mapping {\n
\ ...\n }\n ...\n} \n"
message: ELB has no logging. Missing logs can cause missing important event information.
languages:
- hcl
severity: WARNING
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-326: Inadequate Encryption Strength'
technology:
- aws
- terraform
category: security
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled
shortlink: https://sg.run/Yrye
semgrep.dev:
rule:
r_id: 17358
rv_id: 1263720
rule_id: 4bUg3J
version_id: 0bTKzj4
url: https://semgrep.dev/playground/r/0bTKzj4/terraform.aws.security.aws-elb-access-logs-not-enabled.aws-elb-access-logs-not-enabled
origin: community
- id: terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk
patterns:
- pattern-inside: |
resource "aws_emr_security_configuration" $ANYTHING {
...
}
- pattern: configuration = "$STATEMENT"
- metavariable-pattern:
metavariable: $STATEMENT
language: json
patterns:
- pattern-not-inside: |
"AwsKmsKey": ...
message: Ensure EMR is encrypted at rest using KMS CMKs. CMKs gives you control
over the encryption key in terms of access and rotation.
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk
shortlink: https://sg.run/6gOo
semgrep.dev:
rule:
r_id: 17359
rv_id: 946694
rule_id: PeU0L7
version_id: 9lTy1D0
url: https://semgrep.dev/playground/r/9lTy1D0/terraform.aws.security.aws-emr-encrypted-with-cmk.aws-emr-encrypted-with-cmk
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk
patterns:
- pattern: |
resource "aws_fsx_lustre_file_system" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_fsx_lustre_file_system" $ANYTHING {
...
kms_key_id = ...
...
}
- pattern-regex: (^aws_kms_key\.(.*))
message: Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs
gives you control over the encryption key in terms of access and rotation.
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk
shortlink: https://sg.run/oNG9
semgrep.dev:
rule:
r_id: 17360
rv_id: 1263721
rule_id: JDU6gw
version_id: K3TKk1l
url: https://semgrep.dev/playground/r/K3TKk1l/terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk
patterns:
- pattern: |
resource "aws_fsx_lustre_file_system" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_fsx_lustre_file_system" $ANYTHING {
...
kms_key_id = ...
...
}
message: Ensure FSX Lustre file system is encrypted at rest using KMS CMKs. CMKs
gives you control over the encryption key in terms of access and rotation.
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
cwe:
- 'CWE-311: Missing Encryption of Sensitive Data'
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk
shortlink: https://sg.run/zJ6G
semgrep.dev:
rule:
r_id: 17361
rv_id: 1263722
rule_id: 5rUp50
version_id: qkTR73q
url: https://semgrep.dev/playground/r/qkTR73q/terraform.aws.security.aws-fsx-lustre-filesystem-encrypted-with-cmk.aws-fsx-lustre-filesystem-encrypted-with-cmk
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk
patterns:
- pattern: |
resource "aws_fsx_ontap_file_system" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_fsx_ontap_file_system" $ANYTHING {
...
kms_key_id = ...
...
}
message: Ensure FSX ONTAP file system is encrypted at rest using KMS CMKs. CMKs
gives you control over the encryption key in terms of access and rotation.
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk
shortlink: https://sg.run/pyRg
semgrep.dev:
rule:
r_id: 17362
rv_id: 946697
rule_id: GdUzwK
version_id: bZTXw0d
url: https://semgrep.dev/playground/r/bZTXw0d/terraform.aws.security.aws-fsx-ontapfs-encrypted-with-cmk.aws-fsx-ontapfs-encrypted-with-cmk
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk
patterns:
- pattern: |
resource "aws_fsx_windows_file_system" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_fsx_windows_file_system" $ANYTHING {
...
kms_key_id = ...
...
}
message: Ensure FSX Windows file system is encrypted at rest using KMS CMKs. CMKs
gives you control over the encryption key in terms of access and rotation.
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk
shortlink: https://sg.run/2pN0
semgrep.dev:
rule:
r_id: 17363
rv_id: 946698
rule_id: ReUqv6
version_id: NdTqknl
url: https://semgrep.dev/playground/r/NdTqknl/terraform.aws.security.aws-fsx-windows-encrypted-with-cmk.aws-fsx-windows-encrypted-with-cmk
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal
patterns:
- pattern-inside: |
resource "aws_glacier_vault" $ANYTHING {
...
}
- pattern: access_policy = "$STATEMENT"
- metavariable-pattern:
metavariable: $STATEMENT
language: json
patterns:
- pattern-inside: |
{..., "Effect": "Allow", ...}
- pattern-either:
- pattern: |
"Principal": "*"
- pattern: |
"Principal": {..., "AWS": "*", ...}
- pattern-inside: |
"Principal": {..., "AWS": ..., ...}
- pattern-regex: |
(^\"arn:aws:iam::\*:(.*)\"$)
message: 'Detected wildcard access granted to Glacier Vault. This means anyone within
your AWS account ID can perform actions on Glacier resources. Instead, limit to
a specific identity in your account, like this: `arn:aws:iam::<account_id>:<identity>`.'
metadata:
category: security
technology:
- aws
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe:
- 'CWE-732: Incorrect Permission Assignment for Critical Resource'
references:
- https://cwe.mitre.org/data/definitions/732.html
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal
shortlink: https://sg.run/XN9K
semgrep.dev:
rule:
r_id: 17364
rv_id: 1263723
rule_id: AbUeYK
version_id: l4TJRGB
url: https://semgrep.dev/playground/r/l4TJRGB/terraform.aws.security.aws-glacier-vault-any-principal.aws-glacier-vault-any-principal
origin: community
languages:
- hcl
severity: ERROR
- id: terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin
patterns:
- pattern-inside: |
resource "aws_ssoadmin_permission_set_inline_policy" $ANYTHING {
...
}
- pattern: inline_policy = "$STATEMENT"
- metavariable-pattern:
metavariable: $STATEMENT
language: json
patterns:
- pattern-not-inside: |
{..., "Effect": "Deny", ...}
- pattern-either:
- pattern: |
{..., "Action": [..., "*", ...], "Resource": [..., "*", ...], ...}
- pattern: |
{..., "Action": "*", "Resource": "*", ...}
- pattern: |
{..., "Action": "*", "Resource": [...], ...}
- pattern: |
{..., "Action": [...], "Resource": "*", ...}
message: Detected admin access granted in your policy. This means anyone with this
policy can perform administrative actions. Instead, limit actions and resources
to what you need according to least privilege.
metadata:
category: security
technology:
- aws
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe:
- 'CWE-732: Incorrect Permission Assignment for Critical Resource'
references:
- https://cwe.mitre.org/data/definitions/732.html
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin
shortlink: https://sg.run/jzgY
semgrep.dev:
rule:
r_id: 17365
rv_id: 1263724
rule_id: BYUzY5
version_id: YDTZe9q
url: https://semgrep.dev/playground/r/YDTZe9q/terraform.aws.security.aws-iam-admin-policy-ssoadmin.aws-iam-admin-policy-ssoadmin
origin: community
languages:
- hcl
severity: ERROR
- id: terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy
patterns:
- pattern-inside: |
resource "aws_iam_policy" $ANYTHING {
...
}
- pattern: policy = "$STATEMENT"
- metavariable-pattern:
metavariable: $STATEMENT
language: json
patterns:
- pattern-not-inside: |
{..., "Effect": "Deny", ...}
- pattern-either:
- pattern: |
{..., "Action": [..., "*", ...], "Resource": [..., "*", ...], ...}
- pattern: |
{..., "Action": "*", "Resource": "*", ...}
- pattern: |
{..., "Action": "*", "Resource": [...], ...}
- pattern: |
{..., "Action": [...], "Resource": "*", ...}
message: Detected admin access granted in your policy. This means anyone with this
policy can perform administrative actions. Instead, limit actions and resources
to what you need according to least privilege.
metadata:
category: security
technology:
- aws
- terraform
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe:
- 'CWE-732: Incorrect Permission Assignment for Critical Resource'
references:
- https://cwe.mitre.org/data/definitions/732.html
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy
shortlink: https://sg.run/1zbw
semgrep.dev:
rule:
r_id: 17366
rv_id: 1263725
rule_id: DbUx8l
version_id: 6xT29Pv
url: https://semgrep.dev/playground/r/6xT29Pv/terraform.aws.security.aws-iam-admin-policy.aws-iam-admin-policy
origin: community
languages:
- hcl
severity: ERROR
- id: terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk
patterns:
- pattern: |
resource "aws_imagebuilder_component" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_imagebuilder_component" $ANYTHING {
...
kms_key_id = ...
...
}
message: Ensure ImageBuilder component is encrypted at rest using KMS CMKs. CMKs
gives you control over the encryption key in terms of access and rotation.
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk
shortlink: https://sg.run/9vdY
semgrep.dev:
rule:
r_id: 17367
rv_id: 946702
rule_id: WAUNxL
version_id: O9TX3o0
url: https://semgrep.dev/playground/r/O9TX3o0/terraform.aws.security.aws-imagebuilder-component-encrypted-with-cmk.aws-imagebuilder-component-encrypted-with-cmk
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration
patterns:
- pattern: |
resource "aws_redshift_parameter_group" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_redshift_parameter_group" $ANYTHING {
...
parameter {
name = "require_ssl"
value = "true"
}
...
}
- pattern-not-inside: |
resource "aws_redshift_parameter_group" $ANYTHING {
...
parameter {
name = "require_ssl"
value = true
}
...
}
message: Detected an AWS Redshift configuration with a SSL disabled. To fix this,
set your `require_ssl` to `"true"`.
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-326: Inadequate Encryption Strength'
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration
shortlink: https://sg.run/yPYx
semgrep.dev:
rule:
r_id: 17368
rv_id: 1263727
rule_id: 0oUrOj
version_id: zyTb27A
url: https://semgrep.dev/playground/r/zyTb27A/terraform.aws.security.aws-insecure-redshift-ssl-configuration.aws-insecure-redshift-ssl-configuration
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk
patterns:
- pattern: |
resource "aws_kinesis_stream" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_kinesis_stream" $ANYTHING {
...
kms_key_id = ...
...
}
message: Ensure Kinesis stream is encrypted at rest using KMS CMKs. CMKs gives you
control over the encryption key in terms of access and rotation.
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk
shortlink: https://sg.run/ryBn
semgrep.dev:
rule:
r_id: 17369
rv_id: 946705
rule_id: KxU5yW
version_id: d6TPzwr
url: https://semgrep.dev/playground/r/d6TPzwr/terraform.aws.security.aws-kinesis-stream-encrypted-with-cmk.aws-kinesis-stream-encrypted-with-cmk
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk
patterns:
- pattern: |
resource "aws_kinesis_video_stream" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_kinesis_video_stream" $ANYTHING {
...
kms_key_id = ...
...
}
message: Ensure Kinesis video stream is encrypted at rest using KMS CMKs. CMKs gives
you control over the encryption key in terms of access and rotation.
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk
shortlink: https://sg.run/bXvp
semgrep.dev:
rule:
r_id: 17370
rv_id: 946707
rule_id: qNUWqn
version_id: nWTpYW8
url: https://semgrep.dev/playground/r/nWTpYW8/terraform.aws.security.aws-kinesis-video-stream-encrypted-with-cmk.aws-kinesis-video-stream-encrypted-with-cmk
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal
patterns:
- pattern-inside: |
resource "aws_kms_key" $ANYTHING {
...
}
- pattern: policy = "$STATEMENT"
- metavariable-pattern:
metavariable: $STATEMENT
language: json
patterns:
- pattern-not-inside: |
{..., "Effect": "Deny", ...}
- pattern-either:
- pattern: |
{..., "Principal": "*", "Action": "kms:*", "Resource": "*", ...}
- pattern: |
{..., "Principal": [..., "*", ...], "Action": "kms:*", "Resource": "*", ...}
- pattern: |
{..., "Principal": { "AWS": "*" }, "Action": "kms:*", "Resource": "*", ...}
- pattern: |
{..., "Principal": { "AWS": [..., "*", ...] }, "Action": "kms:*", "Resource": "*", ...}
message: Detected wildcard access granted in your KMS key. This means anyone with
this policy can perform administrative actions over the keys. Instead, limit principals,
actions and resources to what you need according to least privilege.
metadata:
category: security
technology:
- aws
- terraform
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe:
- 'CWE-732: Incorrect Permission Assignment for Critical Resource'
references:
- https://cwe.mitre.org/data/definitions/732.html
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal
shortlink: https://sg.run/Nwlp
semgrep.dev:
rule:
r_id: 17371
rv_id: 1263729
rule_id: lBUWPD
version_id: 2KTv2J4
url: https://semgrep.dev/playground/r/2KTv2J4/terraform.aws.security.aws-kms-key-wildcard-principal.aws-kms-key-wildcard-principal
origin: community
languages:
- hcl
severity: ERROR
- id: terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation
patterns:
- pattern-either:
- pattern: |
resource "aws_kms_key" $ANYTHING {
...
enable_key_rotation = false
...
}
- pattern: |
resource "aws_kms_key" $ANYTHING {
...
customer_master_key_spec = "SYMMETRIC_DEFAULT"
enable_key_rotation = false
...
}
- pattern: |
resource "aws_kms_key" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_kms_key" $ANYTHING {
...
enable_key_rotation = true
...
}
- pattern-not-inside: |
resource "aws_kms_key" $ANYTHING {
...
customer_master_key_spec = "RSA_2096"
...
}
message: The AWS KMS has no rotation. Missing rotation can cause leaked key to be
used by attackers. To fix this, set a `enable_key_rotation`.
languages:
- hcl
severity: WARNING
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-326: Inadequate Encryption Strength'
technology:
- aws
- terraform
category: security
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation
shortlink: https://sg.run/kz47
semgrep.dev:
rule:
r_id: 17372
rv_id: 1263730
rule_id: PeU0L3
version_id: X0Tzy67
url: https://semgrep.dev/playground/r/X0Tzy67/terraform.aws.security.aws-kms-no-rotation.aws-kms-no-rotation
origin: community
- id: terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials
patterns:
- pattern-inside: |
resource "$ANYTING" $ANYTHING {
...
environment {
variables = {
...
}
}
...
}
- pattern-either:
- pattern-inside: |
AWS_ACCESS_KEY_ID = "$Y"
- pattern-regex: |
(?<![A-Z0-9])[A-Z0-9]{20}(?![A-Z0-9])
- pattern-inside: |
AWS_SECRET_ACCESS_KEY = "$Y"
- pattern-regex: |
(?<![A-Za-z0-9/+=])[A-Za-z0-9/+=]{40}(?![A-Za-z0-9/+=])
- focus-metavariable: $Y
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
metadata:
category: security
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-326: Inadequate Encryption Strength'
technology:
- aws
- terraform
- secrets
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials
shortlink: https://sg.run/wZqY
semgrep.dev:
rule:
r_id: 17373
rv_id: 1263731
rule_id: JDU6gj
version_id: jQTn573
url: https://semgrep.dev/playground/r/jQTn573/terraform.aws.security.aws-lambda-environment-credentials.aws-lambda-environment-credentials
origin: community
languages:
- hcl
severity: ERROR
- id: terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted
patterns:
- pattern-inside: |
resource "aws_lambda_function" $ANYTHING {
...
}
- pattern-either:
- patterns:
- pattern: |
environment { ... }
- pattern-not-inside: |
resource $A $B {
...
kms_key_arn = ...
...
}
- patterns:
- pattern: |
kms_key_arn = ...
- pattern-not-inside: |
resource $A $B {
...
environment { ... }
...
}
- pattern: kms_key_arn = ""
message: By default, the AWS Lambda Environment is encrypted using AWS-managed keys.
However, for added security, it's recommended to configure your own AWS KMS encryption
key to protect your environment variables in Lambda. You can either create a new
aws_kms_key resource or use the ARN of an existing key in your AWS account to
do so.
languages:
- hcl
severity: WARNING
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
technology:
- aws
- terraform
category: security
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted
shortlink: https://sg.run/x4lz
semgrep.dev:
rule:
r_id: 17374
rv_id: 946711
rule_id: 5rUp5w
version_id: 8KTKEYz
url: https://semgrep.dev/playground/r/8KTKEYz/terraform.aws.security.aws-lambda-environment-unencrypted.aws-lambda-environment-unencrypted
origin: community
- id: terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention
patterns:
- pattern-either:
- pattern: |
resource "aws_rds_cluster" $ANYTHING {
...
backup_retention_period = 0
...
}
- pattern: |
resource "aws_db_instance" $ANYTHING {
...
backup_retention_period = 0
...
}
message: The AWS RDS has no retention. Missing retention can cause losing important
event information. To fix this, set a `backup_retention_period`.
languages:
- hcl
severity: WARNING
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
technology:
- aws
- terraform
category: security
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention
shortlink: https://sg.run/OyYB
semgrep.dev:
rule:
r_id: 17375
rv_id: 946719
rule_id: GdUzwQ
version_id: GxTP0Lq
url: https://semgrep.dev/playground/r/GxTP0Lq/terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention
origin: community
- id: terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk
patterns:
- pattern: |
resource "aws_redshift_cluster" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_redshift_cluster" $ANYTHING {
...
kms_key_id = ...
...
}
message: Ensure AWS Redshift cluster is encrypted at rest using KMS CMKs. CMKs gives
you control over the encryption key in terms of access and rotation.
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-1220: Insufficient Granularity of Access Control'
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk
shortlink: https://sg.run/eXnb
semgrep.dev:
rule:
r_id: 17376
rv_id: 1263737
rule_id: ReUqvX
version_id: NdTzywo
url: https://semgrep.dev/playground/r/NdTzywo/terraform.aws.security.aws-redshift-cluster-encrypted-with-cmk.aws-redshift-cluster-encrypted-with-cmk
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk
patterns:
- pattern: |
resource "aws_s3_bucket_object" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_s3_bucket_object" $ANYTHING {
...
kms_key_id = ...
...
}
message: Ensure S3 bucket object is encrypted at rest using KMS CMKs. CMKs gives
you control over the encryption key in terms of access and rotation.
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk
shortlink: https://sg.run/veKA
semgrep.dev:
rule:
r_id: 17377
rv_id: 946721
rule_id: AbUeYR
version_id: A8TJWj0
url: https://semgrep.dev/playground/r/A8TJWj0/terraform.aws.security.aws-s3-bucket-object-encrypted-with-cmk.aws-s3-bucket-object-encrypted-with-cmk
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk
patterns:
- pattern: |
resource "aws_s3_object_copy" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_s3_object_copy" $ANYTHING {
...
kms_key_id = ...
...
}
message: Ensure S3 object copies are encrypted at rest using KMS CMKs. CMKs gives
you control over the encryption key in terms of access and rotation.
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk
shortlink: https://sg.run/d1ZZ
semgrep.dev:
rule:
r_id: 17378
rv_id: 946722
rule_id: BYUzYY
version_id: BjT1BWv
url: https://semgrep.dev/playground/r/BjT1BWv/terraform.aws.security.aws-s3-object-copy-encrypted-with-cmk.aws-s3-object-copy-encrypted-with-cmk
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk
patterns:
- pattern: |
resource "aws_sagemaker_domain" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_sagemaker_domain" $ANYTHING {
...
kms_key_id = ...
...
}
message: Ensure AWS Sagemaker domains are encrypted at rest using KMS CMKs. CMKs
gives you control over the encryption key in terms of access and rotation.
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk
shortlink: https://sg.run/ZjrD
semgrep.dev:
rule:
r_id: 17379
rv_id: 946723
rule_id: DbUx8z
version_id: DkTNWdv
url: https://semgrep.dev/playground/r/DkTNWdv/terraform.aws.security.aws-sagemaker-domain-encrypted-with-cmk.aws-sagemaker-domain-encrypted-with-cmk
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted
patterns:
- pattern: |
resource "aws_secretsmanager_secret" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_secretsmanager_secret" $ANYTHING {
...
kms_key_id = ...
...
}
message: By default, AWS SecretManager secrets are encrypted using AWS-managed keys.
However, for added security, it's recommended to configure your own AWS KMS encryption
key to protect your secrets in the Secret Manager. You can either create a new
aws_kms_key resource or use the ARN of an existing key in your AWS account to
do so.
languages:
- hcl
severity: WARNING
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-326: Inadequate Encryption Strength'
technology:
- aws
- terraform
category: security
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted
shortlink: https://sg.run/nrRX
semgrep.dev:
rule:
r_id: 17380
rv_id: 1263738
rule_id: WAUNrz
version_id: kbTzGnz
url: https://semgrep.dev/playground/r/kbTzGnz/terraform.aws.security.aws-secretsmanager-secret-unencrypted.aws-secretsmanager-secret-unencrypted
origin: community
- id: terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues
patterns:
- pattern-either:
- patterns:
- pattern-not-inside: |
resource "aws_ssm_document" $ANYTHING {
...
document_format = "YAML"
...
}
- pattern: content = "$STATEMENT"
- metavariable-pattern:
metavariable: $STATEMENT
language: json
patterns:
- pattern-either:
- pattern: '"s3EncryptionEnabled": false'
- pattern: '"cloudWatchEncryptionEnabled": false'
- pattern: '{..., "cloudWatchLogGroupName": "", ..., "s3BucketName": "",
...}'
message: The AWS SSM logs are unencrypted or disabled. Please enable logs and use
AWS KMS encryption key to protect SSM logs. To create your own, create a aws_kms_key
resource or use the ARN string of a key in your account.
languages:
- hcl
severity: WARNING
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-326: Inadequate Encryption Strength'
technology:
- aws
- terraform
category: security
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues
shortlink: https://sg.run/EyWw
semgrep.dev:
rule:
r_id: 17381
rv_id: 1263743
rule_id: 0oUrWL
version_id: vdT067B
url: https://semgrep.dev/playground/r/vdT067B/terraform.aws.security.aws-ssm-document-logging-issues.aws-ssm-document-logging-issues
origin: community
- id: terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk
patterns:
- pattern: |
resource "aws_timestreamwrite_database" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_timestreamwrite_database" $ANYTHING {
...
kms_key_id = ...
...
}
message: Ensure Timestream database is encrypted at rest using KMS CMKs. CMKs gives
you control over the encryption key in terms of access and rotation.
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk
shortlink: https://sg.run/7nyZ
semgrep.dev:
rule:
r_id: 17382
rv_id: 946731
rule_id: KxU5Nn
version_id: o5TZzX3
url: https://semgrep.dev/playground/r/o5TZzX3/terraform.aws.security.aws-timestream-database-encrypted-with-cmk.aws-timestream-database-encrypted-with-cmk
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public
patterns:
- pattern: |
resource "aws_transfer_server" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_transfer_server" $ANYTHING {
...
endpoint_type = "VPC"
...
}
message: Transfer Server endpoint type should not have public or null configured
in order to block public access. To fix this, set your `endpoint_type` to `"VPC"`.
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-1220: Insufficient Granularity of Access Control'
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public
shortlink: https://sg.run/L39r
semgrep.dev:
rule:
r_id: 17383
rv_id: 1263745
rule_id: qNUWl1
version_id: ZRTKAYB
url: https://semgrep.dev/playground/r/ZRTKAYB/terraform.aws.security.aws-transfer-server-is-public.aws-transfer-server-is-public
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted
patterns:
- pattern: |
resource "aws_workspaces_workspace" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_workspaces_workspace" $ANYTHING {
...
root_volume_encryption_enabled = true
...
}
message: The AWS Workspace root volume is unencrypted. The AWS KMS encryption key
protects root volume. To create your own, create a aws_kms_key resource or use
the ARN string of a key in your account.
languages:
- hcl
severity: WARNING
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-326: Inadequate Encryption Strength'
technology:
- aws
- terraform
category: security
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted
shortlink: https://sg.run/8gby
semgrep.dev:
rule:
r_id: 17384
rv_id: 1263746
rule_id: lBUWB9
version_id: nWT2Lgl
url: https://semgrep.dev/playground/r/nWT2Lgl/terraform.aws.security.aws-workspaces-root-volume-unencrypted.aws-workspaces-root-volume-unencrypted
origin: community
- id: terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted
patterns:
- pattern: |
resource "aws_workspaces_workspace" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_workspaces_workspace" $ANYTHING {
...
user_volume_encryption_enabled = true
...
}
message: The AWS Workspace user volume is unencrypted. The AWS KMS encryption key
protects user volume. To create your own, create a aws_kms_key resource or use
the ARN string of a key in your account.
languages:
- hcl
severity: WARNING
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
cwe:
- 'CWE-320: CWE CATEGORY: Key Management Errors'
technology:
- aws
- terraform
category: security
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted
shortlink: https://sg.run/gXdJ
semgrep.dev:
rule:
r_id: 17385
rv_id: 946734
rule_id: YGUAXr
version_id: 2KTY4ly
url: https://semgrep.dev/playground/r/2KTY4ly/terraform.aws.security.aws-workspaces-user-volume-unencrypted.aws-workspaces-user-volume-unencrypted
origin: community
- id: scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal
patterns:
- pattern: $MODEL.overrideSql($QUERY,...)
- pattern-not: $MODEL.overrideSql("...",...)
- pattern-not-inside: |
$QUERY = "..."
...
message: Detected a formatted string in a SQL statement. This could lead to SQL
injection if variables in the SQL statement are not properly sanitized. Avoid
using non literal values in `overrideSql(...)`.
languages:
- scala
severity: ERROR
metadata:
category: security
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
technology:
- scala
- slick
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal
shortlink: https://sg.run/PYe0
semgrep.dev:
rule:
r_id: 17501
rv_id: 1263692
rule_id: wdUA97
version_id: LjTkgvQ
url: https://semgrep.dev/playground/r/LjTkgvQ/scala.slick.security.scala-slick-overridesql-literal.scala-slick-overrideSql-literal
origin: community
- id: scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal
patterns:
- pattern: sql"..."
- pattern-regex: \#\$
- pattern-inside: |
import slick.$DEPS
...
message: Detected a formatted string in a SQL statement. This could lead to SQL
injection if variables in the SQL statement are not properly sanitized. Avoid
using `#$variable` and use `$variable` in `sql"..."` strings instead.
languages:
- scala
severity: ERROR
metadata:
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SCALA_SQL_INJECTION_SLICK
references:
- https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values
category: security
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
technology:
- scala
- slick
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal
shortlink: https://sg.run/JgDk
semgrep.dev:
rule:
r_id: 17502
rv_id: 1263693
rule_id: x8UNKe
version_id: 8KT5rwy
url: https://semgrep.dev/playground/r/8KT5rwy/scala.slick.security.scala-slick-sql-non-literal.scala-slick-sql-non-literal
origin: community
- id: csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery
message: $METHOD is a state-changing MVC method that does not validate the antiforgery
token or do strict content-type checking. State-changing controller methods should
either enforce antiforgery tokens or do strict content-type checking to prevent
simple HTTP request types from bypassing CORS preflight controls.
severity: WARNING
metadata:
likelihood: LOW
impact: MEDIUM
confidence: LOW
category: security
cwe:
- 'CWE-352: Cross-Site Request Forgery (CSRF)'
cwe2021-top25: true
cwe2022-top25: true
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#cross-site-request-forgery
- https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests
subcategory:
- audit
technology:
- .net
- mvc
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site Request Forgery (CSRF)
source: https://semgrep.dev/r/csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery
shortlink: https://sg.run/Y0Jy
semgrep.dev:
rule:
r_id: 18214
rv_id: 1262619
rule_id: ZqUlxE
version_id: X0Tzydb
url: https://semgrep.dev/playground/r/X0Tzydb/csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery
origin: community
languages:
- csharp
patterns:
- pattern: |
[$HTTPMETHOD]
public IActionResult $METHOD(...){
...
}
- pattern-inside: |
using Microsoft.AspNetCore.Mvc;
...
- pattern-not: |
[ValidateAntiForgeryToken]
public IActionResult $METHOD(...){
...
}
- pattern-not: |
[Consumes(...)]
public IActionResult $METHOD(...){
...
}
- metavariable-regex:
metavariable: $HTTPMETHOD
regex: Http(Post|Put|Delete|Patch)
- id: csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled
message: OWASP guidance recommends disabling tracing for production applications
to prevent accidental leakage of sensitive application information.
severity: WARNING
metadata:
likelihood: LOW
impact: MEDIUM
confidence: LOW
category: security
cwe:
- 'CWE-1323: Improper Management of Sensitive Trace Data'
owasp: A05:2021 - Security Misconfiguration
references:
- https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#asp-net-web-forms-guidance
- https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx
subcategory:
- audit
technology:
- .net
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled
shortlink: https://sg.run/6bP1
semgrep.dev:
rule:
r_id: 18215
rv_id: 945193
rule_id: nJUyJq
version_id: ExTg2rO
url: https://semgrep.dev/playground/r/ExTg2rO/csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled
origin: community
languages:
- generic
paths:
include:
- '*web.config*'
patterns:
- pattern: |
<trace ... enabled = "true" ... />
- pattern-inside: |
<system.web>
...
</system.web>
- id: csharp.dotnet.security.razor-template-injection.razor-template-injection
message: User-controllable string passed to Razor.Parse. This leads directly to
code execution in the context of the process.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
cwe2022-top25: true
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-(SSTI)-in-ASP.NET-Razor/
subcategory:
- vuln
technology:
- .net
- razor
- asp
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/csharp.dotnet.security.razor-template-injection.razor-template-injection
shortlink: https://sg.run/oyj0
semgrep.dev:
rule:
r_id: 18216
rv_id: 1262621
rule_id: EwUr68
version_id: 1QTypdj
url: https://semgrep.dev/playground/r/1QTypdj/csharp.dotnet.security.razor-template-injection.razor-template-injection
origin: community
languages:
- csharp
mode: taint
pattern-sources:
- patterns:
- focus-metavariable: $ARG
- pattern-inside: |
public ActionResult $METHOD(..., string $ARG,...){...}
pattern-sinks:
- pattern: |
Razor.Parse(...)
pattern-sanitizers:
- not_conflicting: true
pattern: $F(...)
- id: csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings
message: Cookie Secure flag is explicitly disabled. You should enforce this value
to avoid accidentally presenting sensitive cookie values over plaintext HTTP connections.
severity: WARNING
metadata:
likelihood: LOW
impact: LOW
confidence: LOW
category: security
cwe:
- 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute'
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
references:
- https://docs.microsoft.com/en-us/aspnet/web-api/overview/advanced/http-cookies
- https://docs.microsoft.com/en-us/dotnet/api/system.web.security.formsauthentication.requiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_FormsAuthentication_RequireSSL
- https://docs.microsoft.com/en-us/dotnet/api/system.web.security.roles.cookierequiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_Roles_CookieRequireSSL
subcategory:
- audit
technology:
- .net
- asp
- webforms
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cookie Security
source: https://semgrep.dev/r/csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings
shortlink: https://sg.run/z1jd
semgrep.dev:
rule:
r_id: 18217
rv_id: 1262626
rule_id: 7KUxPg
version_id: NdTzyXg
url: https://semgrep.dev/playground/r/NdTzyXg/csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings
origin: community
languages:
- generic
paths:
include:
- '*web.config'
patterns:
- pattern-either:
- pattern: |
requireSSL="false"
- pattern: |
cookieRequireSSL="false"
- pattern-either:
- pattern-inside: |
<httpCookies ...>
- pattern-inside: |
<forms ...>
- pattern-inside: |
<roleManager ...>
- id: csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation
severity: WARNING
languages:
- csharp
metadata:
cwe:
- 'CWE-295: Improper Certificate Validation'
owasp:
- A03:2017 - Sensitive Data Exposure
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.issuernameregistry?view=netframework-4.8
category: security
technology:
- .net
confidence: MEDIUM
subcategory:
- vuln
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation
shortlink: https://sg.run/XZ6B
semgrep.dev:
rule:
r_id: 18220
rv_id: 1262629
rule_id: gxUy01
version_id: xyTjzGW
url: https://semgrep.dev/playground/r/xyTjzGW/csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation
origin: community
message: Validating certificates based on subject name is bad practice. Use the
X509Certificate2.Verify() method instead.
patterns:
- pattern-inside: |
using System.IdentityModel.Tokens;
...
- pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
X509SecurityToken $TOK = $RHS;
...
- pattern-inside: |
$T $M(..., X509SecurityToken $TOK, ...) {
...
}
- metavariable-pattern:
metavariable: $RHS
pattern-either:
- pattern: $T as X509SecurityToken
- pattern: new X509SecurityToken(...)
- patterns:
- pattern-either:
- pattern-inside: |
X509Certificate2 $CERT = new X509Certificate2(...);
...
- pattern-inside: |
$T $M(..., X509Certificate2 $CERT, ...) {
...
}
- pattern-inside: |
foreach (X509Certificate2 $CERT in $COLLECTION) {
...
}
- patterns:
- pattern-either:
- pattern: String.Equals($NAME, "...")
- pattern: String.Equals("...", $NAME)
- pattern: $NAME.Equals("...")
- pattern: $NAME == "..."
- pattern: $NAME != "..."
- pattern: |
"..." == $NAME
- pattern: |
"..." != $NAME
- metavariable-pattern:
metavariable: $NAME
pattern-either:
- pattern: $TOK.Certificate.SubjectName.Name
- pattern: $CERT.SubjectName.Name
- pattern: $CERT.GetNameInfo(...)
- id: csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine
mode: taint
pattern-sources:
- patterns:
- pattern: $A
- pattern-inside: |
Path.Combine(...,$A,...)
- pattern-inside: |
public $TYPE $M(...,$A,...){...}
- pattern-not-inside: |
<... Path.GetFileName($A) != $A ...>
pattern-sinks:
- patterns:
- focus-metavariable: $X
- pattern: |
File.$METHOD($X,...)
- metavariable-regex:
metavariable: $METHOD
regex: (?i)^(read|write)
pattern-sanitizers:
- pattern: |
Path.GetFileName(...)
- patterns:
- pattern-inside: |
$X = Path.GetFileName(...);
...
- pattern: $X
- patterns:
- pattern: $X
- pattern-inside: |
if(<... Path.GetFileName($X) != $X ...>){
...
throw new $EXCEPTION(...);
}
...
message: String argument $A is used to read or write data from a file via Path.Combine
without direct sanitization via Path.GetFileName. If the path is user-supplied
data this can lead to path traversal.
languages:
- csharp
severity: WARNING
metadata:
category: security
confidence: MEDIUM
references:
- https://www.praetorian.com/blog/pathcombine-security-issues-in-aspnet-applications/
- https://docs.microsoft.com/en-us/dotnet/api/system.io.path.combine?view=net-6.0#remarks
technology:
- .net
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine
shortlink: https://sg.run/1RvG
semgrep.dev:
rule:
r_id: 18222
rv_id: 1262632
rule_id: 3qU3bE
version_id: vdT0644
url: https://semgrep.dev/playground/r/vdT0644/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine
origin: community
- id: csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings
severity: WARNING
languages:
- C#
metadata:
cwe:
- 'CWE-706: Use of Incorrectly-Resolved Name or Reference'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://docs.microsoft.com/en-us/dotnet/api/system.net.httplistener?view=net-6.0
category: security
technology:
- .net
confidence: MEDIUM
subcategory:
- vuln
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings
shortlink: https://sg.run/9LJr
semgrep.dev:
rule:
r_id: 18223
rv_id: 1262633
rule_id: 4bUQ81
version_id: d6Tyx4K
url: https://semgrep.dev/playground/r/d6Tyx4K/csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings
origin: community
message: The top level wildcard bindings $PREFIX leaves your application open to
security vulnerabilities and give attackers more control over where traffic is
routed. If you must use wildcards, consider using subdomain wildcard binding.
For example, you can use "*.asdf.gov" if you own all of "asdf.gov".
patterns:
- pattern-inside: |
using System.Net;
...
- pattern: $LISTENER.Prefixes.Add("$PREFIX")
- metavariable-regex:
metavariable: $PREFIX
regex: (http|https)://(\*|\+)(.[a-zA-Z]{2,})?:[0-9]+
- id: csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver
severity: WARNING
languages:
- C#
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
references:
- https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide
category: security
technology:
- .net
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver
shortlink: https://sg.run/yXjP
semgrep.dev:
rule:
r_id: 18224
rv_id: 1262636
rule_id: PeUxb0
version_id: ExTExqN
url: https://semgrep.dev/playground/r/ExTExqN/csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver
origin: community
message: Only use DataContractResolver if you are completely sure of what information
is being serialized. Malicious types can cause unexpected behavior.
patterns:
- pattern: |
class $MYDCR : DataContractResolver { ... }
- id: csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full
severity: WARNING
languages:
- C#
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
references:
- https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.typefilterlevel?view=net-6.0
- https://www.synacktiv.com/en/publications/izi-izi-pwn2own-ics-miami.html
category: security
technology:
- .net
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full
shortlink: https://sg.run/rere
semgrep.dev:
rule:
r_id: 18225
rv_id: 1262639
rule_id: JDUlKl
version_id: 8KT5rAN
url: https://semgrep.dev/playground/r/8KT5rAN/csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full
origin: community
message: Using a .NET remoting service can lead to RCE, even if you try to configure
TypeFilterLevel. Recommended to switch from .NET Remoting to WCF https://docs.microsoft.com/en-us/dotnet/framework/wcf/migrating-from-net-remoting-to-wcf
pattern-either:
- patterns:
- pattern-either:
- pattern: new BinaryServerFormatterSinkProvider { TypeFilterLevel = $LEVEL
}
- patterns:
- pattern-inside: |
$TYPE $SP = new BinaryServerFormatterSinkProvider(...);
...
- pattern: |
$SP.TypeFilterLevel = $LEVEL
- metavariable-regex:
metavariable: $LEVEL
regex: (.*)TypeFilterLevel\.(Full|Low)
- patterns:
- pattern-inside: |
$DICT["typeFilterLevel"] = $VAL;
...
- pattern: new BinaryServerFormatterSinkProvider(..., $DICT, ...)
- metavariable-regex:
metavariable: $VAL
regex: (\"Full\"|\"Low\")
- id: csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span
severity: WARNING
languages:
- C#
metadata:
cwe:
- 'CWE-125: Out-of-bounds Read'
owasp:
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
references:
- https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createspan?view=net-6.0
- https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createreadonlyspan?view=net-6.0
category: security
technology:
- .net
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Memory Issues
source: https://semgrep.dev/r/csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span
shortlink: https://sg.run/b4eW
semgrep.dev:
rule:
r_id: 18226
rv_id: 1262645
rule_id: 5rUyEN
version_id: JdTzx62
url: https://semgrep.dev/playground/r/JdTzx62/csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span
origin: community
message: MemoryMarshal.CreateSpan and MemoryMarshal.CreateReadOnlySpan should be
used with caution, as the length argument is not checked.
pattern-either:
- pattern: MemoryMarshal.CreateSpan(...)
- pattern: MemoryMarshal.CreateReadOnlySpan(...)
- id: csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout
severity: WARNING
languages:
- C#
metadata:
cwe:
- 'CWE-1333: Inefficient Regular Expression Complexity'
owasp: A01:2017 - Injection
references:
- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
- https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.infinitematchtimeout
- https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0
category: security
technology:
- .net
confidence: MEDIUM
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Denial-of-Service (DoS)
source: https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout
shortlink: https://sg.run/NgRy
semgrep.dev:
rule:
r_id: 18227
rv_id: 945224
rule_id: GdUDBP
version_id: yeT0nDq
url: https://semgrep.dev/playground/r/yeT0nDq/csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout
origin: community
message: 'Specifying the regex timeout leaves the system vulnerable to a regex-based
Denial of Service (DoS) attack. Consider setting the timeout to a short amount
of time like 2 or 3 seconds. If you are sure you need an infinite timeout, double
check that your context meets the conditions outlined in the "Notes to Callers"
section at the bottom of this page: https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0'
patterns:
- pattern-inside: |
using System.Text.RegularExpressions;
...
- pattern-either:
- pattern: new Regex(..., TimeSpan.InfiniteMatchTimeout)
- patterns:
- pattern: new Regex(..., TimeSpan.FromSeconds($TIME))
- metavariable-comparison:
metavariable: $TIME
comparison: $TIME > 5
- pattern: new Regex(..., TimeSpan.FromMinutes(...))
- pattern: new Regex(..., TimeSpan.FromHours(...))
- id: csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override
mode: taint
pattern-sources:
- patterns:
- focus-metavariable: $ARG
- pattern-inside: |
public $T $M(...,string $ARG,...){...}
pattern-sinks:
- patterns:
- pattern: |
$XMLDOCUMENT.$METHOD(...)
- pattern-inside: "XmlDocument $XMLDOCUMENT = new XmlDocument(...);\n...\n$XMLDOCUMENT.XmlResolver
= new XmlUrlResolver(...);\n... \n"
message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling
a string argument from a public method. Enabling Document Type Definition (DTD)
parsing may cause XML External Entity (XXE) injection if supplied with user-controllable
data.
languages:
- csharp
severity: WARNING
metadata:
category: security
references:
- https://www.jardinesoftware.net/2016/05/26/xxe-and-net/
- https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks
technology:
- .net
- xml
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
impact: MEDIUM
likelihood: LOW
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override
shortlink: https://sg.run/k98P
semgrep.dev:
rule:
r_id: 18228
rv_id: 1262654
rule_id: ReUK9k
version_id: K3TKk5E
url: https://semgrep.dev/playground/r/K3TKk5E/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override
origin: community
- id: csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override
mode: taint
pattern-sources:
- patterns:
- focus-metavariable: $ARG
- pattern-inside: |
public $T $M(...,string $ARG,...){...}
pattern-sinks:
- patterns:
- pattern: |
XmlReader $READER = XmlReader.Create(...,$RS,...);
- pattern-inside: "XmlReaderSettings $RS = new XmlReaderSettings();\n...\n$RS.DtdProcessing
= DtdProcessing.Parse;\n... \n"
message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling
a string argument from a public method. Enabling Document Type Definition (DTD)
parsing may cause XML External Entity (XXE) injection if supplied with user-controllable
data.
languages:
- csharp
severity: WARNING
metadata:
category: security
references:
- https://www.jardinesoftware.net/2016/05/26/xxe-and-net/
- https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks
technology:
- .net
- xml
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
impact: MEDIUM
likelihood: LOW
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override
shortlink: https://sg.run/wXjA
semgrep.dev:
rule:
r_id: 18229
rv_id: 1262655
rule_id: AbU3pX
version_id: qkTR7WD
url: https://semgrep.dev/playground/r/qkTR7WD/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override
origin: community
- id: csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults
mode: taint
pattern-sources:
- patterns:
- focus-metavariable: $ARG
- pattern-inside: |
public $T $M(...,string $ARG,...){...}
pattern-sinks:
- patterns:
- pattern: |
$READER.$METHOD(...)
- pattern-not-inside: |
$READER.DtdProcessing = DtdProcessing.Prohibit;
...
- pattern-inside: |
XmlTextReader $READER = new XmlTextReader(...);
...
message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling
a string argument from a public method. Enabling Document Type Definition (DTD)
parsing may cause XML External Entity (XXE) injection if supplied with user-controllable
data.
languages:
- csharp
severity: WARNING
metadata:
category: security
references:
- https://www.jardinesoftware.net/2016/05/26/xxe-and-net/
- https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks
technology:
- .net
- xml
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
impact: MEDIUM
likelihood: LOW
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults
shortlink: https://sg.run/xXjL
semgrep.dev:
rule:
r_id: 18230
rv_id: 1262656
rule_id: BYUevk
version_id: l4TJRWG
url: https://semgrep.dev/playground/r/l4TJRWG/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults
origin: community
- id: go.aws-lambda.security.database-sqli.database-sqli
languages:
- go
message: Detected SQL statement that is tainted by `$EVENT` object. This could lead
to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use prepared statements with the 'Prepare' and 'PrepareContext'
calls.
mode: taint
metadata:
references:
- https://pkg.go.dev/database/sql#DB.Query
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- database
- sql
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/go.aws-lambda.security.database-sqli.database-sqli
shortlink: https://sg.run/e5e8
semgrep.dev:
rule:
r_id: 18232
rv_id: 1262909
rule_id: WAUdJ7
version_id: BjTkZkQ
url: https://semgrep.dev/playground/r/BjTkZkQ/go.aws-lambda.security.database-sqli.database-sqli
origin: community
pattern-sinks:
- patterns:
- focus-metavariable: $QUERY
- pattern-either:
- pattern: $DB.Exec($QUERY,...)
- pattern: $DB.ExecContent($QUERY,...)
- pattern: $DB.Query($QUERY,...)
- pattern: $DB.QueryContext($QUERY,...)
- pattern: $DB.QueryRow($QUERY,...)
- pattern: $DB.QueryRowContext($QUERY,...)
- pattern-inside: |
import "database/sql"
...
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
func $HANDLER($CTX $CTXTYPE, $EVENT $TYPE, ...) {...}
...
lambda.Start($HANDLER, ...)
- patterns:
- pattern-inside: |
func $HANDLER($EVENT $TYPE) {...}
...
lambda.Start($HANDLER, ...)
- pattern-not-inside: |
func $HANDLER($EVENT context.Context) {...}
...
lambda.Start($HANDLER, ...)
- focus-metavariable: $EVENT
severity: WARNING
- id: go.aws-lambda.security.tainted-sql-string.tainted-sql-string
languages:
- go
severity: ERROR
message: Detected user input used to manually construct a SQL string. This is usually
bad practice because manual construction could accidentally result in a SQL injection.
An attacker could use a SQL injection to steal or modify contents of the database.
Instead, use a parameterized query which is available by default in most database
engines. Alternatively, consider using an object-relational mapper (ORM) such
as Sequelize which will protect your queries.
metadata:
references:
- https://owasp.org/www-community/attacks/SQL_Injection
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/go.aws-lambda.security.tainted-sql-string.tainted-sql-string
shortlink: https://sg.run/vX3Y
semgrep.dev:
rule:
r_id: 18233
rv_id: 1262910
rule_id: 0oUwqg
version_id: DkTRbRL
url: https://semgrep.dev/playground/r/DkTRbRL/go.aws-lambda.security.tainted-sql-string.tainted-sql-string
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
func $HANDLER($CTX $CTXTYPE, $EVENT $TYPE, ...) {...}
...
lambda.Start($HANDLER, ...)
- patterns:
- pattern-inside: |
func $HANDLER($EVENT $TYPE) {...}
...
lambda.Start($HANDLER, ...)
- pattern-not-inside: |
func $HANDLER($EVENT context.Context) {...}
...
lambda.Start($HANDLER, ...)
- focus-metavariable: $EVENT
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: |
"$SQLSTR" + ...
- metavariable-regex:
metavariable: $SQLSTR
regex: (?i)(\s*select|\s*delete|\s*insert|\s*create|\s*update|\s*alter|\s*drop).*
- patterns:
- pattern-either:
- pattern: fmt.Fprintf($F, "$SQLSTR", ...)
- pattern: fmt.Sprintf("$SQLSTR", ...)
- pattern: fmt.Printf("$SQLSTR", ...)
- metavariable-regex:
metavariable: $SQLSTR
regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).*
- pattern-not-inside: |
log.$PRINT(...)
pattern-sanitizers:
- pattern: strconv.Atoi(...)
- id: go.lang.security.filepath-clean-misuse.filepath-clean-misuse
message: '`Clean` is not intended to sanitize against path traversal attacks. This
function is for finding the shortest path name equivalent to the given input.
Using `Clean` to sanitize file reads may expose this application to path traversal
attacks, where an attacker could access arbitrary files on the server. To fix
this easily, write this: `filepath.FromSlash(path.Clean("/"+strings.Trim(req.URL.Path,
"/")))` However, a better solution is using the `SecureJoin` function in the package
`filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme.'
severity: ERROR
languages:
- go
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
($REQUEST : *http.Request).$ANYTHING
- pattern: |
($REQUEST : http.Request).$ANYTHING
- metavariable-regex:
metavariable: $ANYTHING
regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
pattern-sinks:
- patterns:
- pattern-either:
- pattern: filepath.Clean($...INNER)
- pattern: path.Clean($...INNER)
pattern-sanitizers:
- pattern-either:
- pattern: |
"/" + ...
fix: filepath.FromSlash(filepath.Clean("/"+strings.Trim($...INNER, "/")))
options:
interfile: true
metadata:
references:
- https://pkg.go.dev/path#Clean
- http://technosophos.com/2016/03/31/go-quickly-cleaning-filepaths.html
- https://labs.detectify.com/2021/12/15/zero-day-path-traversal-grafana/
- https://dzx.cz/2021/04/02/go_path_traversal/
- https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
category: security
technology:
- go
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse
shortlink: https://sg.run/ZKzw
semgrep.dev:
rule:
r_id: 18235
rv_id: 1262967
rule_id: qNUQJe
version_id: jQTn5Bj
url: https://semgrep.dev/playground/r/jQTn5Bj/go.lang.security.filepath-clean-misuse.filepath-clean-misuse
origin: community
- id: java.aws-lambda.security.tainted-sql-string.tainted-sql-string
languages:
- java
severity: ERROR
message: Detected user input used to manually construct a SQL string. This is usually
bad practice because manual construction could accidentally result in a SQL injection.
An attacker could use a SQL injection to steal or modify contents of the database.
Instead, use a parameterized query which is available by default in most database
engines. Alternatively, consider using an object-relational mapper (ORM) such
as Sequelize which will protect your queries.
options:
interfile: true
metadata:
references:
- https://owasp.org/www-community/attacks/SQL_Injection
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/java.aws-lambda.security.tainted-sql-string.tainted-sql-string
shortlink: https://sg.run/EBYN
semgrep.dev:
rule:
r_id: 18237
rv_id: 1262977
rule_id: YGUl4z
version_id: O9TpxQN
url: https://semgrep.dev/playground/r/O9TpxQN/java.aws-lambda.security.tainted-sql-string.tainted-sql-string
origin: community
mode: taint
pattern-sources:
- patterns:
- focus-metavariable: $EVENT
- pattern-either:
- pattern: |
$HANDLERTYPE $HANDLER($TYPE $EVENT, com.amazonaws.services.lambda.runtime.Context $CONTEXT) {
...
}
- pattern: |
$HANDLERTYPE $HANDLER(InputStream $EVENT, OutputStream $OUT, com.amazonaws.services.lambda.runtime.Context $CONTEXT) {
...
}
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
"$SQLSTR" + ...
- pattern: |
"$SQLSTR".concat(...)
- patterns:
- pattern-inside: |
StringBuilder $SB = new StringBuilder("$SQLSTR");
...
- pattern: $SB.append(...)
- patterns:
- pattern-inside: |
$VAR = "$SQLSTR";
...
- pattern: $VAR += ...
- pattern: String.format("$SQLSTR", ...)
- metavariable-regex:
metavariable: $SQLSTR
regex: (?i)(select|delete|insert|create|update|alter|drop)\b
- pattern-not-inside: |
System.out.$PRINTLN(...)
- id: java.aws-lambda.security.tainted-sqli.tainted-sqli
message: Detected SQL statement that is tainted by `$EVENT` object. This could lead
to SQL injection if variables in the SQL statement are not properly sanitized.
Use parameterized SQL queries or properly sanitize user input instead.
languages:
- java
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- focus-metavariable: $EVENT
- pattern-either:
- pattern: |
$HANDLERTYPE $HANDLER($TYPE $EVENT, com.amazonaws.services.lambda.runtime.Context $CONTEXT) {
...
}
- pattern: |
$HANDLERTYPE $HANDLER(InputStream $EVENT, OutputStream $OUT, com.amazonaws.services.lambda.runtime.Context $CONTEXT) {
...
}
pattern-sinks:
- patterns:
- pattern-either:
- pattern: "(java.sql.CallableStatement $STMT) = ...; \n"
- pattern: |
(java.sql.Statement $STMT) = ...;
- pattern: |
(java.sql.PreparedStatement $STMT) = ...;
- pattern: |
$VAR = $CONN.prepareStatement(...)
- pattern: |
$PATH.queryForObject(...);
- pattern: |
(java.util.Map<String, Object> $STMT) = $PATH.queryForMap(...);
- pattern: |
(org.springframework.jdbc.support.rowset.SqlRowSet $STMT) = ...;
- patterns:
- pattern-inside: |
(String $SQL) = "$SQLSTR" + ...;
...
- pattern: $PATH.$SQLCMD(..., $SQL, ...);
- metavariable-regex:
metavariable: $SQLSTR
regex: (?i)(^SELECT.* | ^INSERT.* | ^UPDATE.*)
- metavariable-regex:
metavariable: $SQLCMD
regex: (execute|query|executeUpdate|batchUpdate)
options:
interfile: true
metadata:
category: security
technology:
- sql
- java
- aws-lambda
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/java.aws-lambda.security.tainted-sqli.tainted-sqli
shortlink: https://sg.run/7942
semgrep.dev:
rule:
r_id: 18238
rv_id: 1262978
rule_id: 6JUDWk
version_id: e1Tyj4g
url: https://semgrep.dev/playground/r/e1Tyj4g/java.aws-lambda.security.tainted-sqli.tainted-sqli
origin: community
- id: java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request
message: Detected input from a HTTPServletRequest going into a SQL sink or statement.
This could lead to SQL injection if variables in the SQL statement are not properly
sanitized. Use parameterized SQL queries or properly sanitize user input instead.
severity: WARNING
metadata:
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
category: security
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
cwe2021-top25: true
cwe2022-top25: true
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
- https://owasp.org/www-community/attacks/SQL_Injection
subcategory:
- vuln
technology:
- sql
- java
- servlets
- spring
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request
shortlink: https://sg.run/Lg56
semgrep.dev:
rule:
r_id: 18239
rv_id: 1409390
rule_id: oqUBJG
version_id: 7ZTKJNj
url: https://semgrep.dev/playground/r/7ZTKJNj/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request
origin: community
languages:
- java
mode: taint
options:
taint_assume_safe_numbers: true
taint_assume_safe_booleans: true
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
(HttpServletRequest $REQ).$REQFUNC(...)
- pattern: "(ServletRequest $REQ).$REQFUNC(...) \n"
- metavariable-regex:
metavariable: $REQFUNC
regex: (getInputStream|getParameter|getParameterMap|getParameterValues|getReader|getCookies|getHeader|getHeaderNames|getHeaders|getPart|getParts|getQueryString)
pattern-sinks:
- patterns:
- pattern-either:
- pattern: "(java.sql.CallableStatement $STMT) = ...; \n"
- pattern: |
(java.sql.Statement $STMT) = ...;
...
$OUTPUT = $STMT.$FUNC(...);
- pattern: |
(java.sql.PreparedStatement $STMT) = ...;
- pattern: |
$VAR = $CONN.prepareStatement(...)
- pattern: |
$PATH.queryForObject(...);
- pattern: |
(java.util.Map<String, Object> $STMT) = $PATH.queryForMap(...);
- pattern: |
(org.springframework.jdbc.support.rowset.SqlRowSet $STMT) = ...;
- pattern: |
(org.springframework.jdbc.core.JdbcTemplate $TEMPL).batchUpdate(...)
- patterns:
- pattern-inside: |
(String $SQL) = "$SQLSTR" + ...;
...
- pattern: $PATH.$SQLCMD(..., $SQL, ...);
- metavariable-regex:
metavariable: $SQLSTR
regex: (?i)(^SELECT.* | ^INSERT.* | ^UPDATE.*)
- metavariable-regex:
metavariable: $SQLCMD
regex: (execute|query|executeUpdate|batchUpdate)
- id: java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request
message: Detected input from a HTTPServletRequest going into a 'ProcessBuilder'
or 'exec' command. This could lead to command injection if variables passed into
the exec commands are not properly sanitized. Instead, avoid using these OS commands
with user-supplied input, or, if you must use these commands, use a whitelist
of specific values.
languages:
- java
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
(HttpServletRequest $REQ)
- patterns:
- pattern-inside: |
(javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);
...
for (javax.servlet.http.Cookie $COOKIE: $COOKIES) {
...
}
- pattern: |
$COOKIE.getValue(...)
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
(ProcessBuilder $PB) = ...;
- patterns:
- pattern: |
(Process $P) = ...;
- pattern-not: |
(Process $P) = (java.lang.Runtime $R).exec(...);
- patterns:
- pattern: (java.lang.Runtime $R).exec($CMD, ...);
- focus-metavariable: $CMD
- patterns:
- pattern-either:
- pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...; \n...\n(ProcessBuilder
$PB) = ...;\n...\n$PB.command($ARGLIST);\n"
- pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...; \n...\n(ProcessBuilder
$PB) = ...;\n"
- pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...; \n...\n(Process
$P) = ...;\n"
- pattern: |
$ARGLIST.add(...);
metadata:
category: security
technology:
- java
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request
shortlink: https://sg.run/8zPN
semgrep.dev:
rule:
r_id: 18240
rv_id: 1263042
rule_id: zdUWrg
version_id: LjTkg9J
url: https://semgrep.dev/playground/r/LjTkg9J/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request
origin: community
- id: java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request
message: Detected input from a HTTPServletRequest going into an LDAP query. This
could lead to LDAP injection if the input is not properly sanitized, which could
result in attackers modifying objects in the LDAP tree structure. Ensure data
passed to an LDAP query is not controllable or properly sanitize the data.
metadata:
cwe:
- 'CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (''LDAP
Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://sensei.securecodewarrior.com/recipes/scw%3Ajava%3ALDAP-injection
category: security
technology:
- java
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- LDAP Injection
source: https://semgrep.dev/r/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request
shortlink: https://sg.run/gRg0
semgrep.dev:
rule:
r_id: 18241
rv_id: 1409392
rule_id: pKUXAv
version_id: 8KT3Pe6
url: https://semgrep.dev/playground/r/8KT3Pe6/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request
origin: community
severity: WARNING
languages:
- java
mode: taint
pattern-sources:
- patterns:
- pattern: (HttpServletRequest $REQ)
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
(javax.naming.directory.InitialDirContext $IDC).search(...)
- pattern: |
(javax.naming.directory.DirContext $CTX).search(...)
- pattern-not: |
(javax.naming.directory.InitialDirContext $IDC).search($Y, "...", ...)
- pattern-not: |
(javax.naming.directory.DirContext $CTX).search($Y, "...", ...)
- id: java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request
message: Detected input from a HTTPServletRequest going into a session command,
like `setAttribute`. User input into such a command could lead to an attacker
inputting malicious code into your session parameters, blurring the line between
what's trusted and untrusted, and therefore leading to a trust boundary violation.
This could lead to programmers trusting unvalidated data. Instead, thoroughly
sanitize user input before passing it into such function calls.
languages:
- java
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern: |
(HttpServletRequest $REQ).$FUNC(...)
- pattern-not: |
(HttpServletRequest $REQ).getSession()
- patterns:
- pattern-inside: |
(javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);
...
for (javax.servlet.http.Cookie $COOKIE: $COOKIES) {
...
}
- pattern: |
$COOKIE.getValue(...)
- patterns:
- pattern-inside: |
$TYPE[] $VALS = (HttpServletRequest $REQ).$GETFUNC(... );
...
- pattern: |
$PARAM = $VALS[$INDEX];
- patterns:
- pattern-inside: |
$HEADERS = (HttpServletRequest $REQ).getHeaders(...);
...
$PARAM = $HEADERS.$FUNC(...);
...
- pattern: |
java.net.URLDecoder.decode($PARAM, ...)
pattern-sinks:
- patterns:
- pattern: (HttpServletRequest $REQ).getSession().$FUNC($NAME, $VALUE);
- metavariable-regex:
metavariable: $FUNC
regex: ^(putValue|setAttribute)$
- focus-metavariable: $VALUE
options:
interfile: true
metadata:
category: security
technology:
- java
cwe:
- 'CWE-501: Trust Boundary Violation'
owasp:
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
confidence: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request
shortlink: https://sg.run/QbDZ
semgrep.dev:
rule:
r_id: 18242
rv_id: 1409393
rule_id: 2ZU7Eo
version_id: gETrv9j
url: https://semgrep.dev/playground/r/gETrv9j/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request
origin: community
- id: java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request
message: Detected input from a HTTPServletRequest going into a XPath evaluate or
compile command. This could lead to xpath injection if variables passed into the
evaluate or compile commands are not properly sanitized. Xpath injection could
lead to unauthorized access to sensitive information in XML documents. Instead,
thoroughly sanitize user input or use parameterized xpath queries if you can.
languages:
- java
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern: |
(HttpServletRequest $REQ).$FUNC(...)
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
(javax.xml.xpath.XPath $XP).evaluate(...)
- pattern: |
(javax.xml.xpath.XPath $XP).compile(...).evaluate(...)
metadata:
category: security
technology:
- java
cwe:
- 'CWE-643: Improper Neutralization of Data within XPath Expressions (''XPath
Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XPath Injection
source: https://semgrep.dev/r/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request
shortlink: https://sg.run/3BvK
semgrep.dev:
rule:
r_id: 18243
rv_id: 1409394
rule_id: X5U5nj
version_id: QkTERKP
url: https://semgrep.dev/playground/r/QkTERKP/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request
origin: community
- id: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false
severity: ERROR
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://blog.sonarsource.com/secure-xml-processor
- https://xerces.apache.org/xerces2-j/features.html
category: security
technology:
- java
- xml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false
shortlink: https://sg.run/4Dv5
semgrep.dev:
rule:
r_id: 18244
rv_id: 1263057
rule_id: j2UrJ8
version_id: 0bTKzgX
url: https://semgrep.dev/playground/r/0bTKzgX/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false
origin: community
message: DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external
entity declarations, this is vulnerable to XML external entity attacks. Disable
this by setting the feature "http://apache.org/xml/features/disallow-doctype-decl"
to true. Alternatively, allow DOCTYPE declarations and only prohibit external
entities declarations. This can be done by setting the features "http://xml.org/sax/features/external-general-entities"
and "http://xml.org/sax/features/external-parameter-entities" to false.
patterns:
- pattern: $DBFACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl",
false);
- pattern-not-inside: |
$RETURNTYPE $METHOD(...){
...
$DBF.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
$DBF.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
}
- pattern-not-inside: |
$RETURNTYPE $METHOD(...){
...
$DBF.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
$DBF.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
}
- pattern-not-inside: |
$RETURNTYPE $METHOD(...){
...
$DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
...
$DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
...
}
- pattern-not-inside: |
$RETURNTYPE $METHOD(...){
...
$DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
...
$DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
...
}
languages:
- java
- id: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing
severity: ERROR
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://blog.sonarsource.com/secure-xml-processor
- https://xerces.apache.org/xerces2-j/features.html
category: security
technology:
- java
- xml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing
shortlink: https://sg.run/PYBz
semgrep.dev:
rule:
r_id: 18245
rv_id: 1263058
rule_id: 10UPQB
version_id: K3TKk80
url: https://semgrep.dev/playground/r/K3TKk80/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing
origin: community
message: DOCTYPE declarations are enabled for this DocumentBuilderFactory. This
is vulnerable to XML external entity attacks. Disable this by setting the feature
"http://apache.org/xml/features/disallow-doctype-decl" to true. Alternatively,
allow DOCTYPE declarations and only prohibit external entities declarations. This
can be done by setting the features "http://xml.org/sax/features/external-general-entities"
and "http://xml.org/sax/features/external-parameter-entities" to false.
mode: taint
pattern-sources:
- by-side-effect: true
patterns:
- pattern-either:
- pattern: |
$FACTORY = DocumentBuilderFactory.newInstance();
- patterns:
- pattern: $FACTORY
- pattern-inside: |
class $C {
...
$V $FACTORY = DocumentBuilderFactory.newInstance();
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = DocumentBuilderFactory.newInstance();
static {
...
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
...
}
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = DocumentBuilderFactory.newInstance();
static {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
}
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = DocumentBuilderFactory.newInstance();
static {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
}
...
}
pattern-sinks:
- patterns:
- pattern: $FACTORY.newDocumentBuilder();
pattern-sanitizers:
- by-side-effect: true
pattern-either:
- patterns:
- pattern-either:
- pattern: |
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
- pattern: |
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
- pattern: |
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
- focus-metavariable: $FACTORY
- patterns:
- pattern-either:
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl",
true);
...
}
...
}
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
}
...
}
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities",false);
...
}
...
}
- pattern: $M($X)
- focus-metavariable: $X
fix: |
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
$FACTORY.newDocumentBuilder();
languages:
- java
- id: java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true
severity: ERROR
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://blog.sonarsource.com/secure-xml-processor
category: security
technology:
- java
- xml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true
shortlink: https://sg.run/JgPy
semgrep.dev:
rule:
r_id: 18246
rv_id: 1263059
rule_id: 9AUJ6r
version_id: qkTR7Lk
url: https://semgrep.dev/playground/r/qkTR7Lk/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true
origin: community
message: External entities are allowed for $DBFACTORY. This is vulnerable to XML
external entity attacks. Disable this by setting the feature "http://xml.org/sax/features/external-general-entities"
to false.
pattern: $DBFACTORY.setFeature("http://xml.org/sax/features/external-general-entities",
true);
fix: $DBFACTORY.setFeature("http://xml.org/sax/features/external-general-entities",
false);
languages:
- java
- id: java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true
severity: ERROR
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://blog.sonarsource.com/secure-xml-processor
category: security
technology:
- java
- xml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true
shortlink: https://sg.run/5Lv0
semgrep.dev:
rule:
r_id: 18247
rv_id: 1263060
rule_id: yyUNeo
version_id: l4TJRoL
url: https://semgrep.dev/playground/r/l4TJRoL/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true
origin: community
message: External entities are allowed for $DBFACTORY. This is vulnerable to XML
external entity attacks. Disable this by setting the feature "http://xml.org/sax/features/external-parameter-entities"
to false.
pattern: $DBFACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities",
true);
fix: $DBFACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities",
false);
languages:
- java
- id: javascript.aws-lambda.security.detect-child-process.detect-child-process
message: Allowing spawning arbitrary programs or running shell processes with arbitrary
arguments may end up in a command injection vulnerability. Try to avoid non-literal
values for the command string. If it is not possible, then do not let running
arbitrary commands, use a white list for inputs.
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- javascript
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/javascript.aws-lambda.security.detect-child-process.detect-child-process
shortlink: https://sg.run/Ggoq
semgrep.dev:
rule:
r_id: 18248
rv_id: 1263105
rule_id: r6UDNQ
version_id: YDTZe4o
url: https://semgrep.dev/playground/r/YDTZe4o/javascript.aws-lambda.security.detect-child-process.detect-child-process
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern: $EVENT
- pattern-either:
- pattern-inside: |
exports.handler = function ($EVENT, ...) {
...
}
- pattern-inside: |
function $FUNC ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern-inside: |
$FUNC = function ($EVENT, ...) {...}
...
exports.handler = $FUNC
pattern-sinks:
- patterns:
- focus-metavariable: $CMD
- pattern-either:
- pattern: exec($CMD,...)
- pattern: execSync($CMD,...)
- pattern: spawn($CMD,...)
- pattern: spawnSync($CMD,...)
- pattern: $CP.exec($CMD,...)
- pattern: $CP.execSync($CMD,...)
- pattern: $CP.spawn($CMD,...)
- pattern: $CP.spawnSync($CMD,...)
- pattern-either:
- pattern-inside: |
require('child_process')
...
- pattern-inside: |
import 'child_process'
...
- id: javascript.aws-lambda.security.knex-sqli.knex-sqli
message: 'Detected SQL statement that is tainted by `$EVENT` object. This could
lead to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `knex.raw(''SELECT $1 from
table'', [userinput])`'
metadata:
references:
- https://knexjs.org/#Builder-fromRaw
- https://knexjs.org/#Builder-whereRaw
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- knex
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/javascript.aws-lambda.security.knex-sqli.knex-sqli
shortlink: https://sg.run/RgWq
semgrep.dev:
rule:
r_id: 18249
rv_id: 1263106
rule_id: bwUBlj
version_id: JdTzxKg
url: https://semgrep.dev/playground/r/JdTzxKg/javascript.aws-lambda.security.knex-sqli.knex-sqli
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
exports.handler = function ($EVENT, ...) {
...
}
- pattern-inside: |
function $FUNC ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern-inside: |
$FUNC = function ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern: $EVENT
pattern-sinks:
- patterns:
- focus-metavariable: $QUERY
- pattern-either:
- pattern: $KNEX.fromRaw($QUERY, ...)
- pattern: $KNEX.whereRaw($QUERY, ...)
- pattern: $KNEX.raw($QUERY, ...)
- pattern-either:
- pattern-inside: |
require('knex')
...
- pattern-inside: |
import 'knex'
...
- id: javascript.aws-lambda.security.mysql-sqli.mysql-sqli
message: 'Detected SQL statement that is tainted by `$EVENT` object. This could
lead to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `connection.query(''SELECT
$1 from table'', [userinput])`'
metadata:
references:
- https://www.npmjs.com/package/mysql2
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- mysql
- mysql2
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/javascript.aws-lambda.security.mysql-sqli.mysql-sqli
shortlink: https://sg.run/A502
semgrep.dev:
rule:
r_id: 18250
rv_id: 1263107
rule_id: NbUBJ2
version_id: 5PTo1En
url: https://semgrep.dev/playground/r/5PTo1En/javascript.aws-lambda.security.mysql-sqli.mysql-sqli
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
exports.handler = function ($EVENT, ...) {
...
}
- pattern-inside: |
function $FUNC ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern-inside: |
$FUNC = function ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern: $EVENT
pattern-sinks:
- patterns:
- focus-metavariable: $QUERY
- pattern-either:
- pattern: $POOL.query($QUERY, ...)
- pattern: $POOL.execute($QUERY, ...)
- pattern-either:
- pattern-inside: |
require('mysql')
...
- pattern-inside: |
require('mysql2')
...
- pattern-inside: |
require('mysql2/promise')
...
- pattern-inside: |
import 'mysql'
...
- pattern-inside: |
import 'mysql2'
...
- pattern-inside: |
import 'mysql2/promise'
...
- id: javascript.aws-lambda.security.pg-sqli.pg-sqli
message: 'Detected SQL statement that is tainted by `$EVENT` object. This could
lead to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `connection.query(''SELECT
$1 from table'', [userinput])`'
metadata:
references:
- https://node-postgres.com/features/queries
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- postgres
- pg
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/javascript.aws-lambda.security.pg-sqli.pg-sqli
shortlink: https://sg.run/BGKA
semgrep.dev:
rule:
r_id: 18251
rv_id: 1263108
rule_id: kxU25P
version_id: GxTkeJL
url: https://semgrep.dev/playground/r/GxTkeJL/javascript.aws-lambda.security.pg-sqli.pg-sqli
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
exports.handler = function ($EVENT, ...) {
...
}
- pattern-inside: |
function $FUNC ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern-inside: |
$FUNC = function ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern: $EVENT
pattern-sinks:
- patterns:
- focus-metavariable: $QUERY
- pattern-either:
- pattern: $DB.query($QUERY, ...)
- pattern-either:
- pattern-inside: |
require('pg')
...
- pattern-inside: |
import 'pg'
...
- id: javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli
message: 'Detected SQL statement that is tainted by `$EVENT` object. This could
lead to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `sequelize.query(''SELECT
* FROM projects WHERE status = ?'', { replacements: [''active''], type: QueryTypes.SELECT
});`'
metadata:
references:
- https://sequelize.org/master/manual/raw-queries.html
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- sequelize
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli
shortlink: https://sg.run/DAlP
semgrep.dev:
rule:
r_id: 18252
rv_id: 1263109
rule_id: wdUA5o
version_id: RGT0LrD
url: https://semgrep.dev/playground/r/RGT0LrD/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
exports.handler = function ($EVENT, ...) {
...
}
- pattern-inside: |
function $FUNC ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern-inside: |
$FUNC = function ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern: $EVENT
pattern-sinks:
- patterns:
- focus-metavariable: $QUERY
- pattern-either:
- pattern: $DB.query($QUERY, ...)
- pattern-either:
- pattern-inside: |
require('sequelize')
...
- pattern-inside: |
import 'sequelize'
...
- id: javascript.aws-lambda.security.tainted-eval.tainted-eval
message: The `eval()` function evaluates JavaScript code represented as a string.
Executing JavaScript from a string is an enormous security risk. It is far too
easy for a bad actor to run arbitrary code when you use `eval()`. Ensure evaluated
content is not definable by external sources.
metadata:
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- javascript
- aws-lambda
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/javascript.aws-lambda.security.tainted-eval.tainted-eval
shortlink: https://sg.run/WjY2
semgrep.dev:
rule:
r_id: 18253
rv_id: 1263110
rule_id: x8UNw5
version_id: A8TgdLk
url: https://semgrep.dev/playground/r/A8TgdLk/javascript.aws-lambda.security.tainted-eval.tainted-eval
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern: $EVENT
- pattern-either:
- pattern-inside: |
exports.handler = function ($EVENT, ...) {
...
}
- pattern-inside: |
function $FUNC ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern-inside: |
$FUNC = function ($EVENT, ...) {...}
...
exports.handler = $FUNC
pattern-sinks:
- patterns:
- focus-metavariable: $CODE
- pattern-either:
- pattern: eval($CODE)
- pattern: Function(...,$CODE)
- pattern: new Function(...,$CODE)
- id: javascript.aws-lambda.security.tainted-html-response.tainted-html-response
message: Detected user input flowing into an HTML response. You may be accidentally
bypassing secure methods of rendering HTML by manually constructing HTML and this
could create a cross-site scripting vulnerability, which could let attackers steal
sensitive user data.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-response.tainted-html-response
shortlink: https://sg.run/0Gvj
semgrep.dev:
rule:
r_id: 18254
rv_id: 1263111
rule_id: OrUJBY
version_id: BjTkZ8D
url: https://semgrep.dev/playground/r/BjTkZ8D/javascript.aws-lambda.security.tainted-html-response.tainted-html-response
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
exports.handler = function ($EVENT, ...) {
...
}
- pattern-inside: |
function $FUNC ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern-inside: |
$FUNC = function ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern: $EVENT
pattern-sinks:
- patterns:
- focus-metavariable: $BODY
- pattern-inside: |
{..., headers: {..., 'Content-Type': 'text/html', ...}, body: $BODY, ... }
- id: javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection
message: The `vm` module enables compiling and running code within V8 Virtual Machine
contexts. The `vm` module is not a security mechanism. Do not use it to run untrusted
code. If code passed to `vm` functions is controlled by user input it could result
in command injection. Do not let user input in `vm` functions.
metadata:
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
category: security
technology:
- javascript
- aws-lambda
cwe2022-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection
shortlink: https://sg.run/q9w7
semgrep.dev:
rule:
r_id: 18256
rv_id: 1263114
rule_id: v8UOdZ
version_id: 0bTKz9J
url: https://semgrep.dev/playground/r/0bTKz9J/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern: $EVENT
- pattern-either:
- pattern-inside: |
exports.handler = function ($EVENT, ...) {
...
}
- pattern-inside: |
function $FUNC ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern-inside: |
$FUNC = function ($EVENT, ...) {...}
...
exports.handler = $FUNC
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
require('vm');
...
- pattern-inside: |
import 'vm'
...
- pattern-either:
- pattern: $VM.runInContext($X,...)
- pattern: $VM.runInNewContext($X,...)
- pattern: $VM.runInThisContext($X,...)
- pattern: $VM.compileFunction($X,...)
- pattern: new $VM.Script($X,...)
- pattern: new $VM.SourceTextModule($X,...)
- pattern: runInContext($X,...)
- pattern: runInNewContext($X,...)
- pattern: runInThisContext($X,...)
- pattern: compileFunction($X,...)
- pattern: new Script($X,...)
- pattern: new SourceTextModule($X,...)
- id: javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli
message: 'Detected SQL statement that is tainted by `$REQ` object. This could lead
to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, it is recommended to use parameterized queries
or prepared statements. An example of parameterized queries like so: `knex.raw(''SELECT
$1 from table'', [userinput])` can help prevent SQLi.'
metadata:
confidence: MEDIUM
references:
- https://knexjs.org/#Builder-fromRaw
- https://knexjs.org/#Builder-whereRaw
- https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- express
- nodejs
- knex
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli
shortlink: https://sg.run/l9eE
semgrep.dev:
rule:
r_id: 18257
rv_id: 1263205
rule_id: d8UKLD
version_id: l4TJRey
url: https://semgrep.dev/playground/r/l4TJRey/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- pattern: $REQ.files.$ANYTHING.data.toString('utf8')
- pattern: $REQ.files.$ANYTHING['data'].toString('utf8')
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
- pattern: files.$ANYTHING.data.toString('utf8')
- pattern: files.$ANYTHING['data'].toString('utf8')
pattern-sinks:
- patterns:
- focus-metavariable: $QUERY
- pattern-either:
- pattern-inside: $KNEX.fromRaw($QUERY, ...)
- pattern-inside: $KNEX.whereRaw($QUERY, ...)
- pattern-inside: $KNEX.raw($QUERY, ...)
- pattern-either:
- pattern-inside: |
require('knex')
...
- pattern-inside: |
import 'knex'
...
pattern-sanitizers:
- patterns:
- pattern: parseInt(...)
- id: javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli
message: Detected a `$IMPORT` SQL statement that comes from a function argument.
This could lead to SQL injection if the variable is user-controlled and is not
properly sanitized. In order to prevent SQL injection, it is recommended to use
parameterized queries or prepared statements.
metadata:
references:
- https://www.npmjs.com/package/mysql2
- https://www.npmjs.com/package/mysql
- https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
confidence: LOW
technology:
- mysql
- mysql2
- javascript
- nodejs
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli
shortlink: https://sg.run/Y0oy
semgrep.dev:
rule:
r_id: 18258
rv_id: 1263207
rule_id: ZqUlWE
version_id: JdTzx2D
url: https://semgrep.dev/playground/r/JdTzx2D/javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-inside: function ... (..., $Y,...) {...}
- pattern: $Y
- pattern-not-inside: |
function ... (..., $Y: number,...) {...}
- pattern-not-inside: $Y.query
- pattern-not-inside: $Y.body
- pattern-not-inside: $Y.params
- pattern-not-inside: $Y.cookies
- pattern-not-inside: $Y.headers
pattern-sinks:
- patterns:
- focus-metavariable: $QUERY
- pattern-either:
- pattern-inside: $POOL.query($QUERY, ...)
- pattern-inside: $POOL.execute($QUERY, ...)
- pattern-either:
- pattern-inside: |
import $S from "$IMPORT"
...
- pattern-inside: |
import { ... } from "$IMPORT"
...
- pattern-inside: |
import * as $S from "$IMPORT"
...
- pattern-inside: |
require("$IMPORT")
...
- metavariable-regex:
metavariable: $IMPORT
regex: (mysql|mysql2)
pattern-sanitizers:
- patterns:
- pattern: parseInt(...)
- id: php.lang.security.deserialization.extract-user-data
mode: taint
pattern-sources:
- pattern-either:
- pattern: $_GET[...]
- pattern: $_FILES[...]
- pattern: $_POST[...]
pattern-sinks:
- pattern: extract(...)
pattern-sanitizers:
- pattern: extract($VAR, EXTR_SKIP,...)
message: Do not call 'extract()' on user-controllable data. If you must, then you
must also provide the EXTR_SKIP flag to prevent overwriting existing variables.
languages:
- php
metadata:
category: security
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
technology:
- php
references:
- https://www.php.net/manual/en/function.extract.php#refsect1-function.extract-notes
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/php.lang.security.deserialization.extract-user-data
shortlink: https://sg.run/6bv1
semgrep.dev:
rule:
r_id: 18259
rv_id: 1263278
rule_id: nJUykq
version_id: w8TRovw
url: https://semgrep.dev/playground/r/w8TRovw/php.lang.security.deserialization.extract-user-data
origin: community
severity: ERROR
- id: python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec
mode: taint
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
pattern-sinks:
- patterns:
- focus-metavariable: $CMD
- pattern-either:
- pattern: asyncio.create_subprocess_exec($PROG, $CMD, ...)
- pattern: asyncio.create_subprocess_exec($PROG, [$CMD, ...], ...)
- pattern: asyncio.subprocess.create_subprocess_exec($PROG, $CMD, ...)
- pattern: asyncio.subprocess.create_subprocess_exec($PROG, [$CMD, ...], ...)
- pattern: asyncio.create_subprocess_exec($PROG, "=~/(sh|bash|ksh|csh|tcsh|zsh)/",
"-c", $CMD, ...)
- pattern: asyncio.create_subprocess_exec($PROG, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/",
"-c", $CMD, ...], ...)
- pattern: asyncio.subprocess.create_subprocess_exec($PROG, "=~/(sh|bash|ksh|csh|tcsh|zsh)/",
"-c", $CMD, ...)
- pattern: asyncio.subprocess.create_subprocess_exec($PROG, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/",
"-c", $CMD, ...], ...)
message: Detected 'create_subprocess_exec' function with argument tainted by `event`
object. If this data can be controlled by a malicious actor, it may be an instance
of command injection. Audit the use of this call to ensure it is not controllable
by an external resource. You may consider using 'shlex.escape()'.
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.8 OS Command Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
references:
- https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec
- https://docs.python.org/3/library/shlex.html
category: security
technology:
- python
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec
shortlink: https://sg.run/oyv0
semgrep.dev:
rule:
r_id: 18260
rv_id: 1263331
rule_id: EwUrX8
version_id: rxTAKgo
url: https://semgrep.dev/playground/r/rxTAKgo/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec
origin: community
languages:
- python
severity: ERROR
- id: python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec
mode: taint
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
pattern-sinks:
- patterns:
- focus-metavariable: $CMD
- pattern-either:
- pattern: $LOOP.subprocess_exec($PROTOCOL, $CMD, ...)
- pattern: $LOOP.subprocess_exec($PROTOCOL, [$CMD, ...], ...)
- pattern: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/",
"-c", $CMD, ...)
- pattern: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/",
"-c", $CMD, ...], ...)
message: Detected subprocess function '$LOOP.subprocess_exec' with argument tainted
by `event` object. If this data can be controlled by a malicious actor, it may
be an instance of command injection. Audit the use of this call to ensure it is
not controllable by an external resource. You may consider using 'shlex.escape()'.
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.8 OS Command Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
references:
- https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec
- https://docs.python.org/3/library/shlex.html
category: security
technology:
- python
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec
shortlink: https://sg.run/z14d
semgrep.dev:
rule:
r_id: 18261
rv_id: 1263332
rule_id: 7KUxXg
version_id: bZT53Ww
url: https://semgrep.dev/playground/r/bZT53Ww/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec
origin: community
languages:
- python
severity: ERROR
- id: python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell
mode: taint
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
pattern-sinks:
- patterns:
- focus-metavariable: $CMD
- pattern-either:
- pattern: $LOOP.subprocess_shell($PROTOCOL, $CMD)
- pattern: asyncio.subprocess.create_subprocess_shell($CMD, ...)
- pattern: asyncio.create_subprocess_shell($CMD, ...)
message: Detected asyncio subprocess function with argument tainted by `event` object.
If this data can be controlled by a malicious actor, it may be an instance of
command injection. Audit the use of this call to ensure it is not controllable
by an external resource. You may consider using 'shlex.escape()'.
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.8 OS Command Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
references:
- https://docs.python.org/3/library/asyncio-subprocess.html
- https://docs.python.org/3/library/shlex.html
category: security
technology:
- python
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell
shortlink: https://sg.run/p9vZ
semgrep.dev:
rule:
r_id: 18262
rv_id: 1263333
rule_id: L1UEl7
version_id: NdTzyWA
url: https://semgrep.dev/playground/r/NdTzyWA/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell
origin: community
languages:
- python
severity: ERROR
- id: python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process
mode: taint
message: Detected `os` function with argument tainted by `event` object. This is
dangerous if external data can reach this function call because it allows a malicious
actor to execute commands. Ensure no external data reaches here.
metadata:
source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.8 OS Command Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
category: security
technology:
- python
- aws-lambda
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process
shortlink: https://sg.run/2AjL
semgrep.dev:
rule:
r_id: 18263
rv_id: 1263334
rule_id: 8GUGBq
version_id: kbTzGv8
url: https://semgrep.dev/playground/r/kbTzGv8/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process
origin: community
languages:
- python
severity: ERROR
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
pattern-sinks:
- patterns:
- focus-metavariable: $CMD
- pattern-either:
- patterns:
- pattern: os.$METHOD($MODE, $CMD, ...)
- metavariable-regex:
metavariable: $METHOD
regex: (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile)
- patterns:
- pattern-inside: os.$METHOD($MODE, $BASH, ["-c", $CMD,...],...)
- metavariable-regex:
metavariable: $METHOD
regex: (spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp)
- metavariable-regex:
metavariable: $BASH
regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
- patterns:
- pattern-inside: os.$METHOD($MODE, $BASH, "-c", $CMD,...)
- metavariable-regex:
metavariable: $METHOD
regex: (spawnl|spawnle|spawnlp|spawnlpe)
- metavariable-regex:
metavariable: $BASH
regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
- id: python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use
mode: taint
message: Detected subprocess function with argument tainted by an `event` object. If
this data can be controlled by a malicious actor, it may be an instance of command
injection. The default option for `shell` is False, and this is secure by default.
Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False`
means you have to split the command string into an array of strings for the command
and its arguments. You may consider using 'shlex.split()' for this purpose.
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.8 OS Command Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
references:
- https://docs.python.org/3/library/subprocess.html
- https://docs.python.org/3/library/shlex.html
category: security
technology:
- python
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use
shortlink: https://sg.run/XZ7B
semgrep.dev:
rule:
r_id: 18264
rv_id: 1263335
rule_id: gxUyn1
version_id: w8TRogj
url: https://semgrep.dev/playground/r/w8TRogj/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use
origin: community
languages:
- python
severity: ERROR
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
pattern-sinks:
- patterns:
- pattern: subprocess.$FUNC(..., shell=True, ...)
pattern-sanitizers:
- pattern: shlex.split(...)
- pattern: pipes.quote(...)
- pattern: shlex.quote(...)
- id: python.aws-lambda.security.dangerous-system-call.dangerous-system-call
mode: taint
message: Detected `os` function with argument tainted by `event` object. This is
dangerous if external data can reach this function call because it allows a malicious
actor to execute commands. Use the 'subprocess' module instead, which is easier
to use without accidentally exposing a command injection vulnerability.
metadata:
source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.2.4 Dyanmic Code Execution Features
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements
version: '4'
category: security
technology:
- python
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-system-call.dangerous-system-call
shortlink: https://sg.run/jDvN
semgrep.dev:
rule:
r_id: 18265
rv_id: 1263336
rule_id: QrUkg6
version_id: xyTjzbG
url: https://semgrep.dev/playground/r/xyTjzbG/python.aws-lambda.security.dangerous-system-call.dangerous-system-call
origin: community
languages:
- python
severity: ERROR
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
pattern-sinks:
- patterns:
- focus-metavariable: $CMD
- pattern-either:
- pattern: os.system($CMD,...)
- pattern: os.popen($CMD,...)
- pattern: os.popen2($CMD,...)
- pattern: os.popen3($CMD,...)
- pattern: os.popen4($CMD,...)
- id: python.aws-lambda.security.mysql-sqli.mysql-sqli
languages:
- python
message: 'Detected SQL statement that is tainted by `event` object. This could lead
to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `cursor.execute(''SELECT
* FROM projects WHERE status = %s'', (''active''))`'
mode: taint
metadata:
references:
- https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html
- https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-executemany.html
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- mysql
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.aws-lambda.security.mysql-sqli.mysql-sqli
shortlink: https://sg.run/1RjG
semgrep.dev:
rule:
r_id: 18266
rv_id: 1263337
rule_id: 3qU3eE
version_id: O9TpxLJ
url: https://semgrep.dev/playground/r/O9TpxLJ/python.aws-lambda.security.mysql-sqli.mysql-sqli
origin: community
pattern-sinks:
- patterns:
- focus-metavariable: $QUERY
- pattern-either:
- pattern: $CURSOR.execute($QUERY,...)
- pattern: $CURSOR.executemany($QUERY,...)
- pattern-either:
- pattern-inside: |
import mysql
...
- pattern-inside: |
import mysql.cursors
...
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
severity: WARNING
- id: python.aws-lambda.security.psycopg-sqli.psycopg-sqli
languages:
- python
message: 'Detected SQL statement that is tainted by `event` object. This could lead
to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `cursor.execute(''SELECT
* FROM projects WHERE status = %s'', ''active'')`'
mode: taint
metadata:
references:
- https://www.psycopg.org/docs/cursor.html#cursor.execute
- https://www.psycopg.org/docs/cursor.html#cursor.executemany
- https://www.psycopg.org/docs/cursor.html#cursor.mogrify
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- psycopg
- psycopg2
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.aws-lambda.security.psycopg-sqli.psycopg-sqli
shortlink: https://sg.run/9L8r
semgrep.dev:
rule:
r_id: 18267
rv_id: 1263338
rule_id: 4bUQG1
version_id: e1TyjPZ
url: https://semgrep.dev/playground/r/e1TyjPZ/python.aws-lambda.security.psycopg-sqli.psycopg-sqli
origin: community
pattern-sinks:
- patterns:
- focus-metavariable: $QUERY
- pattern-either:
- pattern: $CURSOR.execute($QUERY,...)
- pattern: $CURSOR.executemany($QUERY,...)
- pattern: $CURSOR.mogrify($QUERY,...)
- pattern-inside: |
import psycopg2
...
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
severity: WARNING
- id: python.aws-lambda.security.pymssql-sqli.pymssql-sqli
languages:
- python
message: 'Detected SQL statement that is tainted by `event` object. This could lead
to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `cursor.execute(''SELECT
* FROM projects WHERE status = %s'', ''active'')`'
mode: taint
metadata:
references:
- https://pypi.org/project/pymssql/
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- pymssql
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.aws-lambda.security.pymssql-sqli.pymssql-sqli
shortlink: https://sg.run/yXvP
semgrep.dev:
rule:
r_id: 18268
rv_id: 1263339
rule_id: PeUxO0
version_id: vdT06bG
url: https://semgrep.dev/playground/r/vdT06bG/python.aws-lambda.security.pymssql-sqli.pymssql-sqli
origin: community
pattern-sinks:
- patterns:
- focus-metavariable: $QUERY
- pattern: $CURSOR.execute($QUERY,...)
- pattern-inside: |
import pymssql
...
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
severity: WARNING
- id: python.aws-lambda.security.pymysql-sqli.pymysql-sqli
languages:
- python
message: 'Detected SQL statement that is tainted by `event` object. This could lead
to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `cursor.execute(''SELECT
* FROM projects WHERE status = %s'', (''active''))`'
mode: taint
metadata:
references:
- https://pypi.org/project/PyMySQL/#id4
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- pymysql
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.aws-lambda.security.pymysql-sqli.pymysql-sqli
shortlink: https://sg.run/reve
semgrep.dev:
rule:
r_id: 18269
rv_id: 1263340
rule_id: JDUlel
version_id: d6TyxNA
url: https://semgrep.dev/playground/r/d6TyxNA/python.aws-lambda.security.pymysql-sqli.pymysql-sqli
origin: community
pattern-sinks:
- patterns:
- focus-metavariable: $QUERY
- pattern: $CURSOR.execute($QUERY,...)
- pattern-either:
- pattern-inside: |
import pymysql
...
- pattern-inside: |
import pymysql.cursors
...
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
severity: WARNING
- id: python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli
languages:
- python
message: 'Detected SQL statement that is tainted by `event` object. This could lead
to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `cursor.execute(''SELECT
* FROM projects WHERE status = ?'', ''active'')`'
mode: taint
metadata:
references:
- https://docs.sqlalchemy.org/en/14/core/connections.html#sqlalchemy.engine.Connection.execute
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- sqlalchemy
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli
shortlink: https://sg.run/b48W
semgrep.dev:
rule:
r_id: 18270
rv_id: 1263341
rule_id: 5rUy3N
version_id: ZRTKARp
url: https://semgrep.dev/playground/r/ZRTKARp/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli
origin: community
pattern-sinks:
- patterns:
- focus-metavariable: $QUERY
- pattern: $CURSOR.execute($QUERY,...)
- pattern-inside: |
import sqlalchemy
...
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
severity: WARNING
- id: python.aws-lambda.security.tainted-code-exec.tainted-code-exec
mode: taint
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
pattern-sinks:
- patterns:
- pattern-either:
- pattern: eval($CODE, ...)
- pattern: exec($CODE, ...)
message: Detected the use of `exec/eval`.This can be dangerous if used to evaluate
dynamic content. If this content can be input from outside the program, this may
be a code injection vulnerability. Ensure evaluated content is not definable by
external sources.
metadata:
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.2.4 Dyanmic Code Execution Features
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements
version: '4'
category: security
technology:
- python
references:
- https://owasp.org/Top10/A03_2021-Injection
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/python.aws-lambda.security.tainted-code-exec.tainted-code-exec
shortlink: https://sg.run/Ng7y
semgrep.dev:
rule:
r_id: 18271
rv_id: 1263342
rule_id: GdUDJP
version_id: nWT2LD2
url: https://semgrep.dev/playground/r/nWT2LD2/python.aws-lambda.security.tainted-code-exec.tainted-code-exec
origin: community
languages:
- python
severity: WARNING
- id: python.aws-lambda.security.tainted-html-response.tainted-html-response
mode: taint
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
pattern-sinks:
- patterns:
- pattern: $BODY
- pattern-inside: |
{..., "headers": {..., "Content-Type": "text/html", ...}, "body": $BODY, ... }
message: Detected user input flowing into an HTML response. You may be accidentally
bypassing secure methods of rendering HTML by manually constructing HTML and this
could create a cross-site scripting vulnerability, which could let attackers steal
sensitive user data.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- aws-lambda
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.aws-lambda.security.tainted-html-response.tainted-html-response
shortlink: https://sg.run/k9vP
semgrep.dev:
rule:
r_id: 18272
rv_id: 1263343
rule_id: ReUKrk
version_id: ExTEx5o
url: https://semgrep.dev/playground/r/ExTEx5o/python.aws-lambda.security.tainted-html-response.tainted-html-response
origin: community
languages:
- python
severity: WARNING
- id: python.aws-lambda.security.tainted-sql-string.tainted-sql-string
languages:
- python
message: Detected user input used to manually construct a SQL string. This is usually
bad practice because manual construction could accidentally result in a SQL injection.
An attacker could use a SQL injection to steal or modify contents of the database.
Instead, use a parameterized query which is available by default in most database
engines. Alternatively, consider using an object-relational mapper (ORM) such
as Sequelize which will protect your queries.
metadata:
references:
- https://owasp.org/www-community/attacks/SQL_Injection
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string
shortlink: https://sg.run/wXvA
semgrep.dev:
rule:
r_id: 18273
rv_id: 1263346
rule_id: AbU3LX
version_id: 8KT5ron
url: https://semgrep.dev/playground/r/8KT5ron/python.aws-lambda.security.tainted-sql-string.tainted-sql-string
origin: community
mode: taint
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
"$SQLSTR" + ...
- pattern: |
"$SQLSTR" % ...
- pattern: |
"$SQLSTR".format(...)
- pattern: |
f"$SQLSTR{...}..."
- metavariable-regex:
metavariable: $SQLSTR
regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*=
- pattern-not-inside: |
print(...)
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
severity: ERROR
- id: python.django.security.nan-injection.nan-injection
message: Found user input going directly into typecast for bool(), float(), or complex().
This allows an attacker to inject Python's not-a-number (NaN) into the typecast.
This results in undefind behavior, particularly when doing comparisons. Either
cast to a different type, or add a guard checking for all capitalizations of the
string 'nan'.
languages:
- python
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-inside: |
def $FUNC(request, ...):
...
- pattern-either:
- pattern: request.$PROPERTY.get(...)
- pattern: request.$PROPERTY[...]
pattern-sinks:
- patterns:
- pattern-either:
- pattern: float(...)
- pattern: bool(...)
- pattern: complex(...)
- pattern-not-inside: |
if $COND:
...
...
pattern-sanitizers:
- pattern: $ANYTHING(...)
not_conflicting: true
metadata:
references:
- https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868
- https://blog.bitdiscovery.com/2021/12/python-nan-injection/
category: security
cwe:
- 'CWE-704: Incorrect Type Conversion or Cast'
technology:
- django
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/python.django.security.nan-injection.nan-injection
shortlink: https://sg.run/Og7L
semgrep.dev:
rule:
r_id: 18275
rv_id: 946193
rule_id: DbUGvk
version_id: NdTqk7G
url: https://semgrep.dev/playground/r/NdTqk7G/python.django.security.nan-injection.nan-injection
origin: community
- id: python.flask.security.injection.nan-injection.nan-injection
message: Found user input going directly into typecast for bool(), float(), or complex().
This allows an attacker to inject Python's not-a-number (NaN) into the typecast.
This results in undefind behavior, particularly when doing comparisons. Either
cast to a different type, or add a guard checking for all capitalizations of the
string 'nan'.
languages:
- python
severity: ERROR
mode: taint
pattern-sources:
- pattern-either:
- pattern: flask.request.$SOMETHING.get(...)
- pattern: flask.request.$SOMETHING[...]
- patterns:
- pattern-inside: |
@$APP.route(...)
def $FUNC(..., $ROUTEVAR, ...):
...
- pattern: $ROUTEVAR
pattern-sinks:
- pattern-either:
- pattern: float(...)
- pattern: bool(...)
- pattern: complex(...)
pattern-sanitizers:
- not_conflicting: true
pattern: $ANYTHING(...)
metadata:
references:
- https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868
- https://blog.bitdiscovery.com/2021/12/python-nan-injection/
category: security
cwe:
- 'CWE-704: Incorrect Type Conversion or Cast'
technology:
- flask
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/python.flask.security.injection.nan-injection.nan-injection
shortlink: https://sg.run/e598
semgrep.dev:
rule:
r_id: 18276
rv_id: 946222
rule_id: WAUdj7
version_id: qkT4j85
url: https://semgrep.dev/playground/r/qkT4j85/python.flask.security.injection.nan-injection.nan-injection
origin: community
- id: ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli
languages:
- ruby
message: 'Detected SQL statement that is tainted by `event` object. This could lead
to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `Example.find_by_sql ["SELECT
title FROM posts WHERE author = ? AND created > ?", author_id, start_date]`'
mode: taint
metadata:
references:
- https://guides.rubyonrails.org/active_record_querying.html#finding-by-sql
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- active-record
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli
shortlink: https://sg.run/vXvY
semgrep.dev:
rule:
r_id: 18277
rv_id: 1263581
rule_id: 0oUw9g
version_id: w8TRor7
url: https://semgrep.dev/playground/r/w8TRor7/ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli
origin: community
pattern-sinks:
- patterns:
- pattern: $QUERY
- pattern-either:
- pattern: ActiveRecord::Base.connection.execute($QUERY,...)
- pattern: $MODEL.find_by_sql($QUERY,...)
- pattern: $MODEL.select_all($QUERY,...)
- pattern-inside: |
require 'active_record'
...
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context)
...
end
severity: WARNING
- id: ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli
languages:
- ruby
message: 'Detected SQL statement that is tainted by `event` object. This could lead
to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use sanitize statements like so: `escaped = client.escape(user_input)`'
mode: taint
metadata:
references:
- https://github.com/brianmario/mysql2
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- mysql2
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli
shortlink: https://sg.run/dJLE
semgrep.dev:
rule:
r_id: 18278
rv_id: 1263582
rule_id: KxUrQ3
version_id: xyTjzOe
url: https://semgrep.dev/playground/r/xyTjzOe/ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli
origin: community
pattern-sinks:
- patterns:
- pattern: $QUERY
- pattern-either:
- pattern: $CLIENT.query($QUERY,...)
- pattern: $CLIENT.prepare($QUERY,...)
- pattern-inside: |
require 'mysql2'
...
pattern-sanitizers:
- pattern: $CLIENT.escape(...)
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context)
...
end
severity: WARNING
- id: ruby.aws-lambda.security.pg-sqli.pg-sqli
languages:
- ruby
message: 'Detected SQL statement that is tainted by `event` object. This could lead
to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `conn.exec_params(''SELECT
$1 AS a, $2 AS b, $3 AS c'', [1, 2, nil])`'
mode: taint
metadata:
references:
- https://www.rubydoc.info/gems/pg/PG/Connection
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- postgres
- pg
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/ruby.aws-lambda.security.pg-sqli.pg-sqli
shortlink: https://sg.run/ZKww
semgrep.dev:
rule:
r_id: 18279
rv_id: 1263583
rule_id: qNUQee
version_id: O9Tpxz7
url: https://semgrep.dev/playground/r/O9Tpxz7/ruby.aws-lambda.security.pg-sqli.pg-sqli
origin: community
pattern-sinks:
- patterns:
- pattern: $QUERY
- pattern-either:
- pattern: $CONN.exec($QUERY,...)
- pattern: $CONN.exec_params($QUERY,...)
- pattern: $CONN.exec_prepared($QUERY,...)
- pattern: $CONN.async_exec($QUERY,...)
- pattern: $CONN.async_exec_params($QUERY,...)
- pattern: $CONN.async_exec_prepared($QUERY,...)
- pattern-inside: |
require 'pg'
...
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context)
...
end
severity: WARNING
- id: ruby.aws-lambda.security.sequel-sqli.sequel-sqli
languages:
- ruby
message: 'Detected SQL statement that is tainted by `event` object. This could lead
to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `DB[''select * from items
where name = ?'', name]`'
mode: taint
metadata:
references:
- https://github.com/jeremyevans/sequel#label-Arbitrary+SQL+queries
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- sequel
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/ruby.aws-lambda.security.sequel-sqli.sequel-sqli
shortlink: https://sg.run/n9vY
semgrep.dev:
rule:
r_id: 18280
rv_id: 1263584
rule_id: lBUy2N
version_id: e1Tyj5j
url: https://semgrep.dev/playground/r/e1Tyj5j/ruby.aws-lambda.security.sequel-sqli.sequel-sqli
origin: community
pattern-sinks:
- patterns:
- pattern: $QUERY
- pattern-either:
- pattern: DB[$QUERY,...]
- pattern: DB.run($QUERY,...)
- pattern-inside: |
require 'sequel'
...
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context)
...
end
severity: WARNING
- id: ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string
languages:
- ruby
severity: ERROR
message: Detected user input used to manually construct a SQL string. This is usually
bad practice because manual construction could accidentally result in a SQL injection.
An attacker could use a SQL injection to steal or modify contents of the database.
Instead, use a parameterized query which is available by default in most database
engines. Alternatively, consider using an object-relational mapper (ORM) such
as Sequelize which will protect your queries.
metadata:
references:
- https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string
shortlink: https://sg.run/EB7N
semgrep.dev:
rule:
r_id: 18281
rv_id: 1263586
rule_id: PeUxOE
version_id: d6Tyx1Z
url: https://semgrep.dev/playground/r/d6Tyx1Z/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context)
...
end
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: |
"...#{...}..."
- pattern-regex: (?i)(select|delete|insert|create|update|alter|drop)\b|\w+\s*!?[<>=].*
- patterns:
- pattern-either:
- pattern: Kernel::sprintf("$SQLSTR", ...)
- pattern: |
"$SQLSTR" + $EXPR
- pattern: |
"$SQLSTR" % $EXPR
- metavariable-regex:
metavariable: $SQLSTR
regex: (?i)(select|delete|insert|create|update|alter|drop)\b|\w+\s*!?[<>=].*
- pattern-not-inside: |
puts(...)
- id: scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run
patterns:
- pattern: Seq($CMD, ...)
- pattern-not: Seq("...", ...)
- pattern-inside: |
import sys.process
...
- pattern-not-inside: |
$CMD = "..."
...
- pattern-either:
- pattern-inside: Seq(...).!
- pattern-inside: Seq(...).!!
- pattern-inside: Seq(...).lazyLines
message: Found dynamic content used for the external process. This is dangerous
if arbitrary data can reach this function call because it allows a malicious actor
to execute commands. Ensure your variables are not controlled by users or sufficiently
sanitized.
languages:
- scala
severity: ERROR
metadata:
category: security
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
technology:
- scala
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run
shortlink: https://sg.run/79b2
semgrep.dev:
rule:
r_id: 18282
rv_id: 1263670
rule_id: JDUle4
version_id: zyTb2zJ
url: https://semgrep.dev/playground/r/zyTb2zJ/scala.lang.security.audit.dangerous-seq-run.dangerous-seq-run
origin: community
- id: scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run
patterns:
- pattern: Seq($SH, "-c", $CMD, ...)
- pattern-not: Seq($SH, "-c", "...", ...)
- pattern-inside: |
import sys.process
...
- pattern-not-inside: |
$CMD = "..."
...
- pattern-either:
- pattern-inside: Seq(...).!
- pattern-inside: Seq(...).!!
- pattern-inside: Seq(...).lazyLines
- metavariable-regex:
metavariable: $SH
regex: '"(sh|bash|ksh|csh|tcsh|zsh)"'
message: Found dynamic content used for the external process. This is dangerous
if arbitrary data can reach this function call because it allows a malicious actor
to execute commands. Ensure your variables are not controlled by users or sufficiently
sanitized.
languages:
- scala
severity: ERROR
metadata:
category: security
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
technology:
- scala
confidence: LOW
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run
shortlink: https://sg.run/Lg76
semgrep.dev:
rule:
r_id: 18283
rv_id: 1263671
rule_id: 5rUy3K
version_id: pZT03ED
url: https://semgrep.dev/playground/r/pZT03ED/scala.lang.security.audit.dangerous-shell-run.dangerous-shell-run
origin: community
- id: scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings
patterns:
- pattern: secure = false
- pattern-inside: |
session = {
...
}
message: Session cookie `Secure` flag is explicitly disabled. The `secure` flag
for cookies prevents the client from transmitting the cookie over insecure channels
such as HTTP. Set the `Secure` flag by setting `secure` to `true` in configuration
file.
languages:
- generic
severity: WARNING
paths:
include:
- '*.conf'
metadata:
category: security
references:
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#security
- https://www.playframework.com/documentation/2.8.x/SettingsSession#Session-Configuration
technology:
- play
- scala
cwe:
- 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute'
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
confidence: MEDIUM
subcategory:
- vuln
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cookie Security
source: https://semgrep.dev/r/scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings
shortlink: https://sg.run/8z8N
semgrep.dev:
rule:
r_id: 18284
rv_id: 1263685
rule_id: GdUDJO
version_id: e1TyjJv
url: https://semgrep.dev/playground/r/e1TyjJv/scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings
origin: community
- id: scala.play.security.tainted-slick-sqli.tainted-slick-sqli
mode: taint
metadata:
references:
- https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values
- https://scala-slick.org/doc/3.2.0/sql-to-slick.html#non-optimal-sql-code
category: security
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
technology:
- scala
- slick
- play
confidence: HIGH
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/scala.play.security.tainted-slick-sqli.tainted-slick-sqli
shortlink: https://sg.run/k9K2
semgrep.dev:
rule:
r_id: 18328
rv_id: 1263687
rule_id: GdUDWO
version_id: d6TyxJe
url: https://semgrep.dev/playground/r/d6TyxJe/scala.play.security.tainted-slick-sqli.tainted-slick-sqli
origin: community
message: Detected a tainted SQL statement. This could lead to SQL injection if variables
in the SQL statement are not properly sanitized. Avoid using using user input
for generating SQL strings.
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern: $REQ
- pattern-either:
- pattern-inside: "Action {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action(...) {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action.async {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action.async(...) {\n $REQ: Request[$T] => \n ...\n}\n"
- patterns:
- pattern: $PARAM
- pattern-either:
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action(...) {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action.async {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action.async(...) {
...
}
pattern-sinks:
- patterns:
- pattern-either:
- pattern: $MODEL.overrideSql(...)
- pattern: sql"..."
- pattern-inside: |
import slick.$DEPS
...
severity: ERROR
languages:
- scala
- id: scala.play.security.webservice-ssrf.webservice-ssrf
patterns:
- pattern: $WS.url($URL)
- pattern-either:
- pattern-inside: |
class $CLASS (..., $WS: WSClient, ...) {
...
}
- pattern-inside: |
def $FUNC(..., $WS: WSClient, ...) = {
...
}
- pattern-inside: |
$WS = AhcWSClient(...)
...
- pattern-either:
- pattern-inside: |
def $FUNC(..., $URL: $T, ...) = $A {
...
}
- pattern-inside: |
def $FUNC(..., $URL: $T, ...) = {
...
}
message: A parameter being passed directly into `WSClient` most likely lead to SSRF.
This could allow an attacker to send data to their own server, potentially exposing
sensitive data sent with this request. They could also probe internal servers
or other resources that the server running this code can access. Do not allow
arbitrary hosts. Instead, create an allowlist for approved hosts hardcode the
correct host.
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
- https://www.playframework.com/documentation/2.8.x/ScalaWS
category: security
technology:
- scala
- play
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/scala.play.security.webservice-ssrf.webservice-ssrf
shortlink: https://sg.run/reRR
semgrep.dev:
rule:
r_id: 18369
rv_id: 1263690
rule_id: PeUxEE
version_id: ExTExz1
url: https://semgrep.dev/playground/r/ExTExz1/scala.play.security.webservice-ssrf.webservice-ssrf
origin: community
languages:
- scala
severity: WARNING
- id: go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check
patterns:
- pattern-inside: |
import ("github.com/gorilla/websocket")
...
- patterns:
- pattern-not-inside: |
$UPGRADER = websocket.Upgrader{..., CheckOrigin: $FN ,...}
...
- pattern-not-inside: |
$UPGRADER.CheckOrigin = $FN2
...
- pattern: |
$UPGRADER.Upgrade(...)
message: 'The Origin header in the HTTP WebSocket handshake is used to guarantee
that the connection accepted by the WebSocket is from a trusted origin domain.
Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per "gorilla/websocket"
documentation: "A CheckOrigin function should carefully validate the request origin
to prevent cross-site request forgery."'
languages:
- go
severity: WARNING
metadata:
category: security
cwe:
- 'CWE-352: Cross-Site Request Forgery (CSRF)'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://pkg.go.dev/github.com/gorilla/websocket#Upgrader
technology:
- gorilla
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site Request Forgery (CSRF)
source: https://semgrep.dev/r/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check
shortlink: https://sg.run/xXpz
semgrep.dev:
rule:
r_id: 18430
rv_id: 1262914
rule_id: ReUKdz
version_id: qkTR7RP
url: https://semgrep.dev/playground/r/qkTR7RP/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check
origin: community
- id: scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf
patterns:
- pattern: Http($URL)
- pattern-inside: |
import scalaj.http.$HTTP
...
- pattern-either:
- pattern-inside: |
def $FUNC(..., $URL: $T, ...) = $A {
...
}
- pattern-inside: |
def $FUNC(..., $URL: $T, ...) = {
...
}
message: A parameter being passed directly into `Http` can likely lead to SSRF.
This could allow an attacker to send data to their own server, potentially exposing
sensitive data sent with this request. They could also probe internal servers
or other resources that the server running this code can access. Do not allow
arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode
the correct host.
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
- https://github.com/scalaj/scalaj-http#simplified-http
category: security
technology:
- scala
- scalaj-http
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf
shortlink: https://sg.run/OgjB
semgrep.dev:
rule:
r_id: 18431
rv_id: 1263680
rule_id: AbU3xA
version_id: NdTzy7D
url: https://semgrep.dev/playground/r/NdTzy7D/scala.lang.security.audit.scalaj-http-ssrf.scalaj-http-ssrf
origin: community
languages:
- scala
severity: WARNING
- id: javascript.aws-lambda.security.tainted-html-string.tainted-html-string
message: Detected user input flowing into a manually constructed HTML string. You
may be accidentally bypassing secure methods of rendering HTML by manually constructing
HTML and this could create a cross-site scripting vulnerability, which could let
attackers steal sensitive user data. To be sure this is safe, check that the HTML
is rendered safely. Otherwise, use templates which will safely render HTML instead.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-string.tainted-html-string
shortlink: https://sg.run/Lgqr
semgrep.dev:
rule:
r_id: 18483
rv_id: 1263112
rule_id: PeUxwW
version_id: DkTRbvp
url: https://semgrep.dev/playground/r/DkTRbvp/javascript.aws-lambda.security.tainted-html-string.tainted-html-string
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
exports.handler = function ($EVENT, ...) {
...
}
- pattern-inside: |
function $FUNC ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern-inside: |
$FUNC = function ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern: $EVENT
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: |
"$HTMLSTR" + $EXPR
- pattern: |
"$HTMLSTR".concat(...)
- pattern: $UTIL.format($HTMLSTR, ...)
- pattern: format($HTMLSTR, ...)
- metavariable-pattern:
metavariable: $HTMLSTR
language: generic
pattern: <$TAG ...
- patterns:
- pattern: |
`...${...}...`
- pattern-regex: |
.*<\w+.*
- pattern-not-inside: |
console.$LOG(...)
- id: python.aws-lambda.security.tainted-html-string.tainted-html-string
languages:
- python
severity: WARNING
message: Detected user input flowing into a manually constructed HTML string. You
may be accidentally bypassing secure methods of rendering HTML by manually constructing
HTML and this could create a cross-site scripting vulnerability, which could let
attackers steal sensitive user data. To be sure this is safe, check that the HTML
is rendered safely. Otherwise, use templates which will safely render HTML instead.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- aws-lambda
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.aws-lambda.security.tainted-html-string.tainted-html-string
shortlink: https://sg.run/8zNy
semgrep.dev:
rule:
r_id: 18484
rv_id: 1263344
rule_id: JDUlwy
version_id: 7ZTE36K
url: https://semgrep.dev/playground/r/7ZTE36K/python.aws-lambda.security.tainted-html-string.tainted-html-string
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: '"$HTMLSTR" % ...'
- pattern: '"$HTMLSTR".format(...)'
- pattern: '"$HTMLSTR" + ...'
- pattern: f"$HTMLSTR{...}..."
- patterns:
- pattern-inside: |
$HTML = "$HTMLSTR"
...
- pattern-either:
- pattern: $HTML % ...
- pattern: $HTML.format(...)
- pattern: $HTML + ...
- metavariable-pattern:
metavariable: $HTMLSTR
language: generic
pattern: <$TAG ...
- pattern-not-inside: |
print(...)
- id: scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf
patterns:
- pattern: url($URL)
- pattern-inside: |
import dispatch._
...
- pattern-either:
- pattern-inside: |
def $FUNC(..., $URL: $T, ...) = $A {
...
}
- pattern-inside: |
def $FUNC(..., $URL: $T, ...) = {
...
}
message: A parameter being passed directly into `url` most likely lead to SSRF.
This could allow an attacker to send data to their own server, potentially exposing
sensitive data sent with this request. They could also probe internal servers
or other resources that the server running this code can access. Do not allow
arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode
the correct host.
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
- https://dispatchhttp.org/Dispatch.html
category: security
technology:
- scala
- dispatch
confidence: LOW
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf
shortlink: https://sg.run/gR6J
semgrep.dev:
rule:
r_id: 18485
rv_id: 1263672
rule_id: 5rUyl4
version_id: 2KTv282
url: https://semgrep.dev/playground/r/2KTv282/scala.lang.security.audit.dispatch-ssrf.dispatch-ssrf
origin: community
languages:
- scala
severity: WARNING
- id: scala.lang.security.audit.io-source-ssrf.io-source-ssrf
patterns:
- pattern-either:
- pattern: Source.fromURL($URL,...)
- pattern: Source.fromURI($URL,...)
- pattern-inside: |
import scala.io.$SOURCE
...
- pattern-either:
- pattern-inside: |
def $FUNC(..., $URL: $T, ...) = $A {
...
}
- pattern-inside: |
def $FUNC(..., $URL: $T, ...) = {
...
}
message: A parameter being passed directly into `fromURL` most likely lead to SSRF.
This could allow an attacker to send data to their own server, potentially exposing
sensitive data sent with this request. They could also probe internal servers
or other resources that the server running this code can access. Do not allow
arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode
the correct host.
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
- https://www.scala-lang.org/api/current/scala/io/Source$.html#fromURL(url:java.net.URL)(implicitcodec:scala.io.Codec):scala.io.BufferedSource
category: security
technology:
- scala
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/scala.lang.security.audit.io-source-ssrf.io-source-ssrf
shortlink: https://sg.run/Qbz4
semgrep.dev:
rule:
r_id: 18486
rv_id: 1263675
rule_id: GdUDOZ
version_id: 1QTypG9
url: https://semgrep.dev/playground/r/1QTypG9/scala.lang.security.audit.io-source-ssrf.io-source-ssrf
origin: community
languages:
- scala
severity: WARNING
- id: scala.lang.security.audit.scalac-debug.scalac-debug
patterns:
- pattern-either:
- pattern: scalacOptions ... "-Vdebug"
- pattern: scalacOptions ... "-Ydebug"
message: Scala applications built with `debug` set to true in production may leak
debug information to attackers. Debug mode also affects performance and reliability.
Remove it from configuration.
languages:
- generic
severity: WARNING
paths:
include:
- '*.sbt*'
metadata:
category: security
cwe:
- 'CWE-489: Active Debug Code'
owasp: A05:2021 - Security Misconfiguration
technology:
- scala
- sbt
references:
- https://docs.scala-lang.org/overviews/compiler-options/index.html
confidence: MEDIUM
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Active Debug Code
source: https://semgrep.dev/r/scala.lang.security.audit.scalac-debug.scalac-debug
shortlink: https://sg.run/QbGd
semgrep.dev:
rule:
r_id: 18686
rv_id: 946569
rule_id: JDUlE0
version_id: qkT4j0N
url: https://semgrep.dev/playground/r/qkT4j0N/scala.lang.security.audit.scalac-debug.scalac-debug
origin: community
- id: scala.play.security.tainted-html-response.tainted-html-response
mode: taint
metadata:
category: security
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
technology:
- scala
- play
confidence: MEDIUM
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/scala.play.security.tainted-html-response.tainted-html-response
shortlink: https://sg.run/BG96
semgrep.dev:
rule:
r_id: 18795
rv_id: 1263686
rule_id: 0oUwn2
version_id: vdT06yj
url: https://semgrep.dev/playground/r/vdT06yj/scala.play.security.tainted-html-response.tainted-html-response
origin: community
message: Detected a request with potential user-input going into an `Ok()` response.
This bypasses any view or template environments, including HTML escaping, which
may expose this application to cross-site scripting (XSS) vulnerabilities. Consider
using a view technology such as Twirl which automatically escapes HTML views.
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern: $REQ
- pattern-either:
- pattern-inside: "Action {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action(...) {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action.async {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action.async(...) {\n $REQ: Request[$T] => \n ...\n}\n"
- patterns:
- pattern: $PARAM
- pattern-either:
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action(...) {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action.async {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action.async(...) {
...
}
pattern-sanitizers:
- pattern-either:
- pattern: org.apache.commons.lang3.StringEscapeUtils.escapeHtml4(...)
- pattern: org.owasp.encoder.Encode.forHtml(...)
pattern-sinks:
- pattern-either:
- pattern: Html.apply(...)
- pattern: Ok(...).as(HTML)
- pattern: Ok(...).as(ContentTypes.HTML)
- patterns:
- pattern: Ok(...).as($CTYPE)
- metavariable-regex:
metavariable: $CTYPE
regex: '"[tT][eE][xX][tT]/[hH][tT][mM][lL]"'
- patterns:
- pattern: Ok(...).as($CTYPE)
- pattern-not: Ok(...).as("...")
- pattern-either:
- pattern-inside: |
def $FUNC(..., $URL: $T, ...) = $A {
...
}
- pattern-inside: |
def $FUNC(..., $URL: $T, ...) = {
...
}
severity: WARNING
languages:
- scala
- id: php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv
patterns:
- pattern-either:
- pattern: openssl_encrypt($D, $M, $K, $FLAGS, "...",...);
- pattern: openssl_decrypt($D, $M, $K, $FLAGS, "...",...);
- metavariable-comparison:
metavariable: $M
comparison: re.match(".*-CBC",$M)
message: Static IV used with AES in CBC mode. Static IVs enable chosen-plaintext
attacks against encrypted data.
languages:
- php
severity: ERROR
metadata:
cwe:
- 'CWE-329: Generation of Predictable IV with CBC Mode'
references:
- https://csrc.nist.gov/publications/detail/sp/800-38a/final
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
technology:
- php
- openssl
category: security
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv
shortlink: https://sg.run/LgWJ
semgrep.dev:
rule:
r_id: 19039
rv_id: 1263295
rule_id: DbUGbE
version_id: JdTzxOD
url: https://semgrep.dev/playground/r/JdTzxOD/php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv
origin: community
- id: scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode
patterns:
- pattern-inside: |
import pdi.jwt.$DEPS
...
- pattern-either:
- pattern: $JWT.encode($X, "...", ...)
- pattern: $JWT.decode($X, "...", ...)
- pattern: $JWT.decodeRawAll($X, "...", ...)
- pattern: $JWT.decodeRaw($X, "...", ...)
- pattern: $JWT.decodeAll($X, "...", ...)
- pattern: $JWT.validate($X, "...", ...)
- pattern: $JWT.isValid($X, "...", ...)
- pattern: $JWT.decodeJson($X, "...", ...)
- pattern: $JWT.decodeJsonAll($X, "...", ...)
- patterns:
- pattern-either:
- pattern: $JWT.encode($X, $KEY, ...)
- pattern: $JWT.decode($X, $KEY, ...)
- pattern: $JWT.decodeRawAll($X, $KEY, ...)
- pattern: $JWT.decodeRaw($X, $KEY, ...)
- pattern: $JWT.decodeAll($X, $KEY, ...)
- pattern: $JWT.validate($X, $KEY, ...)
- pattern: $JWT.isValid($X, $KEY, ...)
- pattern: $JWT.decodeJson($X, $KEY, ...)
- pattern: $JWT.decodeJsonAll($X, $KEY, ...)
- pattern: $JWT.encode($X, this.$KEY, ...)
- pattern: $JWT.decode($X, this.$KEY, ...)
- pattern: $JWT.decodeRawAll($X, this.$KEY, ...)
- pattern: $JWT.decodeRaw($X, this.$KEY, ...)
- pattern: $JWT.decodeAll($X, this.$KEY, ...)
- pattern: $JWT.validate($X, this.$KEY, ...)
- pattern: $JWT.isValid($X, this.$KEY, ...)
- pattern: $JWT.decodeJson($X, this.$KEY, ...)
- pattern: $JWT.decodeJsonAll($X, this.$KEY, ...)
- pattern-either:
- pattern-inside: |
class $CL {
...
$KEY = "..."
...
}
- pattern-inside: |
object $CL {
...
$KEY = "..."
...
}
- metavariable-pattern:
metavariable: $JWT
patterns:
- pattern-either:
- pattern: Jwt
- pattern: JwtArgonaut
- pattern: JwtCirce
- pattern: JwtJson4s
- pattern: JwtJson
- pattern: JwtUpickle
message: 'Hardcoded JWT secret or private key is used. This is a Insufficiently
Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html
Consider using an appropriate security mechanism to protect the credentials (e.g.
keeping secrets in environment variables)'
languages:
- scala
severity: WARNING
metadata:
references:
- https://jwt-scala.github.io/jwt-scala/
category: security
cwe:
- 'CWE-522: Insufficiently Protected Credentials'
owasp:
- A02:2017 - Broken Authentication
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
technology:
- scala
confidence: HIGH
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode
shortlink: https://sg.run/8zE7
semgrep.dev:
rule:
r_id: 19040
rv_id: 1263669
rule_id: WAUdK0
version_id: o5TbDA8
url: https://semgrep.dev/playground/r/o5TbDA8/scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode
origin: community
- id: scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled
patterns:
- pattern-either:
- pattern: |
$DF = DocumentBuilderFactory.newInstance(...)
...
$DB = $DF.newDocumentBuilder(...)
- patterns:
- pattern: $DB = DocumentBuilderFactory.newInstance(...)
- pattern-not-inside: |
...
$X = $DB.newDocumentBuilder(...)
- pattern: $DB = DocumentBuilderFactory.newInstance(...).newDocumentBuilder(...)
- pattern-not-inside: |
...
$DB.setXIncludeAware(true)
...
$DB.setNamespaceAware(true)
...
$DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
...
$DB.setFeature("http://xml.org/sax/features/external-general-entities", false)
...
$DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
- pattern-not-inside: |
...
$DB.setXIncludeAware(true)
...
$DB.setNamespaceAware(true)
...
$DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
...
$DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
...
$DB.setFeature("http://xml.org/sax/features/external-general-entities", false)
- pattern-not-inside: |
...
$DB.setXIncludeAware(true)
...
$DB.setNamespaceAware(true)
...
$DB.setFeature("http://xml.org/sax/features/external-general-entities", false)
...
$DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
...
$DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
- pattern-not-inside: |
...
$DB.setXIncludeAware(true)
...
$DB.setNamespaceAware(true)
...
$DB.setFeature("http://xml.org/sax/features/external-general-entities", false)
...
$DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
...
$DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
message: Document Builder being instantiated without calling the `setFeature` functions
that are generally used for disabling entity processing. User controlled data
in XML Document builder can result in XML Internal Entity Processing vulnerabilities
like the disclosure of confidential data, denial of service, Server Side Request
Forgery (SSRF), port scanning. Make sure to disable entity processing functionality.
languages:
- scala
severity: WARNING
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
category: security
technology:
- scala
confidence: HIGH
references:
- https://owasp.org/Top10/A05_2021-Security_Misconfiguration
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled
shortlink: https://sg.run/gRQn
semgrep.dev:
rule:
r_id: 19041
rv_id: 1263673
rule_id: 0oUwzP
version_id: X0TzyRq
url: https://semgrep.dev/playground/r/X0TzyRq/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled
origin: community
- id: scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled
patterns:
- pattern-either:
- pattern: $SR = new SAXReader(...)
- pattern: |
$SF = SAXParserFactory.newInstance(...)
...
$SR = $SF.newSAXParser(...)
- patterns:
- pattern: $SR = SAXParserFactory.newInstance(...)
- pattern-not-inside: |
...
$X = $SR.newSAXParser(...)
- pattern: $SR = SAXParserFactory.newInstance(...).newSAXParser(...)
- pattern: $SR = new SAXBuilder(...)
- pattern-not-inside: |
...
$SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
...
$SR.setFeature("http://xml.org/sax/features/external-general-entities", false)
...
$SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
- pattern-not-inside: |
...
$SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
...
$SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
...
$SR.setFeature("http://xml.org/sax/features/external-general-entities", false)
- pattern-not-inside: |
...
$SR.setFeature("http://xml.org/sax/features/external-general-entities", false)
...
$SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
...
$SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
- pattern-not-inside: |
...
$SR.setFeature("http://xml.org/sax/features/external-general-entities", false)
...
$SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
...
$SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
message: XML processor being instantiated without calling the `setFeature` functions
that are generally used for disabling entity processing. User controlled data
in XML Parsers can result in XML Internal Entity Processing vulnerabilities like
the disclosure of confidential data, denial of service, Server Side Request Forgery
(SSRF), port scanning. Make sure to disable entity processing functionality.
languages:
- scala
severity: WARNING
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
category: security
technology:
- scala
confidence: HIGH
references:
- https://owasp.org/Top10/A05_2021-Security_Misconfiguration
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled
shortlink: https://sg.run/QbYP
semgrep.dev:
rule:
r_id: 19042
rv_id: 1263678
rule_id: KxUrkq
version_id: rxTAKWY
url: https://semgrep.dev/playground/r/rxTAKWY/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled
origin: community
- id: scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled
patterns:
- pattern-not-inside: |
...
$XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", false)
- pattern-either:
- pattern: $XMLFACTORY = XMLInputFactory.newFactory(...)
- pattern: $XMLFACTORY = XMLInputFactory.newInstance(...)
- pattern: $XMLFACTORY = new XMLInputFactory(...)
message: XMLInputFactory being instantiated without calling the setProperty functions
that are generally used for disabling entity processing. User controlled data
in XML Document builder can result in XML Internal Entity Processing vulnerabilities
like the disclosure of confidential data, denial of service, Server Side Request
Forgery (SSRF), port scanning. Make sure to disable entity processing functionality.
languages:
- scala
severity: WARNING
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
category: security
technology:
- scala
confidence: HIGH
references:
- https://owasp.org/Top10/A05_2021-Security_Misconfiguration
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled
shortlink: https://sg.run/3BEb
semgrep.dev:
rule:
r_id: 19043
rv_id: 1263683
rule_id: qNUQ7w
version_id: xyTjzkA
url: https://semgrep.dev/playground/r/xyTjzkA/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled
origin: community
- id: terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version
pattern: |
resource "aws_elasticsearch_domain" $ANYTHING {
...
domain_endpoint_options {
...
enforce_https = true
tls_security_policy = "Policy-Min-TLS-1-0-2019-07"
...
}
...
}
message: Detected an AWS Elasticsearch domain using an insecure version of TLS.
To fix this, set "tls_security_policy" equal to "Policy-Min-TLS-1-2-2019-07".
languages:
- terraform
severity: WARNING
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
category: security
technology:
- aws
- terraform
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version
shortlink: https://sg.run/PYlq
semgrep.dev:
rule:
r_id: 19045
rv_id: 1263718
rule_id: YGUle7
version_id: DkTRbA5
url: https://semgrep.dev/playground/r/DkTRbA5/terraform.aws.security.aws-elasticsearch-insecure-tls-version.aws-elasticsearch-insecure-tls-version
origin: community
- id: javascript.express.security.express-insecure-template-usage.express-insecure-template-usage
message: User data from `$REQ` is being compiled into the template, which can lead
to a Server Side Template Injection (SSTI) vulnerability.
options:
interfile: true
metadata:
interfile: true
category: security
cwe:
- 'CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine'
owasp:
- A03:2021 - Injection
- A01:2017 - Injection
- A05:2025 - Injection
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html
technology:
- javascript
- typescript
- express
- pug
- jade
- dot
- ejs
- nunjucks
- lodash
- handlbars
- mustache
- hogan.js
- eta
- squirrelly
source_rule_url:
- https://github.com/github/codeql/blob/2ba2642c7ab29b9eedef33bcc2b8cd1d203d0c10/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/template-sinks.js
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage
shortlink: https://sg.run/b49v
semgrep.dev:
rule:
r_id: 19226
rv_id: 1263165
rule_id: EwUr9k
version_id: zyTb2eD
url: https://semgrep.dev/playground/r/zyTb2eD/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-propagators:
- pattern: $MODEL.$FIND($E).then((...,$S,...)=>{...})
from: $E
to: $S
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
$PUG = require('pug')
...
- pattern-inside: |
import * as $PUG from 'pug'
...
- pattern-inside: |
$PUG = require('jade')
...
- pattern-inside: |
import * as $PUG from 'jade'
...
- pattern-either:
- pattern: $PUG.compile(...)
- pattern: $PUG.compileClient(...)
- pattern: $PUG.compileClientWithDependenciesTracked(...)
- pattern: $PUG.render(...)
- patterns:
- pattern-either:
- pattern-inside: |
$PUG = require('dot')
...
- pattern-inside: |
import * as $PUG from 'dot'
...
- pattern-either:
- pattern: $PUG.template(...)
- pattern: $PUG.compile(...)
- patterns:
- pattern-either:
- pattern-inside: |
$PUG = require('ejs')
...
- pattern-inside: |
import * as $PUG from 'ejs'
...
- pattern-either:
- pattern: $PUG.render(...)
- patterns:
- pattern-either:
- pattern-inside: |
$PUG = require('nunjucks')
...
- pattern-inside: |
import * as $PUG from 'nunjucks'
...
- pattern-either:
- pattern: $PUG.renderString(...)
- patterns:
- pattern-either:
- pattern-inside: |
$PUG = require('lodash')
...
- pattern-inside: |
import * as $PUG from 'lodash'
...
- pattern-either:
- pattern: $PUG.template(...)
- patterns:
- pattern-either:
- pattern-inside: |
$PUG = require('mustache')
...
- pattern-inside: |
import * as $PUG from 'mustache'
...
- pattern-inside: |
$PUG = require('eta')
...
- pattern-inside: |
import * as $PUG from 'eta'
...
- pattern-inside: |
$PUG = require('squirrelly')
...
- pattern-inside: |
import * as $PUG from 'squirrelly'
...
- pattern-either:
- pattern: $PUG.render(...)
- patterns:
- pattern-either:
- pattern-inside: |
$PUG = require('hogan.js')
...
- pattern-inside: |
import * as $PUG from 'hogan.js'
...
- pattern-inside: |
$PUG = require('handlebars')
...
- pattern-inside: |
import * as $PUG from 'handlebars'
...
- pattern-either:
- pattern: $PUG.compile(...)
- id: ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include
mode: taint
pattern-sources:
- patterns:
- pattern: params[...]
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
render ..., file: $X
- pattern: |
render ..., inline: $X
- pattern: |
render ..., template: $X
- pattern: |
render ..., action: $X
- pattern: |
render $X, ...
- focus-metavariable: $X
pattern-sanitizers:
- patterns:
- pattern: $MAP[...]
- metavariable-pattern:
metavariable: $MAP
patterns:
- pattern-not-regex: params
- pattern: File.basename(...)
message: Found request parameters in a call to `render`. This can allow end users
to request arbitrary local files which may result in leaking sensitive information
persisted on disk. Where possible, avoid letting users specify template paths
for `render`. If you must allow user input, use an allow-list of known templates
or normalize the user-supplied value with `File.basename(...)`.
languages:
- ruby
severity: WARNING
metadata:
technology:
- ruby
- rails
category: security
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_render.rb
references:
- https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion
- https://github.com/presidentbeef/brakeman/blob/f74cb53/test/apps/rails2/app/controllers/home_controller.rb#L48-L60
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
vulnerability_class:
- Path Traversal
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include
shortlink: https://sg.run/Jw8Z
semgrep.dev:
rule:
r_id: 20046
rv_id: 1409407
rule_id: ReU2pZ
version_id: K3TgANN
url: https://semgrep.dev/playground/r/K3TgANN/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include
origin: community
- id: ruby.rails.security.brakeman.check-send-file.check-send-file
mode: taint
pattern-sources:
- pattern-either:
- pattern: |
cookies[...]
- patterns:
- pattern: |
cookies. ... .$PROPERTY[...]
- metavariable-regex:
metavariable: $PROPERTY
regex: (?!signed|encrypted)
- pattern: |
params[...]
- pattern: |
request.env[...]
pattern-sinks:
- patterns:
- pattern: |
send_file ...
message: Allowing user input to `send_file` allows a malicious user to potentially
read arbitrary files from the server. Avoid accepting user input in `send_file`
or normalize with `File.basename(...)`
languages:
- ruby
severity: ERROR
metadata:
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_send_file.rb
category: security
cwe:
- 'CWE-73: External Control of File Name or Path'
owasp:
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
technology:
- ruby
- rails
references:
- https://owasp.org/www-community/attacks/Path_Traversal
- https://owasp.org/Top10/A01_2021-Broken_Access_Control/
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-send-file.check-send-file
shortlink: https://sg.run/GbY1
semgrep.dev:
rule:
r_id: 20048
rv_id: 1263660
rule_id: BYUKbl
version_id: BjTkZRj
url: https://semgrep.dev/playground/r/BjTkZRj/ruby.rails.security.brakeman.check-send-file.check-send-file
origin: community
- id: scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request
languages:
- scala
severity: ERROR
mode: taint
message: User data flows into this manually-constructed SQL string. User data can
be safely inserted into SQL strings using prepared statements or an object-relational
mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL
injection, which could let an attacker steal or manipulate data from the database.
Instead, use prepared statements (`connection.PreparedStatement`) or a safe library.
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html
category: security
technology:
- scala
- play
confidence: HIGH
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request
shortlink: https://sg.run/BeW9
semgrep.dev:
rule:
r_id: 20051
rv_id: 1263688
rule_id: 0oUpon
version_id: ZRTKAoG
url: https://semgrep.dev/playground/r/ZRTKAoG/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request
origin: community
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern: $REQ
- pattern-either:
- pattern-inside: "Action {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action(...) {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action.async {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action.async(...) {\n $REQ: Request[$T] => \n ...\n}\n"
- patterns:
- pattern: $PARAM
- pattern-either:
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action(...) {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action.async {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action.async(...) {
...
}
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: |
"$SQLSTR" + ...
- pattern: |
"$SQLSTR".format(...)
- patterns:
- pattern-inside: |
$SB = new StringBuilder("$SQLSTR");
...
- pattern: $SB.append(...)
- patterns:
- pattern-inside: |
$VAR = "$SQLSTR"
...
- pattern: $VAR += ...
- metavariable-regex:
metavariable: $SQLSTR
regex: (?i)(select|delete|insert|create|update|alter|drop)\b
- patterns:
- pattern: s"..."
- pattern-regex: |
.*\b(?i)(select|delete|insert|create|update|alter|drop)\b.*
- pattern-not-inside: println(...)
- id: dockerfile.security.last-user-is-root.last-user-is-root
patterns:
- pattern: USER root
- pattern-not-inside:
patterns:
- pattern: |
USER root
...
USER $X
- metavariable-pattern:
metavariable: $X
patterns:
- pattern-not: root
message: The last user in the container is 'root'. This is a security hazard because
if an attacker gains control of the container they will have root access. Switch
back to another user after running commands as 'root'.
severity: ERROR
languages:
- dockerfile
metadata:
cwe:
- 'CWE-269: Improper Privilege Management'
source-rule-url: https://github.com/hadolint/hadolint/wiki/DL3002
references:
- https://github.com/hadolint/hadolint/wiki/DL3002
category: security
technology:
- dockerfile
confidence: MEDIUM
owasp:
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
subcategory:
- audit
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/dockerfile.security.last-user-is-root.last-user-is-root
shortlink: https://sg.run/5Z43
semgrep.dev:
rule:
r_id: 20147
rv_id: 1262658
rule_id: ReU2n5
version_id: 6xT29Eg
url: https://semgrep.dev/playground/r/6xT29Eg/dockerfile.security.last-user-is-root.last-user-is-root
origin: community
- id: dockerfile.security.missing-user.missing-user
patterns:
- pattern: |
CMD $...VARS
- pattern-not-inside: |
USER $USER
...
- pattern-not-inside: |
HEALTHCHECK ... CMD ...
fix: |
USER non-root
CMD $...VARS
message: By not specifying a USER, a program in the container may run as 'root'.
This is a security hazard. If an attacker can control a process running as root,
they may have control over the container. Ensure that the last USER in a Dockerfile
is a USER other than 'root'.
severity: ERROR
languages:
- dockerfile
metadata:
cwe:
- 'CWE-250: Execution with Unnecessary Privileges'
category: security
technology:
- dockerfile
confidence: MEDIUM
owasp:
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/dockerfile.security.missing-user.missing-user
shortlink: https://sg.run/Gbvn
semgrep.dev:
rule:
r_id: 20148
rv_id: 1262660
rule_id: AbUN06
version_id: zyTb2n2
url: https://semgrep.dev/playground/r/zyTb2n2/dockerfile.security.missing-user.missing-user
origin: community
- id: javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config
message: Prefer Argon2id where possible. Per RFC9016, section 4 IETF recommends
selecting Argon2id unless you can guarantee an adversary has no direct access
to the computing environment.
metadata:
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
- https://eprint.iacr.org/2016/759.pdf
- https://www.cs.tau.ac.il/~tromer/papers/cache-joc-20090619.pdf
- https://datatracker.ietf.org/doc/html/rfc9106#section-4
category: security
cwe:
- 'CWE-916: Use of Password Hash With Insufficient Computational Effort'
technology:
- argon2
- cryptography
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- vuln
impact: LOW
likelihood: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config
shortlink: https://sg.run/ALq4
semgrep.dev:
rule:
r_id: 20150
rv_id: 1263103
rule_id: DbU2X8
version_id: qkTR7Jk
url: https://semgrep.dev/playground/r/qkTR7Jk/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-inside: |
$ARGON = require('argon2');
...
- pattern: |
{type: ...}
pattern-sinks:
- patterns:
- pattern: |
$Y
- pattern-inside: |
$ARGON.hash(...,$Y)
pattern-sanitizers:
- patterns:
- pattern: '{type: $ARGON.argon2id}'
- id: ruby.rails.security.brakeman.check-regex-dos.check-regex-dos
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
cookies[...]
- patterns:
- pattern: |
cookies. ... .$PROPERTY[...]
- metavariable-regex:
metavariable: $PROPERTY
regex: (?!signed|encrypted)
- pattern: |
params[...]
- pattern: |
request.env[...]
- patterns:
- pattern: $Y
- pattern-either:
- pattern-inside: |
$RECORD.read_attribute($Y)
- pattern-inside: |
$RECORD[$Y]
- metavariable-regex:
metavariable: $RECORD
regex: '[A-Z][a-z]+'
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: $Y
- pattern-inside: |
/...#{...}.../
- patterns:
- pattern: $Y
- pattern-inside: |
Regexp.new(...)
message: Found a potentially user-controllable argument in the construction of a
regular expressions. This may result in excessive resource consumption when applied
to certain inputs, or when the user is allowed to control the match target. Avoid
allowing users to specify regular expressions processed by the server. If you
must support user-controllable input in a regular expression, use an allow-list
to restrict the expressions users may supply to limit catastrophic backtracking.
languages:
- ruby
severity: ERROR
metadata:
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_regex_dos.rb
category: security
cwe:
- 'CWE-1333: Inefficient Regular Expression Complexity'
owasp:
- A03:2017 - Sensitive Data Exposure
technology:
- ruby
- rails
references:
- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Denial-of-Service (DoS)
source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-regex-dos.check-regex-dos
shortlink: https://sg.run/qZwx
semgrep.dev:
rule:
r_id: 20156
rv_id: 1409406
rule_id: YGUY4R
version_id: 0bTG0WO
url: https://semgrep.dev/playground/r/0bTG0WO/ruby.rails.security.brakeman.check-regex-dos.check-regex-dos
origin: community
- id: ruby.rails.security.brakeman.check-sql.check-sql
mode: taint
pattern-sources:
- pattern-either:
- pattern: |
cookies[...]
- patterns:
- pattern: |
cookies. ... .$PROPERTY[...]
- metavariable-regex:
metavariable: $PROPERTY
regex: (?!signed|encrypted)
- pattern: |
params[...]
- pattern: |
request.env[...]
pattern-sanitizers:
- patterns:
- pattern-either:
- patterns:
- pattern: $X
- pattern-either:
- pattern-inside: |
:$KEY => $X
- pattern-inside: |
["...",$X,...]
- pattern: |
params[...].to_i
- pattern: |
params[...].to_f
- patterns:
- pattern: |
params[...] ? $A : $B
- metavariable-pattern:
metavariable: $A
patterns:
- pattern-not: |
params[...]
- metavariable-pattern:
metavariable: $B
patterns:
- pattern-not: |
params[...]
pattern-sinks:
- patterns:
- pattern: $X
- pattern-not-inside: |
$P.where("...",...)
- pattern-not-inside: |
$P.where(:$KEY => $VAL,...)
- pattern-either:
- pattern-inside: |
$P.$M(...)
- pattern-inside: |
$P.$M("...",...)
- pattern-inside: |
class $P < ActiveRecord::Base
...
end
- metavariable-regex:
metavariable: $M
regex: (where|find|first|last|select|minimum|maximum|calculate|sum|average)
message: Found potential SQL injection due to unsafe SQL query construction via
$X. Where possible, prefer parameterized queries.
languages:
- ruby
severity: ERROR
metadata:
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_sql.rb
category: security
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
technology:
- ruby
- rails
references:
- https://owasp.org/www-community/attacks/SQL_Injection
- https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/models/product.rb
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-sql.check-sql
shortlink: https://sg.run/vpgb
semgrep.dev:
rule:
r_id: 20533
rv_id: 1263661
rule_id: OrUv2z
version_id: DkTRbE4
url: https://semgrep.dev/playground/r/DkTRbE4/ruby.rails.security.brakeman.check-sql.check-sql
origin: community
- id: ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods
mode: taint
pattern-sources:
- pattern-either:
- pattern: |
cookies[...]
- patterns:
- pattern: |
cookies. ... .$PROPERTY[...]
- metavariable-regex:
metavariable: $PROPERTY
regex: (?!signed|encrypted)
- pattern: |
params[...]
- pattern: |
request.env[...]
pattern-sinks:
- patterns:
- pattern: $X
- pattern-either:
- pattern-inside: |
$X. ... .to_proc
- patterns:
- pattern-inside: |
$Y.method($Z)
- focus-metavariable: $Z
- patterns:
- pattern-inside: |
$Y.tap($Z)
- focus-metavariable: $Z
- patterns:
- pattern-inside: |
$Y.tap{ |$ANY| $Z }
- focus-metavariable: $Z
message: Found user-controllable input to a reflection method. This may allow a
user to alter program behavior and potentially execute arbitrary instructions
in the context of the process. Do not provide arbitrary user input to `tap`, `method`,
or `to_proc`
languages:
- ruby
severity: ERROR
metadata:
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_unsafe_reflection_methods.rb
category: security
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
technology:
- ruby
- rails
references:
- https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails6/app/controllers/groups_controller.rb
cwe2022-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods
shortlink: https://sg.run/dPYd
semgrep.dev:
rule:
r_id: 20534
rv_id: 1263662
rule_id: eqUZ2Q
version_id: WrTqKLA
url: https://semgrep.dev/playground/r/WrTqKLA/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods
origin: community
- id: ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase
message: Found the use of an hardcoded passphrase for RSA. The passphrase can be
easily discovered, and therefore should not be stored in source-code. It is recommended
to remove the passphrase from source-code, and use system environment variables
or a restricted configuration file.
languages:
- ruby
severity: WARNING
metadata:
technology:
- ruby
- secrets
category: security
references:
- https://cwe.mitre.org/data/definitions/522.html
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase
shortlink: https://sg.run/xPEe
semgrep.dev:
rule:
r_id: 20730
rv_id: 1263607
rule_id: bwULyN
version_id: K3TKkEo
url: https://semgrep.dev/playground/r/K3TKkEo/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase
origin: community
patterns:
- pattern-either:
- pattern: OpenSSL::PKey::RSA.new(..., '...')
- pattern: OpenSSL::PKey::RSA.new(...).to_pem(..., '...')
- pattern: OpenSSL::PKey::RSA.new(...).export(..., '...')
- patterns:
- pattern-inside: |
$OPENSSL = OpenSSL::PKey::RSA.new(...)
...
- pattern-either:
- pattern: |
$OPENSSL.export(...,'...')
- pattern: |
$OPENSSL.to_pem(...,'...')
- patterns:
- pattern-either:
- patterns:
- pattern-inside: |
$ASSIGN = '...'
...
- pattern: OpenSSL::PKey::RSA.new(..., $ASSIGN)
- patterns:
- pattern-inside: |
def $METHOD1(...)
...
$ASSIGN = '...'
...
end
...
def $METHOD2(...)
...
end
- pattern: OpenSSL::PKey::RSA.new(..., $ASSIGN)
- patterns:
- pattern-inside: |
$ASSIGN = '...'
...
def $METHOD(...)
$OPENSSL = OpenSSL::PKey::RSA.new(...)
...
end
...
- pattern-either:
- pattern: $OPENSSL.export(...,$ASSIGN)
- pattern: $OPENSSL.to_pem(...,$ASSIGN)
- patterns:
- pattern-inside: |
def $METHOD1(...)
...
$OPENSSL = OpenSSL::PKey::RSA.new(...)
...
$ASSIGN = '...'
...
end
...
- pattern-either:
- pattern: $OPENSSL.export(...,$ASSIGN)
- pattern: $OPENSSL.to_pem(...,$ASSIGN)
- patterns:
- pattern-inside: |
def $METHOD1(...)
...
$ASSIGN = '...'
...
end
...
def $METHOD2(...)
...
$OPENSSL = OpenSSL::PKey::RSA.new(...)
...
end
...
- pattern-either:
- pattern: $OPENSSL.export(...,$ASSIGN)
- pattern: $OPENSSL.to_pem(...,$ASSIGN)
- id: ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size
message: The RSA key size $SIZE is insufficent by NIST standards. It is recommended
to use a key length of 2048 or higher.
languages:
- ruby
severity: WARNING
metadata:
technology:
- ruby
category: security
references:
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size
shortlink: https://sg.run/O4Re
semgrep.dev:
rule:
r_id: 20731
rv_id: 1263608
rule_id: NbUe4N
version_id: qkTR76v
url: https://semgrep.dev/playground/r/qkTR76v/ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size
origin: community
patterns:
- pattern-either:
- pattern: OpenSSL::PKey::RSA.generate($SIZE,...)
- pattern: OpenSSL::PKey::RSA.new($SIZE, ...)
- patterns:
- pattern-either:
- patterns:
- pattern-inside: |
$ASSIGN = $SIZE
...
- pattern-either:
- pattern: OpenSSL::PKey::RSA.new($ASSIGN, ...)
- pattern: OpenSSL::PKey::RSA.generate($ASSIGN, ...)
- patterns:
- pattern-inside: |
def $METHOD1(...)
...
$ASSIGN = $SIZE
...
end
...
- pattern-either:
- pattern: OpenSSL::PKey::RSA.new($ASSIGN, ...)
- pattern: OpenSSL::PKey::RSA.generate($ASSIGN, ...)
- metavariable-comparison:
metavariable: $SIZE
comparison: $SIZE < 2048
- id: ruby.rails.security.brakeman.check-redirect-to.check-redirect-to
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: params
- pattern: cookies
- pattern: request.env
- pattern: url_for(params[...],...,:only_path => false,...)
pattern-sanitizers:
- patterns:
- pattern-either:
- patterns:
- pattern: |
$F(...)
- metavariable-pattern:
metavariable: $F
patterns:
- pattern-not-regex: (params|url_for|cookies|request.env|permit|redirect_to)
- pattern: |
params.merge! :only_path => true
...
- pattern: |
params.slice(...)
...
- pattern: |
redirect_to [...]
- patterns:
- pattern: |
$MODEL. ... .$M(...)
...
- metavariable-regex:
metavariable: $MODEL
regex: '[A-Z]\w+'
- metavariable-regex:
metavariable: $M
regex: (all|create|find|find_by|find_by_sql|first|last|new|from|group|having|joins|lock|order|reorder|select|where|take)
- patterns:
- pattern: |
params.$UNSAFE_HASH.merge(...,:only_path => true,...)
...
- metavariable-regex:
metavariable: $UNSAFE_HASH
regex: to_unsafe_h(ash)?
- patterns:
- pattern: params.permit(...,$X,...)
- metavariable-pattern:
metavariable: $X
patterns:
- pattern-not-regex: (host|port|(sub)?domain)
pattern-sinks:
- patterns:
- pattern: $X
- pattern-inside: |
redirect_to $X, ...
- pattern-not-regex: params\.\w+(?<!permit)\(.*?\)
message: Found potentially unsafe handling of redirect behavior $X. Do not pass
`params` to `redirect_to` without the `:only_path => true` hash value.
languages:
- ruby
severity: WARNING
metadata:
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_redirect.rb
category: security
cwe:
- 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')'
technology:
- ruby
- rails
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Open Redirect
source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-redirect-to.check-redirect-to
shortlink: https://sg.run/eJNX
semgrep.dev:
rule:
r_id: 20732
rv_id: 1263657
rule_id: kxUOJ6
version_id: GxTke14
url: https://semgrep.dev/playground/r/GxTke14/ruby.rails.security.brakeman.check-redirect-to.check-redirect-to
origin: community
- id: ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection
mode: taint
pattern-sources:
- pattern-either:
- pattern: |
cookies[...]
- patterns:
- pattern: |
cookies. ... .$PROPERTY[...]
- metavariable-regex:
metavariable: $PROPERTY
regex: (?!signed|encrypted)
- pattern: |
params[...]
- pattern: |
request.env[...]
pattern-sinks:
- patterns:
- pattern: $X
- pattern-either:
- pattern-inside: |
$X.constantize
- pattern-inside: |
$X. ... .safe_constantize
- pattern-inside: |
const_get(...)
- pattern-inside: |
qualified_const_get(...)
message: Found user-controllable input to Ruby reflection functionality. This allows
a remote user to influence runtime behavior, up to and including arbitrary remote
code execution. Do not provide user-controllable input to reflection functionality.
Do not call symbol conversion on user-controllable input.
languages:
- ruby
severity: ERROR
metadata:
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_unsafe_reflection.rb
category: security
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
technology:
- ruby
- rails
references:
- https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails2/app/controllers/application_controller.rb
cwe2022-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection
shortlink: https://sg.run/vpEX
semgrep.dev:
rule:
r_id: 20733
rv_id: 1263663
rule_id: wdUkYA
version_id: 0bTKzn8
url: https://semgrep.dev/playground/r/0bTKzn8/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection
origin: community
- id: ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find
mode: taint
pattern-sources:
- pattern-either:
- pattern: |
cookies[...]
- patterns:
- pattern: |
cookies. ... .$PROPERTY[...]
- metavariable-regex:
metavariable: $PROPERTY
regex: (?!signed|encrypted)
- pattern: |
params[...]
- pattern: |
request.env[...]
pattern-sinks:
- patterns:
- pattern-either:
- pattern: $MODEL.find(...)
- pattern: $MODEL.find_by_id(...)
- pattern: $MODEL.find_by_id!(...)
- metavariable-regex:
metavariable: $MODEL
regex: '[A-Z]\S+'
message: Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord
model being searched against is sensitive, this may lead to Insecure Direct Object
Reference (IDOR) behavior and allow users to read arbitrary records. Scope the
find to the current user, e.g. `current_user.accounts.find(params[:id])`.
languages:
- ruby
severity: WARNING
metadata:
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_unscoped_find.rb
category: security
cwe:
- 'CWE-639: Authorization Bypass Through User-Controlled Key'
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
technology:
- ruby
- rails
references:
- https://brakemanscanner.org/docs/warning_types/unscoped_find/
- https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/controllers/users_controller.rb
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find
shortlink: https://sg.run/dPbP
semgrep.dev:
rule:
r_id: 20734
rv_id: 1263664
rule_id: x8Ud6d
version_id: K3TKkxZ
url: https://semgrep.dev/playground/r/K3TKkxZ/ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find
origin: community
- id: javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object
message: Detected DynamoDB query params that are tainted by `$EVENT` object. This
could lead to NoSQL injection if the variable is user-controlled and not properly
sanitized. Explicitly assign query params instead of passing data from `$EVENT`
directly to DynamoDB client.
metadata:
cwe:
- 'CWE-943: Improper Neutralization of Special Elements in Data Query Logic'
owasp:
- A01:2017 - Injection
category: security
technology:
- javascript
- aws-lambda
- dynamodb
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object
shortlink: https://sg.run/X1e4
semgrep.dev:
rule:
r_id: 21320
rv_id: 945766
rule_id: 0oU1xk
version_id: GxTP7gN
url: https://semgrep.dev/playground/r/GxTP7gN/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern: $EVENT
- pattern-either:
- pattern-inside: |
exports.handler = function ($EVENT, ...) {
...
}
- pattern-inside: |
function $FUNC ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern-inside: |
$FUNC = function ($EVENT, ...) {...}
...
exports.handler = $FUNC
pattern-sinks:
- patterns:
- focus-metavariable: $SINK
- pattern: |
$DC.$METHOD($SINK, ...)
- metavariable-regex:
metavariable: $METHOD
regex: (query|send|scan|delete|put|transactWrite|update|batchExecuteStatement|executeStatement|executeTransaction|transactWriteItems)
- pattern-either:
- pattern-inside: |
$DC = new $AWS.DocumentClient(...);
...
- pattern-inside: |
$DC = new $AWS.DynamoDB(...);
...
- pattern-inside: |
$DC = new DynamoDBClient(...);
...
- pattern-inside: |
$DC = DynamoDBDocumentClient.from(...);
...
pattern-sanitizers:
- patterns:
- pattern: |
{...}
- id: python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection
mode: taint
metadata:
cwe:
- 'CWE-943: Improper Neutralization of Special Elements in Data Query Logic'
owasp:
- A01:2017 - Injection
category: security
technology:
- python
- boto3
- aws-lambda
- dynamodb
references:
- https://medium.com/appsecengineer/dynamodb-injection-1db99c2454ac
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection
shortlink: https://sg.run/jjrl
semgrep.dev:
rule:
r_id: 21321
rv_id: 946088
rule_id: KxUJ2B
version_id: 9lTy1rQ
url: https://semgrep.dev/playground/r/9lTy1rQ/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection
origin: community
message: Detected DynamoDB query filter that is tainted by `$EVENT` object. This
could lead to NoSQL injection if the variable is user-controlled and not properly
sanitized. Explicitly assign query params instead of passing data from `$EVENT`
directly to DynamoDB client.
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
pattern-sanitizers:
- patterns:
- pattern: |
{...}
pattern-sinks:
- patterns:
- focus-metavariable: $SINK
- pattern-either:
- pattern: $TABLE.scan(..., ScanFilter = $SINK, ...)
- pattern: $TABLE.query(..., QueryFilter = $SINK, ...)
- pattern-either:
- patterns:
- pattern-inside: |
$TABLE = $DB.Table(...)
...
- pattern-inside: |
$DB = boto3.resource('dynamodb', ...)
...
- pattern-inside: |
$TABLE = boto3.client('dynamodb', ...)
...
severity: ERROR
languages:
- python
- id: python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response
message: Detected data rendered directly to the end user via 'Response'. This bypasses
Pyramid's built-in cross-site scripting (XSS) defenses and could result in an
XSS vulnerability. Use Pyramid's template engines to safely render HTML.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- pyramid
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response
shortlink: https://sg.run/DX8G
semgrep.dev:
rule:
r_id: 21452
rv_id: 1263572
rule_id: gxUeA8
version_id: X0TzyEe
url: https://semgrep.dev/playground/r/X0TzyEe/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response
origin: community
languages:
- python
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-inside: |
@pyramid.view.view_config( ... )
def $VIEW($REQ):
...
- pattern: $REQ.$ANYTHING
- pattern-not: $REQ.dbsession
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
pyramid.request.Response.text($SINK)
- pattern: |
pyramid.request.Response($SINK)
- pattern: |
$REQ.response.body = $SINK
- pattern: |
$REQ.response.text = $SINK
- pattern: |
$REQ.response.ubody = $SINK
- pattern: |
$REQ.response.unicode_body = $SINK
- pattern: $SINK
- id: python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection
message: Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause
sql injections if the developer inputs raw SQL into the before-mentioned clauses.
This pattern captures relevant cases in which the developer inputs raw SQL into
the distinct, having, group_by, order_by or filter clauses and injects user-input
into the raw SQL with any function besides "bindparams". Use bindParams to securely
bind user-input to SQL statements.
languages:
- python
severity: ERROR
metadata:
category: security
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.sqlalchemy.org/en/14/tutorial/data_select.html#tutorial-selecting-data
technology:
- pyramid
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection
shortlink: https://sg.run/W7eE
semgrep.dev:
rule:
r_id: 21453
rv_id: 1263573
rule_id: QrUZ7l
version_id: jQTn5WA
url: https://semgrep.dev/playground/r/jQTn5WA/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern-inside: |
from pyramid.view import view_config
...
@view_config( ... )
def $VIEW($REQ):
...
- pattern: $REQ.$ANYTHING
- pattern-not: $REQ.dbsession
pattern-sinks:
- patterns:
- pattern-inside: |
$QUERY = $REQ.dbsession.query(...)
...
- pattern-either:
- pattern: |
$QUERY.$SQLFUNC("...".$FORMATFUNC(..., $SINK, ...))
- pattern: |
$QUERY.join(...).$SQLFUNC("...".$FORMATFUNC(..., $SINK, ...))
- pattern: $SINK
- metavariable-regex:
metavariable: $SQLFUNC
regex: (group_by|order_by|distinct|having|filter)
- metavariable-regex:
metavariable: $FORMATFUNC
regex: (?!bindparams)
fix-regex:
regex: format
replacement: bindparams
- id: javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint
message: Use of angular.element can lead to XSS if user-input is treated as part
of the HTML element within `$SINK`. It is recommended to contextually output encode
user-input, before inserting into `$SINK`. If the HTML needs to be preserved it
is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize.
metadata:
confidence: MEDIUM
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://docs.angularjs.org/api/ng/function/angular.element
- https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
category: security
technology:
- angularjs
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint
shortlink: https://sg.run/5AQ0
semgrep.dev:
rule:
r_id: 21503
rv_id: 1263091
rule_id: GdUP71
version_id: 44TEj8L
url: https://semgrep.dev/playground/r/44TEj8L/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: window.location.search
- pattern: window.document.location.search
- pattern: document.location.search
- pattern: location.search
- pattern: $location.search(...)
- patterns:
- pattern-either:
- pattern: $DECODE(<... location.hash ...>)
- pattern: $DECODE(<... window.location.hash ...>)
- pattern: $DECODE(<... document.location.hash ...>)
- pattern: $DECODE(<... location.href ...>)
- pattern: $DECODE(<... window.location.href ...>)
- pattern: $DECODE(<... document.location.href ...>)
- pattern: $DECODE(<... document.URL ...>)
- pattern: $DECODE(<... window.document.URL ...>)
- pattern: $DECODE(<... document.location.href ...>)
- pattern: $DECODE(<... document.location.href ...>)
- pattern: $DECODE(<... $location.absUrl() ...>)
- pattern: $DECODE(<... $location.url() ...>)
- pattern: $DECODE(<... $location.hash() ...>)
- metavariable-regex:
metavariable: $DECODE
regex: ^(unescape|decodeURI|decodeURIComponent)$
- patterns:
- pattern-inside: $http.$METHOD(...).$CONTINUE(function $FUNC($RES) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|delete|head|jsonp|post|put|patch)
- pattern: $RES.data
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
angular.element(...). ... .$SINK($QUERY)
- pattern-inside: |
$ANGULAR = angular.element(...)
...
$ANGULAR. ... .$SINK($QUERY)
- metavariable-regex:
metavariable: $SINK
regex: ^(after|append|html|prepend|replaceWith|wrap)$
- focus-metavariable: $QUERY
pattern-sanitizers:
- patterns:
- pattern-either:
- pattern: $sce.getTrustedHtml(...)
- pattern: $sanitize(...)
- pattern: DOMPurify.sanitize(...)
- id: python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization
mode: taint
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
pattern-sinks:
- patterns:
- focus-metavariable: $SINK
- pattern-either:
- pattern: pickle.load($SINK,...)
- pattern: pickle.loads($SINK,...)
- pattern: _pickle.load($SINK,...)
- pattern: _pickle.loads($SINK,...)
- pattern: cPickle.load($SINK,...)
- pattern: cPickle.loads($SINK,...)
- pattern: dill.load($SINK,...)
- pattern: dill.loads($SINK,...)
- pattern: shelve.open($SINK,...)
message: Avoid using `pickle`, which is known to lead to code execution vulnerabilities.
When unpickling, the serialized data could be manipulated to run arbitrary code.
Instead, consider serializing the relevant data as JSON or a similar text-based
serialization format.
metadata:
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
references:
- https://docs.python.org/3/library/pickle.html
- https://davidhamann.de/2020/04/05/exploiting-python-pickle/
category: security
technology:
- python
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization
shortlink: https://sg.run/JbjW
semgrep.dev:
rule:
r_id: 21602
rv_id: 1263345
rule_id: JDUDQg
version_id: LjTkgd9
url: https://semgrep.dev/playground/r/LjTkgd9/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization
origin: community
languages:
- python
severity: WARNING
- id: php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection
mode: taint
pattern-sources:
- patterns:
- focus-metavariable: $ARG
- pattern-inside: |
Route::$METHOD($ROUTE_NAME, function(...,$ARG,...){...})
pattern-sanitizers:
- patterns:
- pattern: |
DB::raw("...",[...])
pattern-sinks:
- patterns:
- pattern: |
DB::raw(...)
message: HTTP method [$METHOD] to Laravel route $ROUTE_NAME is vulnerable to SQL
injection via string concatenation or unsafe interpolation.
languages:
- php
severity: WARNING
metadata:
category: security
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md
technology:
- php
- laravel
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection
shortlink: https://sg.run/x94g
semgrep.dev:
rule:
r_id: 21674
rv_id: 1263305
rule_id: zdUln0
version_id: qkTR7A9
url: https://semgrep.dev/playground/r/qkTR7A9/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection
origin: community
- id: php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator
mode: taint
pattern-sources:
- patterns:
- pattern: |
public function $F(...,Request $R,...){...}
- focus-metavariable: $R
- patterns:
- pattern-either:
- pattern: |
$this->$PROPERTY
- pattern: |
$this->$PROPERTY->$GET
- metavariable-pattern:
metavariable: $PROPERTY
patterns:
- pattern-either:
- pattern: query
- pattern: request
- pattern: headers
- pattern: cookies
- pattern: cookie
- pattern: files
- pattern: file
- pattern: allFiles
- pattern: input
- pattern: all
- pattern: post
- pattern: json
- pattern-either:
- pattern-inside: |
class $CL extends Illuminate\Http\Request {...}
- pattern-inside: |
class $CL extends Illuminate\Foundation\Http\FormRequest {...}
pattern-sinks:
- patterns:
- pattern: |
Illuminate\Validation\Rule::unique(...)->ignore(...,$IGNORE,...)
- focus-metavariable: $IGNORE
message: Found a request argument passed to an `ignore()` definition in a Rule constraint.
This can lead to SQL injection.
languages:
- php
severity: ERROR
metadata:
category: security
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
technology:
- php
- laravel
references:
- https://laravel.com/docs/9.x/validation#rule-unique
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator
shortlink: https://sg.run/vkeb
semgrep.dev:
rule:
r_id: 21677
rv_id: 1263314
rule_id: X5ULgE
version_id: DkTRbBl
url: https://semgrep.dev/playground/r/DkTRbBl/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator
origin: community
- id: java.spring.security.injection.tainted-file-path.tainted-file-path
languages:
- java
severity: ERROR
message: Detected user input controlling a file path. An attacker could control
the location of this file, to include going backwards in the directory with '../'.
To address this, ensure that user-controlled variables in file paths are sanitized.
You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...)
to only retrieve the file name from the path.
options:
interfile: true
metadata:
cwe:
- 'CWE-23: Relative Path Traversal'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://owasp.org/www-community/attacks/Path_Traversal
category: security
technology:
- java
- spring
subcategory:
- vuln
impact: HIGH
likelihood: MEDIUM
confidence: HIGH
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/java.spring.security.injection.tainted-file-path.tainted-file-path
shortlink: https://sg.run/x9o0
semgrep.dev:
rule:
r_id: 22074
rv_id: 1263084
rule_id: lBUxok
version_id: ExTEx6Y
url: https://semgrep.dev/playground/r/ExTEx6Y/java.spring.security.injection.tainted-file-path.tainted-file-path
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
$METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {
...
}
- pattern-inside: |
$METHODNAME(..., @$REQ $TYPE $SOURCE,...) {
...
}
- metavariable-regex:
metavariable: $TYPE
regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean))
- metavariable-regex:
metavariable: $REQ
regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute)
- focus-metavariable: $SOURCE
pattern-sinks:
- patterns:
- pattern-either:
- pattern: new File(...)
- pattern: new java.io.File(...)
- pattern: new FileReader(...)
- pattern: new java.io.FileReader(...)
- pattern: new FileInputStream(...)
- pattern: new java.io.FileInputStream(...)
- pattern: (Paths $PATHS).get(...)
- patterns:
- pattern: |
$CLASS.$FUNC(...)
- metavariable-regex:
metavariable: $FUNC
regex: ^(getResourceAsStream|getResource)$
- patterns:
- pattern-either:
- pattern: new ClassPathResource($FILE, ...)
- pattern: ResourceUtils.getFile($FILE, ...)
- pattern: new FileOutputStream($FILE, ...)
- pattern: new java.io.FileOutputStream($FILE, ...)
- pattern: new StreamSource($FILE, ...)
- pattern: new javax.xml.transform.StreamSource($FILE, ...)
- pattern: FileUtils.openOutputStream($FILE, ...)
- focus-metavariable: $FILE
pattern-sanitizers:
- pattern: org.apache.commons.io.FilenameUtils.getName(...)
- id: java.spring.security.injection.tainted-html-string.tainted-html-string
languages:
- java
severity: ERROR
message: Detected user input flowing into a manually constructed HTML string. You
may be accidentally bypassing secure methods of rendering HTML by manually constructing
HTML and this could create a cross-site scripting vulnerability, which could let
attackers steal sensitive user data. To be sure this is safe, check that the HTML
is rendered safely. You can use the OWASP ESAPI encoder if you must render user
data.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
category: security
technology:
- java
- spring
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/java.spring.security.injection.tainted-html-string.tainted-html-string
shortlink: https://sg.run/ObdR
semgrep.dev:
rule:
r_id: 22075
rv_id: 1409395
rule_id: YGUvkL
version_id: 3ZT2598
url: https://semgrep.dev/playground/r/3ZT2598/java.spring.security.injection.tainted-html-string.tainted-html-string
origin: community
mode: taint
pattern-sources:
- label: INPUT
patterns:
- pattern-either:
- pattern-inside: |
$METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {
...
}
- pattern-inside: |
$METHODNAME(..., @$REQ $TYPE $SOURCE,...) {
...
}
- metavariable-regex:
metavariable: $TYPE
regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean))
- metavariable-regex:
metavariable: $REQ
regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute)
- focus-metavariable: $SOURCE
- label: CONCAT
by-side-effect: true
requires: INPUT
patterns:
- pattern-either:
- pattern: |
"$HTMLSTR" + ...
- pattern: |
"$HTMLSTR".concat(...)
- patterns:
- pattern-inside: |
StringBuilder $SB = new StringBuilder("$HTMLSTR");
...
- pattern: $SB.append(...)
- patterns:
- pattern-inside: |
$VAR = "$HTMLSTR";
...
- pattern: $VAR += ...
- pattern: String.format("$HTMLSTR", ...)
- patterns:
- pattern-inside: |
String $VAR = "$HTMLSTR";
...
- pattern: String.format($VAR, ...)
- metavariable-regex:
metavariable: $HTMLSTR
regex: ^<\w+
pattern-propagators:
- pattern: (StringBuilder $SB).append($...TAINTED)
from: $...TAINTED
to: $SB
- pattern: $VAR += $...TAINTED
from: $...TAINTED
to: $VAR
pattern-sinks:
- requires: CONCAT
patterns:
- pattern-either:
- pattern: new ResponseEntity<>($PAYLOAD, ...)
- pattern: new ResponseEntity<$ERROR>($PAYLOAD, ...)
- pattern: ResponseEntity. ... .body($PAYLOAD)
- patterns:
- pattern: |
ResponseEntity.$RESPFUNC($PAYLOAD). ...
- metavariable-regex:
metavariable: $RESPFUNC
regex: ^(ok|of)$
- focus-metavariable: $PAYLOAD
pattern-sanitizers:
- pattern-either:
- pattern: Encode.forHtml(...)
- pattern: (PolicyFactory $POLICY).sanitize(...)
- pattern: (AntiSamy $AS).scan(...)
- pattern: JSoup.clean(...)
- id: java.spring.security.injection.tainted-system-command.tainted-system-command
languages:
- java
severity: ERROR
mode: taint
pattern-propagators:
- pattern: (StringBuilder $STRB).append($INPUT)
from: $INPUT
to: $STRB
label: CONCAT
requires: INPUT
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
$METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {
...
}
- pattern-inside: |
$METHODNAME(..., @$REQ $TYPE $SOURCE,...) {
...
}
- metavariable-regex:
metavariable: $TYPE
regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean))
- metavariable-regex:
metavariable: $REQ
regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute)
- focus-metavariable: $SOURCE
label: INPUT
- patterns:
- pattern-either:
- pattern: $X + $SOURCE
- pattern: $SOURCE + $Y
- pattern: String.format("...", ..., $SOURCE, ...)
- pattern: String.join("...", ..., $SOURCE, ...)
- pattern: (String $STR).concat($SOURCE)
- pattern: $SOURCE.concat(...)
- pattern: $X += $SOURCE
- pattern: $SOURCE += $X
label: CONCAT
requires: INPUT
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
(Process $P) = new Process(...);
- pattern: |
(ProcessBuilder $PB).command(...);
- patterns:
- pattern-either:
- pattern: |
(Runtime $R).$EXEC(...);
- pattern: |
Runtime.getRuntime(...).$EXEC(...);
- metavariable-regex:
metavariable: $EXEC
regex: (exec|loadLibrary|load)
- patterns:
- pattern: |
(ProcessBuilder $PB).command(...).$ADD(...);
- metavariable-regex:
metavariable: $ADD
regex: (add|addAll)
- patterns:
- pattern-either:
- patterns:
- pattern-inside: |
$BUILDER = new ProcessBuilder(...);
...
- pattern: $BUILDER.start(...)
- pattern: |
new ProcessBuilder(...). ... .start(...);
requires: CONCAT
message: 'Detected user input entering a method which executes a system command.
This could result in a command injection vulnerability, which allows an attacker
to inject an arbitrary system command onto the server. The attacker could download
malware onto or steal data from the server. Instead, use ProcessBuilder, separating
the command into individual arguments, like this: `new ProcessBuilder("ls", "-al",
targetDirectory)`. Further, make sure you hardcode or allowlist the actual command
so that attackers can''t run arbitrary commands.'
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- java
- spring
confidence: HIGH
references:
- https://www.stackhawk.com/blog/command-injection-java/
- https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html
- https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.java
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/java.spring.security.injection.tainted-system-command.tainted-system-command
shortlink: https://sg.run/epY0
semgrep.dev:
rule:
r_id: 22076
rv_id: 1263087
rule_id: 6JUxGN
version_id: 8KT5rnP
url: https://semgrep.dev/playground/r/8KT5rnP/java.spring.security.injection.tainted-system-command.tainted-system-command
origin: community
- id: java.spring.security.injection.tainted-url-host.tainted-url-host
languages:
- java
severity: ERROR
message: User data flows into the host portion of this manually-constructed URL.
This could allow an attacker to send data to their own server, potentially exposing
sensitive data such as cookies or authorization information sent with this request.
They could also probe internal servers or other resources that the server running
this code can access. (This is called server-side request forgery, or SSRF.) Do
not allow arbitrary hosts. Instead, create an allowlist for approved hosts, hardcode
the correct host, or ensure that the user data can only affect the path or parameters.
options:
interfile: true
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
category: security
technology:
- java
- spring
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
confidence: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/java.spring.security.injection.tainted-url-host.tainted-url-host
shortlink: https://sg.run/vkYn
semgrep.dev:
rule:
r_id: 22077
rv_id: 1263088
rule_id: oqUZo8
version_id: gETB708
url: https://semgrep.dev/playground/r/gETB708/java.spring.security.injection.tainted-url-host.tainted-url-host
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
$METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {
...
}
- pattern-inside: |
$METHODNAME(..., @$REQ $TYPE $SOURCE,...) {
...
}
- metavariable-regex:
metavariable: $TYPE
regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean))
- metavariable-regex:
metavariable: $REQ
regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute)
- focus-metavariable: $SOURCE
pattern-sinks:
- pattern-either:
- pattern: new URL($ONEARG)
- patterns:
- pattern-either:
- pattern: |
"$URLSTR" + ...
- pattern: |
"$URLSTR".concat(...)
- patterns:
- pattern-inside: |
StringBuilder $SB = new StringBuilder("$URLSTR");
...
- pattern: $SB.append(...)
- patterns:
- pattern-inside: |
$VAR = "$URLSTR";
...
- pattern: $VAR += ...
- patterns:
- pattern: String.format("$URLSTR", ...)
- pattern-not: String.format("$URLSTR", "...", ...)
- patterns:
- pattern-inside: |
String $VAR = "$URLSTR";
...
- pattern: String.format($VAR, ...)
- metavariable-regex:
metavariable: $URLSTR
regex: http(s?)://%(v|s|q).*
- id: ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization
mode: taint
languages:
- ruby
message: Deserialization of a string tainted by `event` object found. Objects in
Ruby can be serialized into strings, then later loaded from strings. However,
uses of `load` can cause remote code execution. Loading user input with MARSHAL,
YAML or CSV can potentially be dangerous. If you need to deserialize untrusted
data, you should use JSON as it is only capable of returning 'primitive' types
such as strings, arrays, hashes, numbers and nil.
metadata:
references:
- https://ruby-doc.org/core-3.1.2/doc/security_rdoc.html
- https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ
- https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb
category: security
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
technology:
- ruby
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization
shortlink: https://sg.run/dplX
semgrep.dev:
rule:
r_id: 22078
rv_id: 1263585
rule_id: zdUlNJ
version_id: vdT06gR
url: https://semgrep.dev/playground/r/vdT06gR/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization
origin: community
pattern-sinks:
- patterns:
- pattern: $SINK
- pattern-either:
- pattern-inside: |
YAML.load($SINK,...)
- pattern-inside: |
CSV.load($SINK,...)
- pattern-inside: |
Marshal.load($SINK,...)
- pattern-inside: |
Marshal.restore($SINK,...)
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context)
...
end
severity: WARNING
- id: javascript.express.security.audit.express-libxml-noent.express-libxml-noent
message: The libxml library processes user-input with the `noent` attribute is set
to `true` which can lead to being vulnerable to XML External Entities (XXE) type
attacks. It is recommended to set `noent` to `false` when using this feature to
ensure you are protected.
options:
interfile: true
metadata:
interfile: true
references:
- https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
technology:
- express
category: security
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent
shortlink: https://sg.run/Z75x
semgrep.dev:
rule:
r_id: 22079
rv_id: 1263138
rule_id: pKUNeD
version_id: d6TyxpX
url: https://semgrep.dev/playground/r/d6TyxpX/javascript.express.security.audit.express-libxml-noent.express-libxml-noent
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- pattern: $REQ.files.$ANYTHING.data.toString('utf8')
- pattern: $REQ.files.$ANYTHING['data'].toString('utf8')
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
- pattern: files.$ANYTHING.data.toString('utf8')
- pattern: files.$ANYTHING['data'].toString('utf8')
pattern-sinks:
- pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
$XML = require('$IMPORT')
...
- pattern-inside: |
import $XML from '$IMPORT'
...
- pattern-inside: |
import * as $XML from '$IMPORT'
...
- metavariable-regex:
metavariable: $IMPORT
regex: ^(libxmljs|libxmljs2)$
- pattern-inside: $XML.$FUNC($QUERY, {...,noent:true,...})
- metavariable-regex:
metavariable: $FUNC
regex: ^(parseXmlString|parseXml)$
- focus-metavariable: $QUERY
- id: javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent
message: Detected use of parseXml() function with the `noent` field set to `true`.
This can lead to an XML External Entities (XXE) attack if untrusted data is passed
into it.
metadata:
references:
- https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
category: security
technology:
- express
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent
shortlink: https://sg.run/n8Ag
semgrep.dev:
rule:
r_id: 22080
rv_id: 1263139
rule_id: 2ZUY52
version_id: ZRTKAXb
url: https://semgrep.dev/playground/r/ZRTKAXb/javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: $VM.runInContext("$CMD", ...)
- pattern: $VM.runInNewContext("$CMD", ...)
- pattern: $VM.runInThisContext("$CMD", ...)
- pattern: $VM.compileFunction("$CMD", ...)
- metavariable-pattern:
metavariable: $CMD
language: typescript
pattern-either:
- pattern: |
$LIBXML.parseXml($DATA, {..., noent: true, ...}, ...)
- patterns:
- pattern-inside: |
$OPTS = {..., noent: true, ...}
...
- pattern: $LIBXML.parseXml( $DATA, $OPTS )
- pattern: |
$LIBXML.parseXml($DATA, {..., noent: true, ...}, ...)
- patterns:
- pattern-inside: |
$OPTS = {..., noent: true, ...}
...
- pattern: $LIBXML.parseXml( $DATA, $OPTS )
- id: javascript.express.security.audit.express-open-redirect.express-open-redirect
message: The application redirects to a URL specified by user-supplied input `$REQ`
that is not validated. This could redirect users to malicious locations. Consider
using an allow-list approach to validate URLs, or warn users they are being redirected
to a third-party website.
metadata:
technology:
- express
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html
cwe:
- 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')'
category: security
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Open Redirect
source: https://semgrep.dev/r/javascript.express.security.audit.express-open-redirect.express-open-redirect
shortlink: https://sg.run/EpoP
semgrep.dev:
rule:
r_id: 22081
rv_id: 1263140
rule_id: X5ULkq
version_id: nWT2L0v
url: https://semgrep.dev/playground/r/nWT2L0v/javascript.express.security.audit.express-open-redirect.express-open-redirect
origin: community
languages:
- javascript
- typescript
severity: WARNING
options:
taint_unify_mvars: true
symbolic_propagation: true
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern-either:
- pattern: $RES.redirect("$HTTP"+$REQ. ... .$VALUE)
- pattern: $RES.redirect("$HTTP"+$REQ. ... .$VALUE + $...A)
- pattern: $RES.redirect(`$HTTP${$REQ. ... .$VALUE}...`)
- pattern: $RES.redirect("$HTTP"+$REQ.$VALUE[...])
- pattern: $RES.redirect("$HTTP"+$REQ.$VALUE[...] + $...A)
- pattern: $RES.redirect(`$HTTP${$REQ.$VALUE[...]}...`)
- metavariable-regex:
metavariable: $HTTP
regex: ^https?:\/\/$
- pattern-either:
- pattern: $REQ. ... .$VALUE
- patterns:
- pattern-either:
- pattern: $RES.redirect($REQ. ... .$VALUE)
- pattern: $RES.redirect($REQ. ... .$VALUE + $...A)
- pattern: $RES.redirect(`${$REQ. ... .$VALUE}...`)
- pattern: $REQ. ... .$VALUE
- patterns:
- pattern-either:
- pattern: $RES.redirect($REQ.$VALUE['...'])
- pattern: $RES.redirect($REQ.$VALUE['...'] + $...A)
- pattern: $RES.redirect(`${$REQ.$VALUE['...']}...`)
- pattern: $REQ.$VALUE
- patterns:
- pattern-either:
- pattern-inside: |
$ASSIGN = $REQ. ... .$VALUE
...
- pattern-inside: |
$ASSIGN = $REQ.$VALUE['...']
...
- pattern-inside: |
$ASSIGN = $REQ. ... .$VALUE + $...A
...
- pattern-inside: "$ASSIGN = $REQ.$VALUE['...'] + $...A\n... \n"
- pattern-inside: |
$ASSIGN = `${$REQ. ... .$VALUE}...`
...
- pattern-inside: "$ASSIGN = `${$REQ.$VALUE['...']}...`\n... \n"
- pattern-either:
- pattern: $RES.redirect($ASSIGN)
- pattern: $RES.redirect($ASSIGN + $...FOO)
- pattern: $RES.redirect(`${$ASSIGN}...`)
- focus-metavariable: $ASSIGN
- id: javascript.express.security.audit.express-res-sendfile.express-res-sendfile
message: The application processes user-input, this is passed to res.sendFile which
can allow an attacker to arbitrarily read files on the system through path traversal.
It is recommended to perform input validation in addition to canonicalizing the
path. This allows you to validate the path against the intended directory it should
be accessing.
metadata:
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html
technology:
- express
category: security
cwe:
- 'CWE-73: External Control of File Name or Path'
owasp:
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/javascript.express.security.audit.express-res-sendfile.express-res-sendfile
shortlink: https://sg.run/7DJk
semgrep.dev:
rule:
r_id: 22082
rv_id: 1263142
rule_id: j2UzDx
version_id: 7ZTE3X9
url: https://semgrep.dev/playground/r/7ZTE3X9/javascript.express.security.audit.express-res-sendfile.express-res-sendfile
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
function ... (...,$REQ: $TYPE, ...) {...}
- metavariable-regex:
metavariable: $TYPE
regex: ^(string|String)
pattern-sinks:
- patterns:
- pattern-either:
- pattern: $RES.$METH($QUERY,...)
- pattern-not-inside: $RES.$METH($QUERY,$OPTIONS)
- metavariable-regex:
metavariable: $METH
regex: ^(sendfile|sendFile)$
- focus-metavariable: $QUERY
- id: javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
options:
interfile: true
metadata:
interfile: true
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
category: security
technology:
- express
- secrets
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret
shortlink: https://sg.run/LYvG
semgrep.dev:
rule:
r_id: 22083
rv_id: 1263143
rule_id: 10Uo39
version_id: LjTkgle
url: https://semgrep.dev/playground/r/LjTkgle/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-either:
- pattern-inside: |
$SESSION = require('express-session');
...
- pattern-inside: |
import $SESSION from 'express-session'
...
- pattern-inside: |
import {..., $SESSION, ...} from 'express-session'
...
- pattern-inside: |
import * as $SESSION from 'express-session'
...
- patterns:
- pattern-either:
- pattern-inside: $APP.use($SESSION({...}))
- pattern: |
$SECRET = $VALUE
...
$APP.use($SESSION($SECRET))
- pattern: |
secret: '$Y'
- id: javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization
message: The following function call $SER.$FUNC accepts user controlled data which
can result in Remote Code Execution (RCE) through Object Deserialization. It is
recommended to use secure data processing alternatives such as JSON.parse() and
Buffer.from().
options:
interfile: true
metadata:
interfile: true
technology:
- express
category: security
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html
source_rule_url:
- https://github.com/ajinabraham/njsscan/blob/75bfbeb9c8d72999e4d527dfa2548f7f0f3cc48a/njsscan/rules/semantic_grep/eval/eval_deserialize.yaml
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization
shortlink: https://sg.run/8W5j
semgrep.dev:
rule:
r_id: 22084
rv_id: 1263145
rule_id: 9AUyqj
version_id: gETB7nD
url: https://semgrep.dev/playground/r/gETB7nD/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- pattern: $REQ.files.$ANYTHING.data.toString('utf8')
- pattern: $REQ.files.$ANYTHING['data'].toString('utf8')
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
- pattern: files.$ANYTHING.data.toString('utf8')
- pattern: files.$ANYTHING['data'].toString('utf8')
pattern-sinks:
- pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
$SER = require('$IMPORT')
...
- pattern-inside: |
import $SER from '$IMPORT'
...
- pattern-inside: |
import * as $SER from '$IMPORT'
...
- metavariable-regex:
metavariable: $IMPORT
regex: ^(node-serialize|serialize-to-js)$
- pattern: $SER.$FUNC(...)
- metavariable-regex:
metavariable: $FUNC
regex: ^(unserialize|deserialize)$
- id: javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection
message: Detected a sequelize statement that is tainted by user-input. This could
lead to SQL injection if the variable is user-controlled and is not properly sanitized.
In order to prevent SQL injection, it is recommended to use parameterized queries
or prepared statements.
options:
interfile: true
metadata:
interfile: true
references:
- https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements
category: security
technology:
- express
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection
shortlink: https://sg.run/gjoe
semgrep.dev:
rule:
r_id: 22085
rv_id: 1263241
rule_id: yyU0GX
version_id: nWT2Llx
url: https://semgrep.dev/playground/r/nWT2Llx/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- pattern: $REQ.files.$ANYTHING.data.toString('utf8')
- pattern: $REQ.files.$ANYTHING['data'].toString('utf8')
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
- pattern: files.$ANYTHING.data.toString('utf8')
- pattern: files.$ANYTHING['data'].toString('utf8')
pattern-sinks:
- pattern-either:
- patterns:
- pattern-either:
- pattern: sequelize.query($QUERY,...)
- pattern: $DB.sequelize.query($QUERY,...)
- focus-metavariable: $QUERY
pattern-sanitizers:
- pattern-either:
- pattern: parseInt(...)
- pattern: $FUNC. ... .hash(...)
- id: javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization
message: Detected a call to `$FUNC()` in an attempt to HTML escape the string `$STR`.
Manually sanitizing input through a manually built list can be circumvented in
many situations, and it's better to use a well known sanitization library such
as `sanitize-html` or `DOMPurify`.
metadata:
category: security
technology:
- javascript
- typescript
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://www.npmjs.com/package/dompurify
- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization
shortlink: https://sg.run/AzoB
semgrep.dev:
rule:
r_id: 22550
rv_id: 1263104
rule_id: kxUYE9
version_id: l4TJR1L
url: https://semgrep.dev/playground/r/l4TJR1L/javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization
origin: community
languages:
- javascript
- typescript
severity: INFO
patterns:
- pattern-either:
- pattern: $STR.$FUNC('<', '&lt;')
- pattern: $STR.$FUNC('>', '&gt;')
- pattern: $STR.$FUNC('"', '&quot;')
- pattern: $STR.$FUNC("'", '&apos;')
- pattern: $STR.$FUNC('&', '&amp;')
- metavariable-regex:
metavariable: $FUNC
regex: (replace|replaceAll)
- id: javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage
message: A CSRF middleware was not detected in your express application. Ensure
you are either using one such as `csurf` or `csrf` (see rule references) and/or
you are properly doing CSRF validation in your routes with a token or cookies.
metadata:
category: security
references:
- https://www.npmjs.com/package/csurf
- https://www.npmjs.com/package/csrf
- https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
cwe:
- 'CWE-352: Cross-Site Request Forgery (CSRF)'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
technology:
- javascript
- typescript
- express
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site Request Forgery (CSRF)
source: https://semgrep.dev/r/javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage
shortlink: https://sg.run/BxzR
semgrep.dev:
rule:
r_id: 22551
rv_id: 1263128
rule_id: wdUKEq
version_id: yeTxp5d
url: https://semgrep.dev/playground/r/yeTxp5d/javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage
origin: community
languages:
- javascript
- typescript
severity: INFO
patterns:
- pattern-inside: |
$EXPRESS = require('express')
...
- pattern-not-inside: |
import {$CSRF} from 'csurf'
...
- pattern-not-inside: |
require('csurf')
...
- pattern-not-inside: |
import {$CSRF} from 'csrf'
...
- pattern-not-inside: |
require('csrf')
...
- pattern: |
$APP = $EXPRESS()
- id: javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing
message: Directory listing/indexing is enabled, which may lead to disclosure of
sensitive directories and files. It is recommended to disable directory listing
unless it is a public resource. If you need directory listing, ensure that sensitive
files are inaccessible when querying the resource.
options:
interfile: true
metadata:
interfile: true
cwe:
- 'CWE-548: Exposure of Information Through Directory Listing'
owasp:
- A06:2017 - Security Misconfiguration
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
category: security
technology:
- express
references:
- https://www.npmjs.com/package/serve-index
- https://www.acunetix.com/blog/articles/directory-listing-information-disclosure/
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing
shortlink: https://sg.run/DX2G
semgrep.dev:
rule:
r_id: 22552
rv_id: 1263129
rule_id: x8UqEb
version_id: rxTAKGb
url: https://semgrep.dev/playground/r/rxTAKGb/javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-either:
- pattern: |
$APP.use(require('serve-index')(...))
- patterns:
- pattern-either:
- pattern-inside: |
$SERVEINDEX = require('serve-index')
...
- pattern-inside: |
import $SERVEINDEX from 'serve-index'
...
- pattern-inside: |
import * as $SERVEINDEX from 'serve-index'
...
- pattern-either:
- patterns:
- pattern-inside: |
$VALUE = $SERVEINDEX(...)
...
- pattern: |
$VALUE(...)
- pattern: |
$APP.use(..., $SERVEINDEX(...), ...)
- id: javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage
message: Detected usage of the `notevil` package, which is unmaintained and has
vulnerabilities. Using any sort of `eval()` functionality can be very dangerous,
but if you must, the `eval` package is an up to date alternative. Be sure that
only trusted input reaches an `eval()` function.
metadata:
category: security
references:
- https://github.com/mmckegg/notevil
cwe:
- 'CWE-1104: Use of Unmaintained Third Party Components'
owasp:
- A06:2021 - Vulnerable and Outdated Components
- A03:2025 - Software Supply Chain Failures
technology:
- javascript
- typescript
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage
shortlink: https://sg.run/W70E
semgrep.dev:
rule:
r_id: 22553
rv_id: 1263136
rule_id: OrUX9K
version_id: e1TyjGl
url: https://semgrep.dev/playground/r/e1TyjGl/javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-either:
- pattern-inside: |
import $EVAL from 'notevil'
...
- pattern-inside: |
import {$EVAL} from 'notevil'
...
- pattern-inside: |
$EVAL = require('notevil')
...
- pattern-either:
- patterns:
- pattern: $EVAL(...)
- pattern-not: $EVAL('...')
- patterns:
- pattern-either:
- pattern: $VM.runInContext("$CMD", ...)
- pattern: $VM.runInNewContext("$CMD", ...)
- pattern: $VM.runInThisContext("$CMD", ...)
- pattern: $VM.compileFunction("$CMD", ...)
- metavariable-pattern:
patterns:
- pattern: $EVAL(...)
- pattern-not: $EVAL('...')
metavariable: $CMD
language: typescript
- id: javascript.express.security.audit.express-ssrf.express-ssrf
message: 'The following request $REQUEST.$METHOD() was found to be crafted from
user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities.
It is recommended where possible to not allow user-input to craft the base request,
but to be treated as part of the path or query parameter. When user-input is necessary
to craft the request, it is recommeneded to follow OWASP best practices to prevent
abuse. '
metadata:
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
technology:
- express
category: security
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/javascript.express.security.audit.express-ssrf.express-ssrf
shortlink: https://sg.run/0PNw
semgrep.dev:
rule:
r_id: 22554
rv_id: 1263144
rule_id: eqU9l2
version_id: 8KT5rBr
url: https://semgrep.dev/playground/r/8KT5rBr/javascript.express.security.audit.express-ssrf.express-ssrf
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
options:
taint_unify_mvars: true
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, ...) {...}
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,...) =>
{...}
- pattern-inside: |
({ $REQ }: $EXPRESS.Request,...) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
$REQUEST = require('request')
...
- pattern-inside: |
import * as $REQUEST from 'request'
...
- pattern-inside: |
import $REQUEST from 'request'
...
- pattern-either:
- pattern: $REQUEST.$METHOD("$HTTP"+$REQ. ... .$VALUE)
- pattern: $REQUEST.$METHOD("$HTTP"+$REQ. ... .$VALUE + $...A)
- pattern: $REQUEST.$METHOD(`$HTTP${$REQ. ... .$VALUE}...`)
- pattern: $REQUEST.$METHOD("$HTTP"+$REQ.$VALUE[...])
- pattern: $REQUEST.$METHOD("$HTTP"+$REQ.$VALUE[...] + $...A)
- pattern: $REQUEST.$METHOD(`$HTTP${$REQ.$VALUE[...]}...`)
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|patch|del|head|delete)$
- metavariable-regex:
metavariable: $HTTP
regex: ^(https?:\/\/|//)$
- pattern-either:
- pattern: $REQ. ... .$VALUE
- patterns:
- pattern-either:
- pattern-inside: |
$REQUEST = require('request')
...
- pattern-inside: |
import * as $REQUEST from 'request'
...
- pattern-inside: |
import $REQUEST from 'request'
...
- pattern-either:
- pattern: $REQUEST.$METHOD($REQ. ... .$VALUE,...)
- pattern: $REQUEST.$METHOD($REQ. ... .$VALUE + $...A,...)
- pattern: $REQUEST.$METHOD(`${$REQ. ... .$VALUE}...`,...)
- pattern: $REQ. ... .$VALUE
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|patch|del|head|delete)$
- patterns:
- pattern-either:
- pattern-inside: |
$REQUEST = require('request')
...
- pattern-inside: |
import * as $REQUEST from 'request'
...
- pattern-inside: |
import $REQUEST from 'request'
...
- pattern-either:
- pattern: $REQUEST.$METHOD($REQ.$VALUE['...'],...)
- pattern: $REQUEST.$METHOD($REQ.$VALUE['...'] + $...A,...)
- pattern: $REQUEST.$METHOD(`${$REQ.$VALUE['...']}...`,...)
- pattern: $REQ.$VALUE
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|patch|del|head|delete)$
- patterns:
- pattern-either:
- pattern-inside: |
$REQUEST = require('request')
...
- pattern-inside: |
import * as $REQUEST from 'request'
...
- pattern-inside: |
import $REQUEST from 'request'
...
- pattern-either:
- pattern-inside: |
$ASSIGN = $REQ. ... .$VALUE
...
- pattern-inside: |
$ASSIGN = $REQ. ... .$VALUE['...']
...
- pattern-inside: |
$ASSIGN = $REQ. ... .$VALUE + $...A
...
- pattern-inside: "$ASSIGN = $REQ. ... .$VALUE['...'] + $...A\n... \n"
- pattern-inside: |
$ASSIGN = `${$REQ. ... .$VALUE}...`
...
- pattern-inside: "$ASSIGN = `${$REQ. ... .$VALUE['...']}...`\n... \n"
- patterns:
- pattern-either:
- pattern-inside: |
$ASSIGN = "$HTTP"+ $REQ. ... .$VALUE
...
- pattern-inside: |
$ASSIGN = "$HTTP"+$REQ. ... .$VALUE + $...A
...
- pattern-inside: |
$ASSIGN = "$HTTP"+$REQ.$VALUE[...]
...
- pattern-inside: |
$ASSIGN = "$HTTP"+$REQ.$VALUE[...] + $...A
...
- pattern-inside: |
$ASSIGN = `$HTTP${$REQ.$VALUE[...]}...`
...
- metavariable-regex:
metavariable: $HTTP
regex: ^(https?:\/\/|//)$
- pattern-either:
- pattern: $REQUEST.$METHOD($ASSIGN,...)
- pattern: $REQUEST.$METHOD($ASSIGN + $...FOO,...)
- pattern: $REQUEST.$METHOD(`${$ASSIGN}...`,...)
- patterns:
- pattern-either:
- pattern: $REQUEST.$METHOD("$HTTP"+$ASSIGN,...)
- pattern: $REQUEST.$METHOD("$HTTP"+$ASSIGN + $...A,...)
- pattern: $REQUEST.$METHOD(`$HTTP${$ASSIGN}...`,...)
- metavariable-regex:
metavariable: $HTTP
regex: ^(https?:\/\/|//)$
- pattern: $ASSIGN
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|patch|del|head|delete)$
- id: javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key
message: Detected a hardcoded hmac key. Avoid hardcoding secrets and consider using
an alternate option such as reading the secret from a config file or using an
environment variable.
options:
interfile: true
metadata:
interfile: true
category: security
technology:
- crypto
- hmac
references:
- https://rules.sonarsource.com/javascript/RSPEC-2068
- https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#key-management
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key
shortlink: https://sg.run/K9bn
semgrep.dev:
rule:
r_id: 22555
rv_id: 1263198
rule_id: v8UGEw
version_id: A8Tgdyk
url: https://semgrep.dev/playground/r/A8Tgdyk/javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key
origin: community
languages:
- javascript
- typescript
severity: WARNING
pattern-either:
- pattern: $CRYPTO.createHmac($ALGO, '...')
- patterns:
- pattern-inside: |
const $SECRET = '...'
...
- pattern: $CRYPTO.createHmac($ALGO, $SECRET)
- id: csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure
patterns:
- pattern: $APP.UseDeveloperExceptionPage(...);
- pattern-not-inside: |
if ($ENV.IsDevelopment(...)) {
...
}
- pattern-not-inside: |
if ($ENV.EnvironmentName == "Development") {
...
}
message: Stacktrace information is displayed in a non-Development environment. Accidentally
disclosing sensitive stack trace information in a production environment aids
an attacker in reconnaissance and information gathering.
metadata:
category: security
technology:
- csharp
owasp:
- A06:2017 - Security Misconfiguration
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
cwe:
- 'CWE-209: Generation of Error Message Containing Sensitive Information'
references:
- https://cwe.mitre.org/data/definitions/209.html
- https://owasp.org/Top10/A04_2021-Insecure_Design/
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure
shortlink: https://sg.run/XvkA
semgrep.dev:
rule:
r_id: 26720
rv_id: 1262653
rule_id: lBU6Dv
version_id: 0bTKzrB
url: https://semgrep.dev/playground/r/0bTKzrB/csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure
origin: community
languages:
- csharp
severity: WARNING
- id: csharp.dotnet.security.audit.mass-assignment.mass-assignment
message: Mass assignment or Autobinding vulnerability in code allows an attacker
to execute over-posting attacks, which could create a new parameter in the binding
request and manipulate the underlying object in the application.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe:
- 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object
Attributes'
owasp:
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
references:
- https://cwe.mitre.org/data/definitions/915.html
- https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa6-mass-assignment.md
subcategory:
- vuln
technology:
- .net
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mass Assignment
source: https://semgrep.dev/r/csharp.dotnet.security.audit.mass-assignment.mass-assignment
shortlink: https://sg.run/7B3e
semgrep.dev:
rule:
r_id: 26838
rv_id: 1262613
rule_id: x8Up5B
version_id: YDTZeD9
url: https://semgrep.dev/playground/r/YDTZeD9/csharp.dotnet.security.audit.mass-assignment.mass-assignment
origin: community
languages:
- csharp
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
public IActionResult $METHOD(..., $TYPE $ARG, ...){
...
}
- pattern: |
public ActionResult $METHOD(..., $TYPE $ARG, ...){
...
}
- pattern-inside: |
using Microsoft.AspNetCore.Mvc;
...
- pattern-not: |
public IActionResult $METHOD(..., [Bind(...)] $TYPE $ARG, ...){
...
}
- pattern-not: |
public ActionResult $METHOD(..., [Bind(...)] $TYPE $ARG, ...){
...
}
- focus-metavariable: $ARG
pattern-sinks:
- pattern: View(...)
- id: python.lang.security.dangerous-code-run.dangerous-interactive-code-run
mode: taint
options:
symbolic_propagation: true
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: flask.request.form.get(...)
- pattern: flask.request.form[...]
- pattern: flask.request.args.get(...)
- pattern: flask.request.args[...]
- pattern: flask.request.values.get(...)
- pattern: flask.request.values[...]
- pattern: flask.request.cookies.get(...)
- pattern: flask.request.cookies[...]
- pattern: flask.request.stream
- pattern: flask.request.headers.get(...)
- pattern: flask.request.headers[...]
- pattern: flask.request.data
- pattern: flask.request.full_path
- pattern: flask.request.url
- pattern: flask.request.json
- pattern: flask.request.get_json()
- pattern: flask.request.view_args.get(...)
- pattern: flask.request.view_args[...]
- patterns:
- pattern-inside: |
@$APP.route(...)
def $FUNC(..., $ROUTEVAR, ...):
...
- focus-metavariable: $ROUTEVAR
- patterns:
- pattern-inside: |
def $FUNC(request, ...):
...
- pattern-either:
- pattern: request.$PROPERTY.get(...)
- pattern: request.$PROPERTY[...]
- patterns:
- pattern-either:
- pattern-inside: |
@rest_framework.decorators.api_view(...)
def $FUNC($REQ, ...):
...
- patterns:
- pattern-either:
- pattern-inside: |
class $VIEW(..., rest_framework.views.APIView, ...):
...
- pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView,
...):\n ... \n"
- pattern-inside: |
def $METHOD(self, $REQ, ...):
...
- metavariable-regex:
metavariable: $METHOD
regex: (get|post|put|patch|delete|head)
- pattern-either:
- pattern: $REQ.POST.get(...)
- pattern: $REQ.POST[...]
- pattern: $REQ.FILES.get(...)
- pattern: $REQ.FILES[...]
- pattern: $REQ.DATA.get(...)
- pattern: $REQ.DATA[...]
- pattern: $REQ.QUERY_PARAMS.get(...)
- pattern: $REQ.QUERY_PARAMS[...]
- pattern: $REQ.data.get(...)
- pattern: $REQ.data[...]
- pattern: $REQ.query_params.get(...)
- pattern: $REQ.query_params[...]
- pattern: $REQ.content_type
- pattern: $REQ.content_type
- pattern: $REQ.stream
- pattern: $REQ.stream
- patterns:
- pattern-either:
- pattern-inside: |
class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):
...
- pattern-inside: |
class $SERVER(..., http.server.StreamRequestHandler, ...):
...
- pattern-inside: |
class $SERVER(..., http.server.DatagramRequestHandler, ...):
...
- pattern-either:
- pattern: self.requestline
- pattern: self.path
- pattern: self.headers[...]
- pattern: self.headers.get(...)
- pattern: self.rfile
- patterns:
- pattern-inside: |
@pyramid.view.view_config( ... )
def $VIEW($REQ):
...
- pattern: $REQ.$ANYTHING
- pattern-not: $REQ.dbsession
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
$X = code.InteractiveConsole(...)
...
- pattern-inside: |
$X = code.InteractiveInterpreter(...)
...
- pattern-either:
- pattern: |
$X.push($PAYLOAD,...)
- pattern: |
$X.runsource($PAYLOAD,...)
- pattern: |
$X.runcode(code.compile_command($PAYLOAD),...)
- pattern: |
$PL = code.compile_command($PAYLOAD,...)
...
$X.runcode($PL,...)
- focus-metavariable: $PAYLOAD
- pattern-not: |
$X.push("...",...)
- pattern-not: |
$X.runsource("...",...)
- pattern-not: |
$X.runcode(code.compile_command("..."),...)
- pattern-not: |
$PL = code.compile_command("...",...)
...
$X.runcode($PL,...)
message: Found user controlled data inside InteractiveConsole/InteractiveInterpreter
method. This is dangerous if external data can reach this function call because
it allows a malicious actor to run arbitrary Python code.
metadata:
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://semgrep.dev/docs/cheat-sheets/python-command-injection/
category: security
technology:
- python
confidence: MEDIUM
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/python.lang.security.dangerous-code-run.dangerous-interactive-code-run
shortlink: https://sg.run/9pRY
semgrep.dev:
rule:
r_id: 27267
rv_id: 1263521
rule_id: KxUKzx
version_id: l4TJRgo
url: https://semgrep.dev/playground/r/l4TJRgo/python.lang.security.dangerous-code-run.dangerous-interactive-code-run
origin: community
severity: WARNING
languages:
- python
- id: python.lang.security.dangerous-os-exec.dangerous-os-exec
mode: taint
options:
symbolic_propagation: true
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: flask.request.form.get(...)
- pattern: flask.request.form[...]
- pattern: flask.request.args.get(...)
- pattern: flask.request.args[...]
- pattern: flask.request.values.get(...)
- pattern: flask.request.values[...]
- pattern: flask.request.cookies.get(...)
- pattern: flask.request.cookies[...]
- pattern: flask.request.stream
- pattern: flask.request.headers.get(...)
- pattern: flask.request.headers[...]
- pattern: flask.request.data
- pattern: flask.request.full_path
- pattern: flask.request.url
- pattern: flask.request.json
- pattern: flask.request.get_json()
- pattern: flask.request.view_args.get(...)
- pattern: flask.request.view_args[...]
- patterns:
- pattern-inside: |
@$APP.route(...)
def $FUNC(..., $ROUTEVAR, ...):
...
- focus-metavariable: $ROUTEVAR
- patterns:
- pattern-inside: |
def $FUNC(request, ...):
...
- pattern-either:
- pattern: request.$PROPERTY.get(...)
- pattern: request.$PROPERTY[...]
- patterns:
- pattern-either:
- pattern-inside: |
@rest_framework.decorators.api_view(...)
def $FUNC($REQ, ...):
...
- patterns:
- pattern-either:
- pattern-inside: |
class $VIEW(..., rest_framework.views.APIView, ...):
...
- pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView,
...):\n ... \n"
- pattern-inside: |
def $METHOD(self, $REQ, ...):
...
- metavariable-regex:
metavariable: $METHOD
regex: (get|post|put|patch|delete|head)
- pattern-either:
- pattern: $REQ.POST.get(...)
- pattern: $REQ.POST[...]
- pattern: $REQ.FILES.get(...)
- pattern: $REQ.FILES[...]
- pattern: $REQ.DATA.get(...)
- pattern: $REQ.DATA[...]
- pattern: $REQ.QUERY_PARAMS.get(...)
- pattern: $REQ.QUERY_PARAMS[...]
- pattern: $REQ.data.get(...)
- pattern: $REQ.data[...]
- pattern: $REQ.query_params.get(...)
- pattern: $REQ.query_params[...]
- pattern: $REQ.content_type
- pattern: $REQ.content_type
- pattern: $REQ.stream
- pattern: $REQ.stream
- patterns:
- pattern-either:
- pattern-inside: |
class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):
...
- pattern-inside: |
class $SERVER(..., http.server.StreamRequestHandler, ...):
...
- pattern-inside: |
class $SERVER(..., http.server.DatagramRequestHandler, ...):
...
- pattern-either:
- pattern: self.requestline
- pattern: self.path
- pattern: self.headers[...]
- pattern: self.headers.get(...)
- pattern: self.rfile
- patterns:
- pattern-inside: |
@pyramid.view.view_config( ... )
def $VIEW($REQ):
...
- pattern: $REQ.$ANYTHING
- pattern-not: $REQ.dbsession
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-not: os.$METHOD("...", ...)
- pattern: os.$METHOD(...)
- metavariable-regex:
metavariable: $METHOD
regex: (execl|execle|execlp|execlpe|execv|execve|execvp|execvpe)
- patterns:
- pattern-not: os.$METHOD("...", [$PATH,"...","...",...],...)
- pattern-inside: os.$METHOD($BASH,[$PATH,"-c",$CMD,...],...)
- pattern: $CMD
- metavariable-regex:
metavariable: $METHOD
regex: (execv|execve|execvp|execvpe)
- metavariable-regex:
metavariable: $BASH
regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
- patterns:
- pattern-not: os.$METHOD("...", $PATH, "...", "...",...)
- pattern-inside: os.$METHOD($BASH, $PATH, "-c", $CMD,...)
- pattern: $CMD
- metavariable-regex:
metavariable: $METHOD
regex: (execl|execle|execlp|execlpe)
- metavariable-regex:
metavariable: $BASH
regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
message: Found user controlled content when spawning a process. This is dangerous
because it allows a malicious actor to execute commands.
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://semgrep.dev/docs/cheat-sheets/python-command-injection/
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.8 OS Command Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
confidence: MEDIUM
category: security
technology:
- python
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.lang.security.dangerous-os-exec.dangerous-os-exec
shortlink: https://sg.run/yL9x
semgrep.dev:
rule:
r_id: 27268
rv_id: 1263523
rule_id: qNUR13
version_id: 6xT29rz
url: https://semgrep.dev/playground/r/6xT29rz/python.lang.security.dangerous-os-exec.dangerous-os-exec
origin: community
languages:
- python
severity: ERROR
- id: python.lang.security.dangerous-spawn-process.dangerous-spawn-process
mode: taint
options:
symbolic_propagation: true
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: flask.request.form.get(...)
- pattern: flask.request.form[...]
- pattern: flask.request.args.get(...)
- pattern: flask.request.args[...]
- pattern: flask.request.values.get(...)
- pattern: flask.request.values[...]
- pattern: flask.request.cookies.get(...)
- pattern: flask.request.cookies[...]
- pattern: flask.request.stream
- pattern: flask.request.headers.get(...)
- pattern: flask.request.headers[...]
- pattern: flask.request.data
- pattern: flask.request.full_path
- pattern: flask.request.url
- pattern: flask.request.json
- pattern: flask.request.get_json()
- pattern: flask.request.view_args.get(...)
- pattern: flask.request.view_args[...]
- patterns:
- pattern-inside: |
@$APP.route(...)
def $FUNC(..., $ROUTEVAR, ...):
...
- pattern: $ROUTEVAR
- patterns:
- pattern-inside: |
def $FUNC(request, ...):
...
- pattern-either:
- pattern: request.$PROPERTY.get(...)
- pattern: request.$PROPERTY[...]
- patterns:
- pattern-either:
- pattern-inside: |
@rest_framework.decorators.api_view(...)
def $FUNC($REQ, ...):
...
- patterns:
- pattern-either:
- pattern-inside: |
class $VIEW(..., rest_framework.views.APIView, ...):
...
- pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView,
...):\n ... \n"
- pattern-inside: |
def $METHOD(self, $REQ, ...):
...
- metavariable-regex:
metavariable: $METHOD
regex: (get|post|put|patch|delete|head)
- pattern-either:
- pattern: $REQ.POST.get(...)
- pattern: $REQ.POST[...]
- pattern: $REQ.FILES.get(...)
- pattern: $REQ.FILES[...]
- pattern: $REQ.DATA.get(...)
- pattern: $REQ.DATA[...]
- pattern: $REQ.QUERY_PARAMS.get(...)
- pattern: $REQ.QUERY_PARAMS[...]
- pattern: $REQ.data.get(...)
- pattern: $REQ.data[...]
- pattern: $REQ.query_params.get(...)
- pattern: $REQ.query_params[...]
- pattern: $REQ.content_type
- pattern: $REQ.content_type
- pattern: $REQ.stream
- pattern: $REQ.stream
- patterns:
- pattern-either:
- pattern-inside: |
class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):
...
- pattern-inside: |
class $SERVER(..., http.server.StreamRequestHandler, ...):
...
- pattern-inside: |
class $SERVER(..., http.server.DatagramRequestHandler, ...):
...
- pattern-either:
- pattern: self.requestline
- pattern: self.path
- pattern: self.headers[...]
- pattern: self.headers.get(...)
- pattern: self.rfile
- patterns:
- pattern-inside: |
@pyramid.view.view_config( ... )
def $VIEW($REQ):
...
- pattern: $REQ.$ANYTHING
- pattern-not: $REQ.dbsession
- patterns:
- pattern-either:
- pattern: os.environ['$ANYTHING']
- pattern: os.environ.get('$FOO', ...)
- pattern: os.environb['$ANYTHING']
- pattern: os.environb.get('$FOO', ...)
- pattern: os.getenv('$ANYTHING', ...)
- pattern: os.getenvb('$ANYTHING', ...)
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: sys.argv[...]
- pattern: sys.orig_argv[...]
- patterns:
- pattern-inside: |
$PARSER = argparse.ArgumentParser(...)
...
- pattern-inside: |
$ARGS = $PARSER.parse_args()
- pattern: <... $ARGS ...>
- patterns:
- pattern-inside: |
$PARSER = optparse.OptionParser(...)
...
- pattern-inside: |
$ARGS = $PARSER.parse_args()
- pattern: <... $ARGS ...>
- patterns:
- pattern-either:
- pattern-inside: |
$OPTS, $ARGS = getopt.getopt(...)
...
- pattern-inside: |
$OPTS, $ARGS = getopt.gnu_getopt(...)
...
- pattern-either:
- patterns:
- pattern-inside: |
for $O, $A in $OPTS:
...
- pattern: $A
- pattern: $ARGS
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-not: os.$METHOD($MODE, "...", ...)
- pattern-inside: os.$METHOD($MODE, $CMD, ...)
- pattern: $CMD
- metavariable-regex:
metavariable: $METHOD
regex: (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile)
- patterns:
- pattern-not: os.$METHOD($MODE, "...", ["...","...",...], ...)
- pattern-inside: os.$METHOD($MODE, $BASH, ["-c",$CMD,...],...)
- pattern: $CMD
- metavariable-regex:
metavariable: $METHOD
regex: (spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp)
- metavariable-regex:
metavariable: $BASH
regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
- patterns:
- pattern-not: os.$METHOD($MODE, "...", "...", "...", ...)
- pattern-inside: os.$METHOD($MODE, $BASH, "-c", $CMD,...)
- pattern: $CMD
- metavariable-regex:
metavariable: $METHOD
regex: (spawnl|spawnle|spawnlp|spawnlpe)
- metavariable-regex:
metavariable: $BASH
regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
message: Found user controlled content when spawning a process. This is dangerous
because it allows a malicious actor to execute commands.
metadata:
source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://semgrep.dev/docs/cheat-sheets/python-command-injection/
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.8 OS Command Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
category: security
technology:
- python
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.lang.security.dangerous-spawn-process.dangerous-spawn-process
shortlink: https://sg.run/r8Zn
semgrep.dev:
rule:
r_id: 27269
rv_id: 1263524
rule_id: lBUJrn
version_id: o5TbDO5
url: https://semgrep.dev/playground/r/o5TbDO5/python.lang.security.dangerous-spawn-process.dangerous-spawn-process
origin: community
languages:
- python
severity: ERROR
- id: python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string
mode: taint
options:
symbolic_propagation: true
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: flask.request.form.get(...)
- pattern: flask.request.form[...]
- pattern: flask.request.args.get(...)
- pattern: flask.request.args[...]
- pattern: flask.request.values.get(...)
- pattern: flask.request.values[...]
- pattern: flask.request.cookies.get(...)
- pattern: flask.request.cookies[...]
- pattern: flask.request.stream
- pattern: flask.request.headers.get(...)
- pattern: flask.request.headers[...]
- pattern: flask.request.data
- pattern: flask.request.full_path
- pattern: flask.request.url
- pattern: flask.request.json
- pattern: flask.request.get_json()
- pattern: flask.request.view_args.get(...)
- pattern: flask.request.view_args[...]
- patterns:
- pattern-inside: |
@$APP.route(...)
def $FUNC(..., $ROUTEVAR, ...):
...
- focus-metavariable: $ROUTEVAR
- patterns:
- pattern-inside: |
def $FUNC(request, ...):
...
- pattern-either:
- pattern: request.$PROPERTY.get(...)
- pattern: request.$PROPERTY[...]
- patterns:
- pattern-either:
- pattern-inside: |
@rest_framework.decorators.api_view(...)
def $FUNC($REQ, ...):
...
- patterns:
- pattern-either:
- pattern-inside: |
class $VIEW(..., rest_framework.views.APIView, ...):
...
- pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView,
...):\n ... \n"
- pattern-inside: |
def $METHOD(self, $REQ, ...):
...
- metavariable-regex:
metavariable: $METHOD
regex: (get|post|put|patch|delete|head)
- pattern-either:
- pattern: $REQ.POST.get(...)
- pattern: $REQ.POST[...]
- pattern: $REQ.FILES.get(...)
- pattern: $REQ.FILES[...]
- pattern: $REQ.DATA.get(...)
- pattern: $REQ.DATA[...]
- pattern: $REQ.QUERY_PARAMS.get(...)
- pattern: $REQ.QUERY_PARAMS[...]
- pattern: $REQ.data.get(...)
- pattern: $REQ.data[...]
- pattern: $REQ.query_params.get(...)
- pattern: $REQ.query_params[...]
- pattern: $REQ.content_type
- pattern: $REQ.content_type
- pattern: $REQ.stream
- pattern: $REQ.stream
- patterns:
- pattern-either:
- pattern-inside: |
class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):
...
- pattern-inside: |
class $SERVER(..., http.server.StreamRequestHandler, ...):
...
- pattern-inside: |
class $SERVER(..., http.server.DatagramRequestHandler, ...):
...
- pattern-either:
- pattern: self.requestline
- pattern: self.path
- pattern: self.headers[...]
- pattern: self.headers.get(...)
- pattern: self.rfile
- patterns:
- pattern-inside: |
@pyramid.view.view_config( ... )
def $VIEW($REQ):
...
- pattern: $REQ.$ANYTHING
- pattern-not: $REQ.dbsession
pattern-sinks:
- patterns:
- pattern: |
_xxsubinterpreters.run_string($ID, $PAYLOAD, ...)
- pattern-not: |
_xxsubinterpreters.run_string($ID, "...", ...)
- focus-metavariable: $PAYLOAD
message: Found user controlled content in `run_string`. This is dangerous because
it allows a malicious actor to run arbitrary Python code.
metadata:
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://bugs.python.org/issue43472
- https://semgrep.dev/docs/cheat-sheets/python-command-injection/
category: security
technology:
- python
confidence: MEDIUM
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string
shortlink: https://sg.run/bPop
semgrep.dev:
rule:
r_id: 27270
rv_id: 1263525
rule_id: PeURWr
version_id: zyTb2OX
url: https://semgrep.dev/playground/r/zyTb2OX/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string
origin: community
severity: WARNING
languages:
- python
- id: python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use
mode: taint
options:
symbolic_propagation: true
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: flask.request.form.get(...)
- pattern: flask.request.form[...]
- pattern: flask.request.args.get(...)
- pattern: flask.request.args[...]
- pattern: flask.request.values.get(...)
- pattern: flask.request.values[...]
- pattern: flask.request.cookies.get(...)
- pattern: flask.request.cookies[...]
- pattern: flask.request.stream
- pattern: flask.request.headers.get(...)
- pattern: flask.request.headers[...]
- pattern: flask.request.data
- pattern: flask.request.full_path
- pattern: flask.request.url
- pattern: flask.request.json
- pattern: flask.request.get_json()
- pattern: flask.request.view_args.get(...)
- pattern: flask.request.view_args[...]
- patterns:
- pattern-inside: |
@$APP.route(...)
def $FUNC(..., $ROUTEVAR, ...):
...
- focus-metavariable: $ROUTEVAR
- patterns:
- pattern-inside: |
def $FUNC(request, ...):
...
- pattern-either:
- pattern: request.$PROPERTY.get(...)
- pattern: request.$PROPERTY[...]
- patterns:
- pattern-either:
- pattern-inside: |
@rest_framework.decorators.api_view(...)
def $FUNC($REQ, ...):
...
- patterns:
- pattern-either:
- pattern-inside: |
class $VIEW(..., rest_framework.views.APIView, ...):
...
- pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView,
...):\n ... \n"
- pattern-inside: |
def $METHOD(self, $REQ, ...):
...
- metavariable-regex:
metavariable: $METHOD
regex: (get|post|put|patch|delete|head)
- pattern-either:
- pattern: $REQ.POST.get(...)
- pattern: $REQ.POST[...]
- pattern: $REQ.FILES.get(...)
- pattern: $REQ.FILES[...]
- pattern: $REQ.DATA.get(...)
- pattern: $REQ.DATA[...]
- pattern: $REQ.QUERY_PARAMS.get(...)
- pattern: $REQ.QUERY_PARAMS[...]
- pattern: $REQ.data.get(...)
- pattern: $REQ.data[...]
- pattern: $REQ.query_params.get(...)
- pattern: $REQ.query_params[...]
- pattern: $REQ.content_type
- pattern: $REQ.content_type
- pattern: $REQ.stream
- pattern: $REQ.stream
- patterns:
- pattern-either:
- pattern-inside: |
class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):
...
- pattern-inside: |
class $SERVER(..., http.server.StreamRequestHandler, ...):
...
- pattern-inside: |
class $SERVER(..., http.server.DatagramRequestHandler, ...):
...
- pattern-either:
- pattern: self.requestline
- pattern: self.path
- pattern: self.headers[...]
- pattern: self.headers.get(...)
- pattern: self.rfile
- patterns:
- pattern-inside: |
@pyramid.view.view_config( ... )
def $VIEW($REQ):
...
- pattern: $REQ.$ANYTHING
- pattern-not: $REQ.dbsession
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-not: subprocess.$FUNC("...", ...)
- pattern-not: subprocess.$FUNC(["...",...], ...)
- pattern-not: subprocess.$FUNC(("...",...), ...)
- pattern-not: subprocess.CalledProcessError(...)
- pattern-not: subprocess.SubprocessError(...)
- pattern: subprocess.$FUNC($CMD, ...)
- patterns:
- pattern-not: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...)
- pattern: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD)
- patterns:
- pattern-not: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...],...)
- pattern-not: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...),...)
- pattern-either:
- pattern: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD],
...)
- pattern: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD),
...)
- patterns:
- pattern-not: subprocess.$FUNC("=~/(python)/","...",...)
- pattern: subprocess.$FUNC("=~/(python)/", $CMD)
- patterns:
- pattern-not: subprocess.$FUNC(["=~/(python)/","...",...],...)
- pattern-not: subprocess.$FUNC(("=~/(python)/","...",...),...)
- pattern-either:
- pattern: subprocess.$FUNC(["=~/(python)/", $CMD],...)
- pattern: subprocess.$FUNC(("=~/(python)/", $CMD),...)
- focus-metavariable: $CMD
message: Detected subprocess function '$FUNC' with user controlled data. A malicious
actor could leverage this to perform command injection. You may consider using
'shlex.escape()'.
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.8 OS Command Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
references:
- https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess
- https://docs.python.org/3/library/subprocess.html
- https://docs.python.org/3/library/shlex.html
- https://semgrep.dev/docs/cheat-sheets/python-command-injection/
category: security
technology:
- python
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use
shortlink: https://sg.run/NWxp
semgrep.dev:
rule:
r_id: 27271
rv_id: 1263526
rule_id: JDUz3R
version_id: pZT038J
url: https://semgrep.dev/playground/r/pZT038J/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use
origin: community
languages:
- python
severity: ERROR
- id: python.lang.security.dangerous-system-call.dangerous-system-call
mode: taint
options:
symbolic_propagation: true
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: flask.request.form.get(...)
- pattern: flask.request.form[...]
- pattern: flask.request.args.get(...)
- pattern: flask.request.args[...]
- pattern: flask.request.values.get(...)
- pattern: flask.request.values[...]
- pattern: flask.request.cookies.get(...)
- pattern: flask.request.cookies[...]
- pattern: flask.request.stream
- pattern: flask.request.headers.get(...)
- pattern: flask.request.headers[...]
- pattern: flask.request.data
- pattern: flask.request.full_path
- pattern: flask.request.url
- pattern: flask.request.json
- pattern: flask.request.get_json()
- pattern: flask.request.view_args.get(...)
- pattern: flask.request.view_args[...]
- patterns:
- pattern-inside: |
@$APP.route(...)
def $FUNC(..., $ROUTEVAR, ...):
...
- focus-metavariable: $ROUTEVAR
- patterns:
- pattern-inside: |
def $FUNC(request, ...):
...
- pattern-either:
- pattern: request.$PROPERTY.get(...)
- pattern: request.$PROPERTY[...]
- patterns:
- pattern-either:
- pattern-inside: |
@rest_framework.decorators.api_view(...)
def $FUNC($REQ, ...):
...
- patterns:
- pattern-either:
- pattern-inside: |
class $VIEW(..., rest_framework.views.APIView, ...):
...
- pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView,
...):\n ... \n"
- pattern-inside: |
def $METHOD(self, $REQ, ...):
...
- metavariable-regex:
metavariable: $METHOD
regex: (get|post|put|patch|delete|head)
- pattern-either:
- pattern: $REQ.POST.get(...)
- pattern: $REQ.POST[...]
- pattern: $REQ.FILES.get(...)
- pattern: $REQ.FILES[...]
- pattern: $REQ.DATA.get(...)
- pattern: $REQ.DATA[...]
- pattern: $REQ.QUERY_PARAMS.get(...)
- pattern: $REQ.QUERY_PARAMS[...]
- pattern: $REQ.data.get(...)
- pattern: $REQ.data[...]
- pattern: $REQ.query_params.get(...)
- pattern: $REQ.query_params[...]
- pattern: $REQ.content_type
- pattern: $REQ.content_type
- pattern: $REQ.stream
- pattern: $REQ.stream
- patterns:
- pattern-either:
- pattern-inside: |
class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):
...
- pattern-inside: |
class $SERVER(..., http.server.StreamRequestHandler, ...):
...
- pattern-inside: |
class $SERVER(..., http.server.DatagramRequestHandler, ...):
...
- pattern-either:
- pattern: self.requestline
- pattern: self.path
- pattern: self.headers[...]
- pattern: self.headers.get(...)
- pattern: self.rfile
- patterns:
- pattern-inside: |
@pyramid.view.view_config( ... )
def $VIEW($REQ):
...
- pattern: $REQ.$ANYTHING
- pattern-not: $REQ.dbsession
pattern-sinks:
- patterns:
- pattern-not: os.$W("...", ...)
- pattern-either:
- pattern: os.system(...)
- pattern: getattr(os, "system")(...)
- pattern: __import__("os").system(...)
- pattern: getattr(__import__("os"), "system")(...)
- pattern: |
$X = __import__("os")
...
$X.system(...)
- pattern: |
$X = __import__("os")
...
getattr($X, "system")(...)
- pattern: |
$X = getattr(os, "system")
...
$X(...)
- pattern: |
$X = __import__("os")
...
$Y = getattr($X, "system")
...
$Y(...)
- pattern: os.popen(...)
- pattern: os.popen2(...)
- pattern: os.popen3(...)
- pattern: os.popen4(...)
message: Found user-controlled data used in a system call. This could allow a malicious
actor to execute commands. Use the 'subprocess' module instead, which is easier
to use without accidentally exposing a command injection vulnerability.
metadata:
source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://semgrep.dev/docs/cheat-sheets/python-command-injection/
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.2.4 Dyanmic Code Execution Features
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements
version: '4'
category: security
technology:
- python
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.lang.security.dangerous-system-call.dangerous-system-call
shortlink: https://sg.run/k0W7
semgrep.dev:
rule:
r_id: 27272
rv_id: 1263527
rule_id: 5rUoP1
version_id: 2KTv2Zn
url: https://semgrep.dev/playground/r/2KTv2Zn/python.lang.security.dangerous-system-call.dangerous-system-call
origin: community
languages:
- python
severity: ERROR
- id: python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp
mode: taint
options:
symbolic_propagation: true
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: flask.request.form.get(...)
- pattern: flask.request.form[...]
- pattern: flask.request.args.get(...)
- pattern: flask.request.args[...]
- pattern: flask.request.values.get(...)
- pattern: flask.request.values[...]
- pattern: flask.request.cookies.get(...)
- pattern: flask.request.cookies[...]
- pattern: flask.request.stream
- pattern: flask.request.headers.get(...)
- pattern: flask.request.headers[...]
- pattern: flask.request.data
- pattern: flask.request.full_path
- pattern: flask.request.url
- pattern: flask.request.json
- pattern: flask.request.get_json()
- pattern: flask.request.view_args.get(...)
- pattern: flask.request.view_args[...]
- patterns:
- pattern-inside: |
@$APP.route(...)
def $FUNC(..., $ROUTEVAR, ...):
...
- focus-metavariable: $ROUTEVAR
- patterns:
- pattern-inside: |
def $FUNC(request, ...):
...
- pattern-either:
- pattern: request.$PROPERTY.get(...)
- pattern: request.$PROPERTY[...]
- patterns:
- pattern-either:
- pattern-inside: |
@rest_framework.decorators.api_view(...)
def $FUNC($REQ, ...):
...
- patterns:
- pattern-either:
- pattern-inside: |
class $VIEW(..., rest_framework.views.APIView, ...):
...
- pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView,
...):\n ... \n"
- pattern-inside: |
def $METHOD(self, $REQ, ...):
...
- metavariable-regex:
metavariable: $METHOD
regex: (get|post|put|patch|delete|head)
- pattern-either:
- pattern: $REQ.POST.get(...)
- pattern: $REQ.POST[...]
- pattern: $REQ.FILES.get(...)
- pattern: $REQ.FILES[...]
- pattern: $REQ.DATA.get(...)
- pattern: $REQ.DATA[...]
- pattern: $REQ.QUERY_PARAMS.get(...)
- pattern: $REQ.QUERY_PARAMS[...]
- pattern: $REQ.data.get(...)
- pattern: $REQ.data[...]
- pattern: $REQ.query_params.get(...)
- pattern: $REQ.query_params[...]
- pattern: $REQ.content_type
- pattern: $REQ.content_type
- pattern: $REQ.stream
- pattern: $REQ.stream
- patterns:
- pattern-either:
- pattern-inside: |
class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):
...
- pattern-inside: |
class $SERVER(..., http.server.StreamRequestHandler, ...):
...
- pattern-inside: |
class $SERVER(..., http.server.DatagramRequestHandler, ...):
...
- pattern-either:
- pattern: self.requestline
- pattern: self.path
- pattern: self.headers[...]
- pattern: self.headers.get(...)
- pattern: self.rfile
- patterns:
- pattern-inside: |
@pyramid.view.view_config( ... )
def $VIEW($REQ):
...
- pattern: $REQ.$ANYTHING
- pattern-not: $REQ.dbsession
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
_testcapi.run_in_subinterp($PAYLOAD, ...)
- pattern: |
test.support.run_in_subinterp($PAYLOAD, ...)
- focus-metavariable: $PAYLOAD
- pattern-not: |
_testcapi.run_in_subinterp("...", ...)
- pattern-not: |
test.support.run_in_subinterp("...", ...)
message: Found user controlled content in `run_in_subinterp`. This is dangerous
because it allows a malicious actor to run arbitrary Python code.
metadata:
cwe:
- 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
(''Eval Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://semgrep.dev/docs/cheat-sheets/python-command-injection/
category: security
technology:
- python
confidence: MEDIUM
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp
shortlink: https://sg.run/wLpY
semgrep.dev:
rule:
r_id: 27273
rv_id: 1263528
rule_id: GdUkxR
version_id: X0Tzy1e
url: https://semgrep.dev/playground/r/X0Tzy1e/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp
origin: community
severity: WARNING
languages:
- python
- id: csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation
patterns:
- pattern-either:
- patterns:
- pattern: $LIFETIME = $FALSE
- pattern-inside: new TokenValidationParameters {...}
- patterns:
- pattern: |
(TokenValidationParameters $OPTS). ... .$LIFETIME = $FALSE
- metavariable-regex:
metavariable: $LIFETIME
regex: (RequireExpirationTime|ValidateLifetime)
- metavariable-regex:
metavariable: $FALSE
regex: (false)
- focus-metavariable: $FALSE
fix: |
true
message: The TokenValidationParameters.$LIFETIME is set to $FALSE, this means the
JWT tokens lifetime is not validated. This can lead to an JWT token being used
after it has expired, which has security implications. It is recommended to validate
the JWT lifetime to ensure only valid tokens are used.
metadata:
category: security
technology:
- csharp
owasp:
- A02:2017 - Broken Authentication
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe:
- 'CWE-613: Insufficient Session Expiration'
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/
- https://cwe.mitre.org/data/definitions/613.html
- https://docs.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationparameters?view=azure-dotnet
subcategory:
- audit
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation
shortlink: https://sg.run/KA0d
semgrep.dev:
rule:
r_id: 28955
rv_id: 1262628
rule_id: bwU5kK
version_id: w8TRolJ
url: https://semgrep.dev/playground/r/w8TRolJ/csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation
origin: community
languages:
- csharp
severity: WARNING
- id: python.django.security.injection.command.subprocess-injection.subprocess-injection
languages:
- python
mode: taint
options:
symbolic_propagation: true
pattern-sources:
- patterns:
- pattern-inside: |
def $FUNC(..., $REQUEST, ...):
...
- focus-metavariable: $REQUEST
- metavariable-pattern:
metavariable: $REQUEST
patterns:
- pattern: request
- pattern-not-inside: request.build_absolute_uri
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: subprocess.$FUNC(...)
- pattern-not: subprocess.$FUNC("...", ...)
- pattern-not: subprocess.$FUNC(["...", ...], ...)
- pattern-not-inside: |
$CMD = ["...", ...]
...
subprocess.$FUNC($CMD, ...)
- patterns:
- pattern: subprocess.$FUNC(["$SHELL", "-c", ...], ...)
- metavariable-regex:
metavariable: $SHELL
regex: ^(sh|bash|ksh|csh|tcsh|zsh)$
- patterns:
- pattern: subprocess.$FUNC(["$INTERPRETER", ...], ...)
- metavariable-regex:
metavariable: $INTERPRETER
regex: ^(python|python\d)$
pattern-sanitizers:
- patterns:
- pattern: $DICT[$KEY]
- focus-metavariable: $KEY
severity: ERROR
message: Detected user input entering a `subprocess` call unsafely. This could result
in a command injection vulnerability. An attacker could use this vulnerability
to execute arbitrary commands on the host, which allows them to download malware,
scan sensitive data, or run any command they wish on the server. Do not let users
choose the command to run. In general, prefer to use Python API versions of system
commands. If you must use subprocess, use a dictionary to allowlist a set of commands.
metadata:
category: security
technology:
- flask
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
references:
- https://semgrep.dev/docs/cheat-sheets/python-command-injection/
confidence: HIGH
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection
shortlink: https://sg.run/49BE
semgrep.dev:
rule:
r_id: 31144
rv_id: 1263388
rule_id: EwUepx
version_id: 7ZTE3qK
url: https://semgrep.dev/playground/r/7ZTE3qK/python.django.security.injection.command.subprocess-injection.subprocess-injection
origin: community
- id: python.flask.security.injection.subprocess-injection.subprocess-injection
languages:
- python
mode: taint
options:
symbolic_propagation: true
pattern-sources:
- pattern-either:
- patterns:
- pattern-either:
- pattern: flask.request.form.get(...)
- pattern: flask.request.form[...]
- pattern: flask.request.args.get(...)
- pattern: flask.request.args[...]
- pattern: flask.request.values.get(...)
- pattern: flask.request.values[...]
- pattern: flask.request.cookies.get(...)
- pattern: flask.request.cookies[...]
- pattern: flask.request.stream
- pattern: flask.request.headers.get(...)
- pattern: flask.request.headers[...]
- pattern: flask.request.data
- pattern: flask.request.full_path
- pattern: flask.request.url
- pattern: flask.request.json
- pattern: flask.request.get_json()
- pattern: flask.request.view_args.get(...)
- pattern: flask.request.view_args[...]
- patterns:
- pattern-inside: |
@$APP.route($ROUTE, ...)
def $FUNC(..., $ROUTEVAR, ...):
...
- focus-metavariable: $ROUTEVAR
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: subprocess.$FUNC(...)
- pattern-not: subprocess.$FUNC("...", ...)
- pattern-not: subprocess.$FUNC(["...", ...], ...)
- pattern-not-inside: |
$CMD = ["...", ...]
...
subprocess.$FUNC($CMD, ...)
- patterns:
- pattern: subprocess.$FUNC(["$SHELL", "-c", ...], ...)
- metavariable-regex:
metavariable: $SHELL
regex: ^(sh|bash|ksh|csh|tcsh|zsh)$
- patterns:
- pattern: subprocess.$FUNC(["$INTERPRETER", ...], ...)
- metavariable-regex:
metavariable: $INTERPRETER
regex: ^(python|python\d)$
pattern-sanitizers:
- patterns:
- pattern: $DICT[$KEY]
- focus-metavariable: $KEY
severity: ERROR
message: Detected user input entering a `subprocess` call unsafely. This could result
in a command injection vulnerability. An attacker could use this vulnerability
to execute arbitrary commands on the host, which allows them to download malware,
scan sensitive data, or run any command they wish on the server. Do not let users
choose the command to run. In general, prefer to use Python API versions of system
commands. If you must use subprocess, use a dictionary to allowlist a set of commands.
metadata:
category: security
technology:
- flask
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
references:
- https://semgrep.dev/docs/cheat-sheets/python-command-injection/
confidence: HIGH
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection
shortlink: https://sg.run/5gW3
semgrep.dev:
rule:
r_id: 31147
rv_id: 1263433
rule_id: 8GU3qp
version_id: bZT53gQ
url: https://semgrep.dev/playground/r/bZT53gQ/python.flask.security.injection.subprocess-injection.subprocess-injection
origin: community
- id: yaml.github-actions.security.github-script-injection.github-script-injection
languages:
- yaml
message: 'Using variable interpolation `${{...}}` with `github` context data in
a `actions/github-script`''s `script:` step could allow an attacker to inject
their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted.
Instead, use an intermediate environment variable with `env:` to store the data
and use the environment variable in the `run:` script. Be sure to use double-quotes
the environment variable, like this: "$ENVVAR".'
metadata:
category: security
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
- https://securitylab.github.com/research/github-actions-untrusted-input/
- https://github.com/actions/github-script
technology:
- github-actions
cwe2022-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/yaml.github-actions.security.github-script-injection.github-script-injection
shortlink: https://sg.run/g1G0
semgrep.dev:
rule:
r_id: 31441
rv_id: 1423394
rule_id: OrUQvK
version_id: 5PT7Zyw
url: https://semgrep.dev/playground/r/5PT7Zyw/yaml.github-actions.security.github-script-injection.github-script-injection
origin: community
patterns:
- pattern-inside: 'steps: [...]'
- pattern-inside: |
uses: $ACTION
...
- pattern-inside: |
with:
...
script: ...
...
- pattern: 'script: $SHELL'
- metavariable-regex:
metavariable: $ACTION
regex: actions/github-script@.*
- metavariable-pattern:
language: generic
metavariable: $SHELL
patterns:
- pattern-either:
- pattern: ${{ ... github.event.issue.title ... }}
- pattern: ${{ ... github.event.issue.body ... }}
- pattern: ${{ ... github.event.pull_request.title ... }}
- pattern: ${{ ... github.event.pull_request.body ... }}
- pattern: ${{ ... github.event.comment.body ... }}
- pattern: ${{ ... github.event.review.body ... }}
- pattern: ${{ ... github.event.review_comment.body ... }}
- pattern: ${{ ... github.event.pages ... .page_name ... }}
- pattern: ${{ ... github.event.head_commit.message ... }}
- pattern: ${{ ... github.event.head_commit.author.email ... }}
- pattern: ${{ ... github.event.head_commit.author.name ... }}
- pattern: ${{ ... github.event.commits ... .author.email ... }}
- pattern: ${{ ... github.event.commits ... .author.name ... }}
- pattern: ${{ ... github.event.commits ... .message ... }}
- pattern: ${{ ... github.event.pull_request.head.ref ... }}
- pattern: ${{ ... github.event.pull_request.head.label ... }}
- pattern: ${{ ... github.event.pull_request.head.repo.default_branch ...
}}
- pattern: ${{ ... github.ref ... }}
- pattern: ${{ ... github.base_ref ... }}
- pattern: ${{ ... github.head_ref ... }}
- pattern: ${{ ... github.ref_name ... }}
- pattern: ${{ ... github.workflow ... }}
- pattern: ${{ ... github.event.inputs ... }}
- pattern: ${{ ... github.event.discussion.title ... }}
- pattern: ${{ ... github.event.discussion.body ... }}
- pattern: ${{ ... github.event.workflow_run.head_branch ... }}
- pattern: ${{ ... github.event.workflow_run.head_commit.message ... }}
- pattern: ${{ ... github.event.milestone.title ... }}
- pattern: ${{ ... github.event.milestone.description ... }}
- pattern: ${{ ... github.event.project_card.note ... }}
- pattern: ${{ ... github.event.project.name ... }}
- pattern: ${{ ... github.event.project_column.name ... }}
- pattern: ${{ ... github.event.release.name ... }}
- pattern: ${{ ... github.event.release.body ... }}
- pattern: ${{ ... github.event.deployment.ref ... }}
- pattern: ${{ ... inputs ... }}
- pattern-not: ${{ ... github.event.issue.title && ... }}
- pattern-not: ${{ ... github.event.issue.body && ... }}
- pattern-not: ${{ ... github.event.pull_request.title && ... }}
- pattern-not: ${{ ... github.event.pull_request.body && ... }}
- pattern-not: ${{ ... github.event.comment.body && ... }}
- pattern-not: ${{ ... github.event.review.body && ... }}
- pattern-not: ${{ ... github.event.review_comment.body && ... }}
- pattern-not: ${{ ... github.event.pages ... .page_name && ... }}
- pattern-not: ${{ ... github.event.head_commit.message && ... }}
- pattern-not: ${{ ... github.event.head_commit.author.email && ... }}
- pattern-not: ${{ ... github.event.head_commit.author.name && ... }}
- pattern-not: ${{ ... github.event.commits ... .author.email && ... }}
- pattern-not: ${{ ... github.event.commits ... .author.name && ... }}
- pattern-not: ${{ ... github.event.commits ... .message && ... }}
- pattern-not: ${{ ... github.event.pull_request.head.ref && ... }}
- pattern-not: ${{ ... github.event.pull_request.head.label && ... }}
- pattern-not: ${{ ... github.event.pull_request.head.repo.default_branch &&
... }}
- pattern-not: ${{ ... github.ref && ... }}
- pattern-not: ${{ ... github.base_ref && ... }}
- pattern-not: ${{ ... github.head_ref && ... }}
- pattern-not: ${{ ... github.ref_name && ... }}
- pattern-not: ${{ ... github.workflow && ... }}
- pattern-not: ${{ ... github.event.inputs && ... }}
- pattern-not: ${{ ... github.event.discussion.title && ... }}
- pattern-not: ${{ ... github.event.discussion.body && ... }}
- pattern-not: ${{ ... github.event.workflow_run.head_branch && ... }}
- pattern-not: ${{ ... github.event.workflow_run.head_commit.message && ...
}}
- pattern-not: ${{ ... github.event.milestone.title && ... }}
- pattern-not: ${{ ... github.event.milestone.description && ... }}
- pattern-not: ${{ ... github.event.project_card.note && ... }}
- pattern-not: ${{ ... github.event.project.name && ... }}
- pattern-not: ${{ ... github.event.project_column.name && ... }}
- pattern-not: ${{ ... github.event.release.name && ... }}
- pattern-not: ${{ ... github.event.release.body && ... }}
- pattern-not: ${{ ... github.event.deployment.ref && ... }}
severity: ERROR
- id: python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4
message: ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial
stream output. Its use is strongly discouraged. ARC4 does not use mode constructions.
Use a strong symmetric cipher such as EAS instead. With the `cryptography` package
it is recommended to use the `Fernet` which is a secure implementation of AES
in CBC mode with a 128-bit key. Alternatively, keep using the `Cipher` class
from the hazmat primitives but use the AES algorithm instead.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
bandit-code: B304
references:
- https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers
category: security
technology:
- cryptography
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
functional-categories:
- crypto::search::symmetric-algorithm::cryptography
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4
shortlink: https://sg.run/xoZL
semgrep.dev:
rule:
r_id: 33630
rv_id: 1263348
rule_id: KxU8gK
version_id: QkTGq3Q
url: https://semgrep.dev/playground/r/QkTGq3Q/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4
origin: community
severity: WARNING
languages:
- python
patterns:
- pattern: cryptography.hazmat.primitives.ciphers.algorithms.$ARC4($KEY)
- pattern-inside: cryptography.hazmat.primitives.ciphers.Cipher(...)
- metavariable-regex:
metavariable: $ARC4
regex: ^(ARC4)$
- focus-metavariable: $ARC4
fix: AES
- id: python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish
message: Blowfish is a block cipher developed by Bruce Schneier. It is known to
be susceptible to attacks when using weak keys. The author has recommended that
users of Blowfish move to newer algorithms such as AES. With the `cryptography`
package it is recommended to use `Fernet` which is a secure implementation of
AES in CBC mode with a 128-bit key. Alternatively, keep using the `Cipher` class
from the hazmat primitives but use the AES algorithm instead.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
bandit-code: B304
references:
- https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers
- https://tools.ietf.org/html/rfc5469
category: security
technology:
- cryptography
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
functional-categories:
- crypto::search::symmetric-algorithm::cryptography
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish
shortlink: https://sg.run/OdzL
semgrep.dev:
rule:
r_id: 33631
rv_id: 1263349
rule_id: qNULvO
version_id: 3ZT4XK7
url: https://semgrep.dev/playground/r/3ZT4XK7/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish
origin: community
severity: WARNING
languages:
- python
patterns:
- pattern: cryptography.hazmat.primitives.ciphers.algorithms.$BLOWFISH($KEY)
- metavariable-regex:
metavariable: $BLOWFISH
regex: ^(Blowfish)$
- focus-metavariable: $BLOWFISH
fix: AES
- id: python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5
message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision
resistant and is therefore not suitable as a cryptographic signature. Use SHA256
or SHA3 instead.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
bandit-code: B303
references:
- https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#md5
- https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html
- https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability
- http://2012.sharcs.org/slides/stevens.pdf
- https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
category: security
technology:
- cryptography
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
functional-categories:
- crypto::search::symmetric-algorithm::cryptography
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5
shortlink: https://sg.run/eY88
semgrep.dev:
rule:
r_id: 33632
rv_id: 1263352
rule_id: lBUopp
version_id: JdTzxww
url: https://semgrep.dev/playground/r/JdTzxww/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5
origin: community
severity: WARNING
languages:
- python
patterns:
- pattern: cryptography.hazmat.primitives.hashes.$MD5()
- metavariable-regex:
metavariable: $MD5
regex: ^(MD5)$
- focus-metavariable: $MD5
fix: SHA256
- id: python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish
message: Detected Blowfish cipher algorithm which is considered insecure. This algorithm
is not cryptographically secure and can be reversed easily. Use secure stream
ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES
with a block size of 128 bits. When using a block cipher, use a modern mode of
operation that also provides authentication, such as GCM.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
bandit-code: B304
references:
- https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption
- https://www.pycryptodome.org/src/cipher/cipher
category: security
technology:
- pycryptodome
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
functional-categories:
- crypto::search::symmetric-algorithm::pycryptodome
- crypto::search::symmetric-algorithm::pycryptodomex
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish
shortlink: https://sg.run/dlOE
semgrep.dev:
rule:
r_id: 33634
rv_id: 1263545
rule_id: JDUGnK
version_id: ExTExln
url: https://semgrep.dev/playground/r/ExTExln/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish
origin: community
options:
symbolic_propagation: true
severity: WARNING
languages:
- python
pattern-either:
- pattern: Cryptodome.Cipher.Blowfish.new(...)
- pattern: Crypto.Cipher.Blowfish.new(...)
- id: python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des
message: Detected DES cipher or Triple DES algorithm which is considered insecure.
This algorithm is not cryptographically secure and can be reversed easily. Use
a secure symmetric cipher from the cryptodome package instead. Use secure stream
ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES
with a block size of 128 bits. When using a block cipher, use a modern mode of
operation that also provides authentication, such as GCM.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
bandit-code: B304
references:
- https://cwe.mitre.org/data/definitions/326.html
- https://www.pycryptodome.org/src/cipher/cipher
category: security
technology:
- pycryptodome
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
functional-categories:
- crypto::search::symmetric-algorithm::pycryptodome
- crypto::search::symmetric-algorithm::pycryptodomex
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des
shortlink: https://sg.run/Z5bw
semgrep.dev:
rule:
r_id: 33635
rv_id: 1263546
rule_id: 5rUr73
version_id: 7ZTE3G7
url: https://semgrep.dev/playground/r/7ZTE3G7/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des
origin: community
options:
symbolic_propagation: true
severity: WARNING
languages:
- python
pattern-either:
- pattern: Cryptodome.Cipher.DES.new(...)
- pattern: Crypto.Cipher.DES.new(...)
- pattern: Cryptodome.Cipher.DES3.new(...)
- pattern: Crypto.Cipher.DES3.new(...)
- id: python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2
message: Detected RC2 cipher algorithm which is considered insecure. This algorithm
is not cryptographically secure and can be reversed easily. Use secure stream
ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES
with a block size of 128 bits. When using a block cipher, use a modern mode of
operation that also provides authentication, such as GCM.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
bandit-code: B304
references:
- https://cwe.mitre.org/data/definitions/326.html
- https://www.pycryptodome.org/src/cipher/cipher
category: security
technology:
- pycryptodome
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
functional-categories:
- crypto::search::symmetric-algorithm::pycryptodome
- crypto::search::symmetric-algorithm::pycryptodomex
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2
shortlink: https://sg.run/nAbY
semgrep.dev:
rule:
r_id: 33636
rv_id: 1263547
rule_id: GdUYlW
version_id: LjTkgn6
url: https://semgrep.dev/playground/r/LjTkgn6/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2
origin: community
options:
symbolic_propagation: true
severity: WARNING
languages:
- python
pattern-either:
- pattern: Cryptodome.Cipher.ARC2.new(...)
- pattern: Crypto.Cipher.ARC2.new(...)
- id: python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4
message: Detected ARC4 cipher algorithm which is considered insecure. This algorithm
is not cryptographically secure and can be reversed easily. Use secure stream
ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES
with a block size of 128 bits. When using a block cipher, use a modern mode of
operation that also provides authentication, such as GCM.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
bandit-code: B304
references:
- https://cwe.mitre.org/data/definitions/326.html
- https://www.pycryptodome.org/src/cipher/cipher
category: security
technology:
- pycryptodome
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
functional-categories:
- crypto::search::symmetric-algorithm::pycryptodome
- crypto::search::symmetric-algorithm::pycryptodomex
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4
shortlink: https://sg.run/Eo6N
semgrep.dev:
rule:
r_id: 33637
rv_id: 1263548
rule_id: ReUnEB
version_id: 8KT5rXY
url: https://semgrep.dev/playground/r/8KT5rXY/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4
origin: community
severity: WARNING
languages:
- python
pattern-either:
- pattern: Cryptodome.Cipher.ARC4.new(...)
- pattern: Crypto.Cipher.ARC4.new(...)
- id: python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2
message: Detected MD2 hash algorithm which is considered insecure. MD2 is not collision
resistant and is therefore not suitable as a cryptographic signature. Use a modern
hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms
- https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html
- https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability
- http://2012.sharcs.org/slides/stevens.pdf
- https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
category: security
technology:
- pycryptodome
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
functional-categories:
- crypto::search::hash-algorithm::pycryptodome
- crypto::search::hash-algorithm::pycryptodomex
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2
shortlink: https://sg.run/7JP2
semgrep.dev:
rule:
r_id: 33638
rv_id: 1263550
rule_id: AbU0Ex
version_id: QkTGqD8
url: https://semgrep.dev/playground/r/QkTGqD8/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2
origin: community
options:
symbolic_propagation: true
severity: WARNING
languages:
- python
pattern-either:
- pattern: Crypto.Hash.MD2.new(...)
- pattern: Cryptodome.Hash.MD2.new (...)
- id: python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4
message: Detected MD4 hash algorithm which is considered insecure. MD4 is not collision
resistant and is therefore not suitable as a cryptographic signature. Use a modern
hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms
- https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html
- https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability
- http://2012.sharcs.org/slides/stevens.pdf
- https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
category: security
technology:
- pycryptodome
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
functional-categories:
- crypto::search::hash-algorithm::pycryptodome
- crypto::search::hash-algorithm::pycryptodomex
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4
shortlink: https://sg.run/Lve6
semgrep.dev:
rule:
r_id: 33639
rv_id: 1263551
rule_id: BYUJy4
version_id: 3ZT4Xnp
url: https://semgrep.dev/playground/r/3ZT4Xnp/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4
origin: community
options:
symbolic_propagation: true
severity: WARNING
languages:
- python
pattern-either:
- pattern: Crypto.Hash.MD4.new(...)
- pattern: Cryptodome.Hash.MD4.new (...)
- id: python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5
message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision
resistant and is therefore not suitable as a cryptographic signature. Use a modern
hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.
metadata:
source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms
- https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html
- https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability
- http://2012.sharcs.org/slides/stevens.pdf
- https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
category: security
technology:
- pycryptodome
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
functional-categories:
- crypto::search::hash-algorithm::pycryptodome
- crypto::search::hash-algorithm::pycryptodomex
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5
shortlink: https://sg.run/85JN
semgrep.dev:
rule:
r_id: 33640
rv_id: 1263552
rule_id: DbUXwo
version_id: 44TEjpk
url: https://semgrep.dev/playground/r/44TEjpk/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5
origin: community
options:
symbolic_propagation: true
severity: WARNING
languages:
- python
pattern-either:
- pattern: Crypto.Hash.MD5.new(...)
- pattern: Cryptodome.Hash.MD5.new (...)
- id: yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout
languages:
- yaml
message: This GitHub Actions workflow file uses `workflow_run` and checks out code
from the incoming pull request. When using `workflow_run`, the Action runs in
the context of the target repository, which includes access to all repository
secrets. Normally, this is safe because the Action only runs code from the target
repository, not the incoming PR. However, by checking out the incoming PR code,
you're now using the incoming code for the rest of the action. You may be inadvertently
executing arbitrary code from the incoming PR with access to repository secrets,
which would let an attacker steal repository secrets. This normally happens by
running build scripts (e.g., `npm build` and `make`) or dependency installation
scripts (e.g., `python setup.py install`). Audit your workflow file to make sure
no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
for additional mitigations.
metadata:
category: security
owasp: A01:2017 - Injection
cwe: 'CWE-913: Improper Control of Dynamically-Managed Code Resources'
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
subcategory:
- vuln
references:
- https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
- https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md
- https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability
technology:
- github-actions
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout
shortlink: https://sg.run/A0p6
semgrep.dev:
rule:
r_id: 35494
rv_id: 947046
rule_id: 4bU8E4
version_id: kbTYRwl
url: https://semgrep.dev/playground/r/kbTYRwl/yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout
origin: community
patterns:
- pattern-inside: |
on:
...
workflow_run: ...
...
...
- pattern-inside: |
jobs:
...
$JOBNAME:
...
steps:
...
- pattern: |
...
uses: "$ACTION"
with:
...
ref: $EXPR
- metavariable-regex:
metavariable: $ACTION
regex: actions/checkout@.*
- metavariable-pattern:
language: generic
metavariable: $EXPR
patterns:
- pattern: ${{ github.event.workflow_run ... }}
severity: WARNING
- id: csharp.dotnet.security.use_ecb_mode.use_ecb_mode
message: Usage of the insecure ECB mode detected. You should use an authenticated
encryption mode instead, which is implemented by the classes AesGcm or ChaCha20Poly1305.
severity: WARNING
metadata:
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
category: security
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.chacha20poly1305?view=net-6.0
- https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0
- https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.ciphermode?view=net-6.0
- https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes
subcategory:
- vuln
technology:
- .net
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/csharp.dotnet.security.use_ecb_mode.use_ecb_mode
shortlink: https://sg.run/wj9n
semgrep.dev:
rule:
r_id: 36773
rv_id: 1262623
rule_id: 0oUqWP
version_id: yeTxpPw
url: https://semgrep.dev/playground/r/yeTxpPw/csharp.dotnet.security.use_ecb_mode.use_ecb_mode
origin: community
languages:
- csharp
patterns:
- pattern-either:
- pattern: ($KEYTYPE $KEY).EncryptEcb(...);
- pattern: ($KEYTYPE $KEY).DecryptEcb(...);
- pattern: ($KEYTYPE $KEY).Mode = CipherMode.ECB;
- metavariable-pattern:
metavariable: $KEYTYPE
pattern-either:
- pattern: SymmetricAlgorithm
- pattern: Aes
- pattern: Rijndael
- pattern: DES
- pattern: TripleDES
- pattern: RC2
- id: csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration
message: You are using an insecure random number generator (RNG) to create a cryptographic
key. System.Random must never be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator
instead.
severity: ERROR
metadata:
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
category: security
cwe:
- 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)'
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://learn.microsoft.com/en-us/dotnet/api/system.random?view=net-6.0#remarks
- https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator?view=net-6.0
- https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0#constructors
- https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.symmetricalgorithm.key?view=net-6.0#system-security-cryptography-symmetricalgorithm-key
subcategory:
- vuln
technology:
- .net
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration
shortlink: https://sg.run/xjrA
semgrep.dev:
rule:
r_id: 36774
rv_id: 1262624
rule_id: KxU3Nq
version_id: rxTAK2O
url: https://semgrep.dev/playground/r/rxTAK2O/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration
origin: community
languages:
- csharp
mode: taint
pattern-sources:
- patterns:
- pattern-inside: (System.Random $RNG).NextBytes($KEY); ...
- pattern: $KEY
pattern-sinks:
- pattern-either:
- patterns:
- pattern: ($KEYTYPE $CIPHER).Key = $SINK;
- focus-metavariable: $SINK
- metavariable-pattern:
metavariable: $KEYTYPE
pattern-either:
- pattern: SymmetricAlgorithm
- pattern: Aes
- pattern: Rijndael
- pattern: DES
- pattern: TripleDES
- pattern: RC2
- pattern: new AesGcm(...)
- pattern: new AesCcm(...)
- pattern: new ChaCha20Poly1305(...)
- id: html.security.plaintext-http-link.plaintext-http-link
metadata:
category: security
technology:
- html
cwe:
- 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
confidence: HIGH
subcategory:
- vuln
references:
- https://cwe.mitre.org/data/definitions/319.html
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/html.security.plaintext-http-link.plaintext-http-link
shortlink: https://sg.run/RA5q
semgrep.dev:
rule:
r_id: 39193
rv_id: 1262976
rule_id: AbUnNo
version_id: xyTjzRL
url: https://semgrep.dev/playground/r/xyTjzRL/html.security.plaintext-http-link.plaintext-http-link
origin: community
patterns:
- pattern: <a href="$URL">...</a>
- metavariable-regex:
metavariable: $URL
regex: ^(?i)http://
message: This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL
if possible.
severity: WARNING
languages:
- html
- id: java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils
message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision
resistant and is therefore not suitable as a cryptographic signature. Use HMAC
instead.
languages:
- java
severity: WARNING
metadata:
functional-categories:
- crypto::search::hash-algorithm::org.apache.commons
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-328: Use of Weak Hash'
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_MD5
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils
shortlink: https://sg.run/AWL2
semgrep.dev:
rule:
r_id: 39194
rv_id: 1263012
rule_id: BYUGK0
version_id: WrTqK7K
url: https://semgrep.dev/playground/r/WrTqK7K/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils
origin: community
patterns:
- pattern: |
$DU.$GET_ALGO().digest(...)
- metavariable-pattern:
metavariable: $GET_ALGO
pattern: getMd5Digest
- metavariable-pattern:
metavariable: $DU
pattern: DigestUtils
- focus-metavariable: $GET_ALGO
fix: |
getSha512Digest
- id: rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid
message: Dangerously accepting invalid TLS information
pattern-either:
- pattern: reqwest::Client::builder(). ... .danger_accept_invalid_hostnames(true)
- pattern: reqwest::Client::builder(). ... .danger_accept_invalid_certs(true)
metadata:
references:
- https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_hostnames
- https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_certs
technology:
- reqwest
category: security
cwe: 'CWE-295: Improper Certificate Validation'
confidence: HIGH
likelihood: LOW
impact: MEDIUM
subcategory: vuln
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid
shortlink: https://sg.run/DqrG
semgrep.dev:
rule:
r_id: 40108
rv_id: 946551
rule_id: qNUKDg
version_id: 7ZTrQLJ
url: https://semgrep.dev/playground/r/7ZTrQLJ/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid
origin: community
languages:
- rust
severity: WARNING
- id: rust.lang.security.rustls-dangerous.rustls-dangerous
message: Dangerous client config used, ensure SSL verification
pattern-either:
- pattern: rustls::client::DangerousClientConfig
- pattern: $CLIENT.dangerous().set_certificate_verifier(...)
- pattern: |
let $CLIENT = rustls::client::ClientConfig::dangerous(...);
...
$CLIENT.set_certificate_verifier(...);
metadata:
references:
- https://docs.rs/rustls/latest/rustls/client/struct.DangerousClientConfig.html
- https://docs.rs/rustls/latest/rustls/client/struct.ClientConfig.html#method.dangerous
technology:
- rustls
category: security
cwe: 'CWE-295: Improper Certificate Validation'
confidence: HIGH
likelihood: LOW
impact: MEDIUM
subcategory: vuln
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/rust.lang.security.rustls-dangerous.rustls-dangerous
shortlink: https://sg.run/01Rw
semgrep.dev:
rule:
r_id: 40110
rv_id: 946553
rule_id: YGU8LK
version_id: 8KTKjdO
url: https://semgrep.dev/playground/r/8KTKjdO/rust.lang.security.rustls-dangerous.rustls-dangerous
origin: community
languages:
- rust
severity: WARNING
- id: rust.lang.security.ssl-verify-none.ssl-verify-none
message: SSL verification disabled, this allows for MitM attacks
pattern: $BUILDER.set_verify(openssl::ssl::SSL_VERIFY_NONE)
metadata:
references:
- https://docs.rs/openssl/latest/openssl/ssl/struct.SslContextBuilder.html#method.set_verify
technology:
- openssl
category: security
cwe: 'CWE-295: Improper Certificate Validation'
confidence: HIGH
likelihood: LOW
impact: MEDIUM
subcategory: vuln
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/rust.lang.security.ssl-verify-none.ssl-verify-none
shortlink: https://sg.run/K2Pn
semgrep.dev:
rule:
r_id: 40111
rv_id: 946554
rule_id: 6JU0Bl
version_id: gETe1bo
url: https://semgrep.dev/playground/r/gETe1bo/rust.lang.security.ssl-verify-none.ssl-verify-none
origin: community
languages:
- rust
severity: WARNING
- id: yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection
message: Using input or workflow parameters in here-scripts can lead to command
injection or code injection. Convert the parameters to env variables instead.
languages:
- yaml
metadata:
category: security
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- "A03:2021 \u2013 Injection"
confidence: MEDIUM
likelihood: MEDIUM
impact: HIGH
subcategory:
- vuln
references:
- https://github.com/argoproj/argo-workflows/issues/5061
- https://github.com/argoproj/argo-workflows/issues/5114#issue-808865370
technology:
- ci
- argo
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
- Command Injection
source: https://semgrep.dev/r/yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection
shortlink: https://sg.run/yqeZ
semgrep.dev:
rule:
r_id: 40768
rv_id: 1151472
rule_id: 10U0zW
version_id: xyTp17z
url: https://semgrep.dev/playground/r/xyTp17z/yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection
origin: community
severity: ERROR
patterns:
- pattern-inside: |
apiVersion: $VERSION
...
- metavariable-regex:
metavariable: $VERSION
regex: (argoproj.io.*)
- pattern-either:
- patterns:
- pattern-inside: |
command:
...
- $LANG
...
...
source:
$SCRIPT
- metavariable-regex:
metavariable: $LANG
regex: .*(sh|bash|ksh|csh|tcsh|zsh|python|python3|node|perl|ruby|php|lua|awk|sed|powershell|fish|dash|R|grooby|scala|clj|elixir|coffee|dart|haskell|ocaml).*
- metavariable-pattern:
metavariable: $SCRIPT
pattern-either:
- pattern-regex: (.*{{.*inputs.parameters.*}}.*)
- pattern-regex: (.*{{.*workflow.parameters.*}}.*)
- focus-metavariable: $SCRIPT
- patterns:
- pattern-either:
- pattern-inside: |
container:
...
command: $LANG
...
args: $PARAM
- pattern-inside: |
containerSet:
...
containers:
- ...
command: $LANG
...
args: $PARAM
- metavariable-regex:
metavariable: $LANG
regex: .*(sh|bash|ksh|csh|tcsh|zsh|python|python3|node|perl|ruby|php|lua|awk|sed|powershell|fish|dash|R|grooby|scala|clj|elixir|coffee|dart|haskell|ocaml).*
- metavariable-pattern:
metavariable: $PARAM
pattern-either:
- pattern-regex: (.*{{.*inputs.parameters.*}}.*)
- pattern-regex: (.*{{.*workflow.parameters.*}}.*)
- focus-metavariable: $PARAM
- id: python.cryptography.security.empty-aes-key.empty-aes-key
message: Potential empty AES encryption key. Using an empty key in AES encryption
can result in weak encryption and may allow attackers to easily decrypt sensitive
data. Ensure that a strong, non-empty key is used for AES encryption.
patterns:
- pattern: AES.new("",...)
languages:
- python
severity: WARNING
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
- 'CWE-310: Cryptographic Issues'
references:
- https://cwe.mitre.org/data/definitions/327.html
- https://cwe.mitre.org/data/definitions/310.html
category: security
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
owasp: A6:2017 misconfiguration
functional-categories:
- crypto::search::key-length::pycrypto
- crypto::search::key-length::pycryptodome
technology:
- python
- pycrypto
- pycryptodome
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.cryptography.security.empty-aes-key.empty-aes-key
shortlink: https://sg.run/zQ9G
semgrep.dev:
rule:
r_id: 44817
rv_id: 946105
rule_id: OrUADK
version_id: 8KTKjRg
url: https://semgrep.dev/playground/r/8KTKjRg/python.cryptography.security.empty-aes-key.empty-aes-key
origin: community
- id: dockerfile.security.missing-user-entrypoint.missing-user-entrypoint
patterns:
- pattern: |
ENTRYPOINT $...VARS
- pattern-not-inside: |
USER $USER
...
fix: |
USER non-root
ENTRYPOINT $...VARS
message: By not specifying a USER, a program in the container may run as 'root'.
This is a security hazard. If an attacker can control a process running as root,
they may have control over the container. Ensure that the last USER in a Dockerfile
is a USER other than 'root'.
severity: ERROR
languages:
- dockerfile
metadata:
cwe:
- 'CWE-269: Improper Privilege Management'
category: security
technology:
- dockerfile
confidence: MEDIUM
owasp:
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint
shortlink: https://sg.run/k281
semgrep.dev:
rule:
r_id: 47272
rv_id: 1262659
rule_id: ReUW9E
version_id: o5TbD21
url: https://semgrep.dev/playground/r/o5TbD21/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint
origin: community
- id: terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions
pattern-either:
- pattern: |
resource "aws_config_configuration_aggregator" $ANYTHING {
...
account_aggregation_source {
...
regions = ...
...
}
...
}
- pattern: |
resource "aws_config_configuration_aggregator" $ANYTHING {
...
organization_aggregation_source {
...
regions = ...
...
}
...
}
message: The AWS configuration aggregator does not aggregate all AWS Config region.
This may result in unmonitored configuration in regions that are thought to be
unused. Configure the aggregator with all_regions for the source.
languages:
- hcl
severity: WARNING
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A09:2021 - Security Logging and Monitoring Failures
- A09:2025 - Security Logging & Alerting Failures
cwe:
- 'CWE-778: Insufficient Logging'
references:
- https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insufficient Logging
source: https://semgrep.dev/r/terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions
shortlink: https://sg.run/O6A7
semgrep.dev:
rule:
r_id: 47275
rv_id: 1263703
rule_id: DbUo7v
version_id: A8Tgdwv
url: https://semgrep.dev/playground/r/A8Tgdwv/terraform.aws.security.aws-config-aggregator-not-all-regions.aws-config-aggregator-not-all-regions
origin: community
- id: yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext
patterns:
- pattern-inside: |
containers:
...
- pattern-inside: |
- $NAME: $CONTAINER
...
- pattern: |
image: ...
...
- pattern-not: |
image: ...
...
securityContext:
...
- metavariable-regex:
metavariable: $NAME
regex: name
- focus-metavariable: $NAME
fix: |
securityContext:
allowPrivilegeEscalation: false
$NAME
message: In Kubernetes, each pod runs in its own isolated environment with its own
set of security policies. However, certain container images may contain `setuid`
or `setgid` binaries that could allow an attacker to perform privilege escalation
and gain access to sensitive resources. To mitigate this risk, it's recommended
to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation`
set to `false`. This will prevent the container from running any privileged processes
and limit the impact of any potential attacks. By adding a `securityContext` to
your Kubernetes pod, you can help to ensure that your containerized applications
are more secure and less vulnerable to privilege escalation attacks.
metadata:
cwe:
- 'CWE-732: Incorrect Permission Assignment for Critical Resource'
owasp:
- A05:2021 - Security Misconfiguration
- A06:2017 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
references:
- https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation
- https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
- https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt
- https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag
category: security
technology:
- kubernetes
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext
shortlink: https://sg.run/eleR
semgrep.dev:
rule:
r_id: 47276
rv_id: 1263931
rule_id: WAU5J6
version_id: 2KTv2j8
url: https://semgrep.dev/playground/r/2KTv2j8/yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext
origin: community
languages:
- yaml
severity: WARNING
- id: yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true
patterns:
- pattern-inside: |
containers:
...
- pattern-inside: |
- name: $CONTAINER
...
- pattern-inside: |
image: ...
...
- pattern-inside: |
securityContext:
...
- pattern: |
allowPrivilegeEscalation: $TRUE
- metavariable-pattern:
metavariable: $TRUE
pattern: |
true
- focus-metavariable: $TRUE
fix: |
false
message: In Kubernetes, each pod runs in its own isolated environment with its own set
of security policies. However, certain container images may contain `setuid`
or `setgid` binaries that could allow an attacker to perform privilege escalation
and gain access to sensitive resources. To mitigate this risk, it's recommended
to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation`
set to `false`. This will prevent the container from running any privileged processes
and limit the impact of any potential attacks. In the container `$CONTAINER`
this parameter is set to `true` which makes this container much more vulnerable
to privelege escalation attacks.
metadata:
cwe:
- 'CWE-732: Incorrect Permission Assignment for Critical Resource'
owasp:
- A05:2021 - Security Misconfiguration
- A06:2017 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
references:
- https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation
- https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
- https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt
- https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag
category: security
technology:
- kubernetes
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true
shortlink: https://sg.run/vw3W
semgrep.dev:
rule:
r_id: 47277
rv_id: 1263932
rule_id: 0oUkqQ
version_id: X0Tzyqr
url: https://semgrep.dev/playground/r/X0Tzyqr/yaml.kubernetes.security.allow-privilege-escalation-true.allow-privilege-escalation-true
origin: community
languages:
- yaml
severity: WARNING
- id: terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled
patterns:
- pattern: |
resource "aws_docdb_cluster" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_docdb_cluster" $ANYTHING {
...
enabled_cloudwatch_logs_exports = [..., "audit", ...]
...
}
message: Auditing is not enabled for DocumentDB. To ensure that you are able to
accurately audit the usage of your DocumentDB cluster, you should enable auditing
and export logs to CloudWatch.
languages:
- hcl
severity: INFO
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A09:2021 - Security Logging and Monitoring Failures
- A09:2025 - Security Logging & Alerting Failures
cwe:
- 'CWE-778: Insufficient Logging'
references:
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_cluster#enabled_cloudwatch_logs_exports
- https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insufficient Logging
source: https://semgrep.dev/r/terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled
shortlink: https://sg.run/xJYP
semgrep.dev:
rule:
r_id: 48630
rv_id: 1263705
rule_id: AbU1WN
version_id: DkTRbA4
url: https://semgrep.dev/playground/r/DkTRbA4/terraform.aws.security.aws-documentdb-auditing-disabled.aws-documentdb-auditing-disabled
origin: community
- id: terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags
patterns:
- pattern: |
resource "aws_ecr_repository" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_ecr_repository" $ANYTHING {
...
image_tag_mutability = "IMMUTABLE"
...
}
message: The ECR repository allows tag mutability. Image tags could be overwritten
with compromised images. ECR images should be set to IMMUTABLE to prevent code
injection through image mutation. This can be done by setting `image_tag_mutability`
to IMMUTABLE.
languages:
- hcl
severity: WARNING
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-345: Insufficient Verification of Data Authenticity'
references:
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository#image_tag_mutability
- https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags
shortlink: https://sg.run/ZEeL
semgrep.dev:
rule:
r_id: 48635
rv_id: 1263716
rule_id: KxUB4o
version_id: A8Tgdwd
url: https://semgrep.dev/playground/r/A8Tgdwd/terraform.aws.security.aws-ecr-mutable-image-tags.aws-ecr-mutable-image-tags
origin: community
- id: terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal
patterns:
- pattern-inside: |
resource "aws_ecr_repository_policy" $ANYTHING {
...
}
- pattern-either:
- patterns:
- pattern: policy = "$JSONPOLICY"
- metavariable-pattern:
metavariable: $JSONPOLICY
language: json
patterns:
- pattern-not-inside: |
{..., "Effect": "Deny", ...}
- pattern-either:
- pattern: |
{..., "Principal": "*", ...}
- pattern: |
{..., "Principal": [..., "*", ...], ...}
- pattern: |
{..., "Principal": { "AWS": "*" }, ...}
- pattern: |
{..., "Principal": { "AWS": [..., "*", ...] }, ...}
- patterns:
- pattern-inside: policy = jsonencode(...)
- pattern-not-inside: |
{..., Effect = "Deny", ...}
- pattern-either:
- pattern: |
{..., Principal = "*", ...}
- pattern: |
{..., Principal = [..., "*", ...], ...}
- pattern: |
{..., Principal = { AWS = "*" }, ...}
- pattern: |
{..., Principal = { AWS = [..., "*", ...] }, ...}
message: Detected wildcard access granted in your ECR repository policy principal.
This grants access to all users, including anonymous users (public access). Instead,
limit principals, actions and resources to what you need according to least privilege.
metadata:
category: security
technology:
- aws
- terraform
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe:
- 'CWE-732: Incorrect Permission Assignment for Critical Resource'
references:
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository_policy
- https://docs.aws.amazon.com/lambda/latest/operatorguide/wildcard-permissions-iam.html
- https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/monitor-amazon-ecr-repositories-for-wildcard-permissions-using-aws-cloudformation-and-aws-config.html
- https://cwe.mitre.org/data/definitions/732.html
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal
shortlink: https://sg.run/nzqb
semgrep.dev:
rule:
r_id: 48636
rv_id: 1263717
rule_id: qNUzov
version_id: BjTkZ6A
url: https://semgrep.dev/playground/r/BjTkZ6A/terraform.aws.security.aws-ecr-repository-wildcard-principal.aws-ecr-repository-wildcard-principal
origin: community
languages:
- hcl
severity: WARNING
- id: java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb
pattern: $CIPHER.getInstance("=~/AES/ECB.*/")
metadata:
functional-categories:
- crypto::search::mode::javax.crypto
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
- https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb
shortlink: https://sg.run/dB2Y
semgrep.dev:
rule:
r_id: 48734
rv_id: 1263009
rule_id: WAU2yA
version_id: A8TgdEo
url: https://semgrep.dev/playground/r/A8TgdEo/java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb
origin: community
message: 'Use of AES with ECB mode detected. ECB doesn''t provide message confidentiality
and is not semantically secure so should not be used. Instead, use a strong,
secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions
for more information.'
severity: WARNING
languages:
- java
- id: java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish
pattern: $CIPHER.getInstance("Blowfish")
metadata:
functional-categories:
- crypto::search::symmetric-algorithm::javax.crypto
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
- https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish
shortlink: https://sg.run/ZE4n
semgrep.dev:
rule:
r_id: 48735
rv_id: 1263010
rule_id: 0oUR28
version_id: BjTkZy0
url: https://semgrep.dev/playground/r/BjTkZy0/java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish
origin: community
message: 'Use of Blowfish was detected. Blowfish uses a 64-bit block size that makes
it vulnerable to birthday attacks, and is therefore considered non-compliant. Instead,
use a strong, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions
for more information.'
severity: WARNING
languages:
- java
- id: java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes
pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
import javax;
...
- pattern-either:
- pattern: javax.crypto.Cipher.getInstance("AES")
- pattern: (javax.crypto.Cipher $CIPHER).getInstance("AES")
- patterns:
- pattern-either:
- pattern-inside: |
import javax.*;
...
- pattern-inside: |
import javax.crypto;
...
- pattern-either:
- pattern: crypto.Cipher.getInstance("AES")
- pattern: (crypto.Cipher $CIPHER).getInstance("AES")
- patterns:
- pattern-either:
- pattern-inside: |
import javax.crypto.*;
...
- pattern-inside: |
import javax.crypto.Cipher;
...
- pattern-either:
- pattern: Cipher.getInstance("AES")
- pattern: (Cipher $CIPHER).getInstance("AES")
metadata:
functional-categories:
- crypto::search::mode::javax.crypto
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
- https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes
shortlink: https://sg.run/nzKO
semgrep.dev:
rule:
r_id: 48736
rv_id: 1263011
rule_id: KxUB7Z
version_id: DkTRbwy
url: https://semgrep.dev/playground/r/DkTRbwy/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes
origin: community
message: 'Use of AES with no settings detected. By default, java.crypto.Cipher uses
ECB mode. ECB doesn''t provide message confidentiality and is not semantically
secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance("AES/CBC/PKCS7PADDING").
See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for
more information.'
severity: WARNING
languages:
- java
- id: java.lang.security.audit.crypto.use-of-rc2.use-of-rc2
pattern: $CIPHER.getInstance("RC2")
metadata:
functional-categories:
- crypto::search::symmetric-algorithm::javax.crypto
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
- https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc2.use-of-rc2
shortlink: https://sg.run/EEvA
semgrep.dev:
rule:
r_id: 48737
rv_id: 1263014
rule_id: qNUzXG
version_id: K3TKkg0
url: https://semgrep.dev/playground/r/K3TKkg0/java.lang.security.audit.crypto.use-of-rc2.use-of-rc2
origin: community
message: 'Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and
is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING").
See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for
more information.'
severity: WARNING
languages:
- java
- id: java.lang.security.audit.crypto.use-of-rc4.use-of-rc4
pattern: $CIPHER.getInstance("RC4")
metadata:
functional-categories:
- crypto::search::symmetric-algorithm::javax.crypto
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
- https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc4.use-of-rc4
shortlink: https://sg.run/7OYR
semgrep.dev:
rule:
r_id: 48738
rv_id: 1263015
rule_id: lBUw8k
version_id: qkTR7vk
url: https://semgrep.dev/playground/r/qkTR7vk/java.lang.security.audit.crypto.use-of-rc4.use-of-rc4
origin: community
message: 'Use of RC4 was detected. RC4 is vulnerable to several attacks, including
stream cipher attacks and bit flipping attacks. Instead, use a strong, secure
cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions
for more information.'
severity: WARNING
languages:
- java
- id: problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request
message: Detected an HTTP request sent via HttpGet. This could lead to sensitive
information being sent over an insecure channel. Instead, it is recommended to
send requests over HTTPS.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: A03:2017 - Sensitive Data Exposure
references:
- https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html
- https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection()
subcategory:
- vuln
technology:
- java
vulnerability: Insecure Transport
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request
shortlink: https://sg.run/QE2q
semgrep.dev:
rule:
r_id: 48942
rv_id: 946061
rule_id: 6JUOJ2
version_id: WrTEo9G
url: https://semgrep.dev/playground/r/WrTEo9G/problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request
origin: community
languages:
- java
fix-regex:
regex: '[Hh][Tt][Tt][Pp]://'
replacement: https://
count: 1
patterns:
- pattern: |
"=~/[Hh][Tt][Tt][Pp]://.*/"
- pattern-inside: |
$R = new HttpGet("=~/[Hh][Tt][Tt][Pp]://.*/");
...
$CLIENT. ... .execute($R, ...);
- id: terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted
patterns:
- pattern: |
resource "aws_ebs_volume" $ANYTHING {
...
}
- pattern-not: |
resource "aws_ebs_volume" $ANYTHING {
...
encrypted = true
...
}
message: The AWS EBS volume is unencrypted. The volume, the disk I/O and any derived
snapshots could be read if compromised. Volumes should be encrypted to ensure
sensitive data is stored securely.
languages:
- hcl
severity: WARNING
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
cwe:
- 'CWE-311: Missing Encryption of Sensitive Data'
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ebs_volume#encrypted
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html
subcategory:
- audit
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted
shortlink: https://sg.run/6ZbY
semgrep.dev:
rule:
r_id: 50759
rv_id: 1263708
rule_id: YGUKl1
version_id: K3TKk1Z
url: https://semgrep.dev/playground/r/K3TKk1Z/terraform.aws.security.aws-ebs-volume-unencrypted.aws-ebs-volume-unencrypted
origin: community
- id: terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled
patterns:
- pattern: |
resource "aws_launch_template" $ANYTHING {
...
}
- pattern-not-inside: |
resource "aws_launch_template" $ANYTHING {
...
metadata_options {
...
http_endpoint = "disabled"
...
}
...
}
- pattern-not-inside: |
resource "aws_launch_template" $ANYTHING {
...
metadata_options {
...
http_tokens = "required"
...
}
...
}
message: The EC2 launch template has Instance Metadata Service Version 1 (IMDSv1)
enabled. IMDSv2 introduced session authentication tokens which improve security
when talking to IMDS. You should either disable IMDS or require the use of IMDSv2.
languages:
- hcl
severity: WARNING
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe:
- 'CWE-1390: Weak Authentication'
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration#metadata_options
- https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled
shortlink: https://sg.run/pg9J
semgrep.dev:
rule:
r_id: 50762
rv_id: 1263712
rule_id: zdU0Wo
version_id: JdTzx88
url: https://semgrep.dev/playground/r/JdTzx88/terraform.aws.security.aws-ec2-launch-template-metadata-service-v1-enabled.aws-ec2-launch-template-metadata-service-v1-enabled
origin: community
- id: terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address
patterns:
- pattern-either:
- pattern: |
resource "aws_subnet" $ANYTHING {
...
map_public_ip_on_launch = true
...
}
- pattern: |
resource "aws_default_subnet" $ANYTHING {
...
}
- pattern-not: |
resource "aws_default_subnet" $ANYTHING {
...
map_public_ip_on_launch = false
...
}
message: Resources in the AWS subnet are assigned a public IP address. Resources
should not be exposed on the public internet, but should have access limited to
consumers required for the function of your application. Set `map_public_ip_on_launch`
to false so that resources are not publicly-accessible.
languages:
- hcl
severity: WARNING
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-1220: Insufficient Granularity of Access Control'
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control/
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet#map_public_ip_on_launch
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#concepts-public-addresses
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address
shortlink: https://sg.run/XJZw
semgrep.dev:
rule:
r_id: 50764
rv_id: 1263744
rule_id: 2ZUo79
version_id: d6Tyxdb
url: https://semgrep.dev/playground/r/d6Tyxdb/terraform.aws.security.aws-subnet-has-public-ip-address.aws-subnet-has-public-ip-address
origin: community
- id: clojure.lang.security.use-of-md5.use-of-md5
languages:
- clojure
severity: WARNING
message: MD5 hash algorithm detected. This is not collision resistant and leads
to easily-cracked password hashes. Replace with current recommended hashing algorithms.
metadata:
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html
- https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
technology:
- clojure
source-rule-url: https://github.com/clj-holmes/clj-holmes-rules/blob/main/security/weak-hash-function-md5.yml
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-328: Use of Weak Hash'
author: Gabriel Marquet <gab.marquet@gmail.com>
category: security
subcategory:
- vuln
confidence: HIGH
likelihood: MEDIUM
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/clojure.lang.security.use-of-md5.use-of-md5
shortlink: https://sg.run/BgPx
semgrep.dev:
rule:
r_id: 52195
rv_id: 1262609
rule_id: nJU1ep
version_id: 0bTKz2B
url: https://semgrep.dev/playground/r/0bTKz2B/clojure.lang.security.use-of-md5.use-of-md5
origin: community
pattern-either:
- pattern: (MessageDigest/getInstance "MD5")
- pattern: (MessageDigest/getInstance MessageDigestAlgorithms/MD5)
- pattern: (MessageDigest/getInstance org.apache.commons.codec.digest.MessageDigestAlgorithms/MD5)
- pattern: (java.security.MessageDigest/getInstance "MD5")
- pattern: (java.security.MessageDigest/getInstance MessageDigestAlgorithms/MD5)
- pattern: (java.security.MessageDigest/getInstance org.apache.commons.codec.digest.MessageDigestAlgorithms/MD5)
- id: generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak
patterns:
- pattern-regex: ^(AIza[0-9A-Za-z_-]{35}(?!\S))$
message: Detects potential Google Maps API keys in code
languages:
- generic
severity: WARNING
metadata:
description: Detects potential Google Maps API keys in code
severity: MEDIUM
category: security
confidence: MEDIUM
impact: HIGH
likelihood: MEDIUM
subcategory:
- audit
owasp:
- A3:2017 Sensitive Data Exposure
references:
- https://ozguralp.medium.com/unauthorized-google-maps-api-key-usage-cases-and-why-you-need-to-care-1ccb28bf21e
cwe:
- 'CWE-538: Insertion of Sensitive Information into Externally-Accessible File
or Directory'
technology:
- Google Maps
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Mishandled Sensitive Information
source: https://semgrep.dev/r/generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak
shortlink: https://sg.run/DL5d
semgrep.dev:
rule:
r_id: 52196
rv_id: 945530
rule_id: EwU3kN
version_id: NdTqkGz
url: https://semgrep.dev/playground/r/NdTqkGz/generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak
origin: community
- id: terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted
patterns:
- pattern: |
resource "aws_kinesis_stream" $ANYTHING {
...
}
- pattern-not: |
resource "aws_kinesis_stream" $ANYTHING {
...
encryption_type = "KMS"
...
}
message: The AWS Kinesis stream does not encrypt data at rest. The data could be
read if the Kinesis stream storage layer is compromised. Enable Kinesis stream
server-side encryption.
languages:
- hcl
severity: WARNING
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A03:2017 - Sensitive Data Exposure
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
cwe:
- 'CWE-311: Missing Encryption of Sensitive Data'
references:
- https://owasp.org/Top10/A04_2021-Insecure_Design
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_stream#encryption_type
- https://docs.aws.amazon.com/streams/latest/dev/server-side-encryption.html
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: MEDIUM
rule-origin-note: published from /src/aws-kinesis-stream-unencrypted.yml in None
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted
shortlink: https://sg.run/KZ0L
semgrep.dev:
rule:
r_id: 52199
rv_id: 1263728
rule_id: 8GU72N
version_id: pZT037O
url: https://semgrep.dev/playground/r/pZT037O/terraform.aws.security.aws-kinesis-stream-unencrypted.aws-kinesis-stream-unencrypted
origin: community
- id: terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal
patterns:
- pattern-either:
- pattern-inside: |
resource "aws_sqs_queue_policy" $ANYTHING {
...
}
- pattern-inside: |
resource "aws_sqs_queue" $ANYTHING {
...
}
- pattern-either:
- patterns:
- pattern: policy = "$JSONPOLICY"
- metavariable-pattern:
metavariable: $JSONPOLICY
language: json
patterns:
- pattern-not-inside: |
{..., "Effect": "Deny", ...}
- pattern-either:
- pattern: |
{..., "Principal": "*", ...}
- pattern: |
{..., "Principal": [..., "*", ...], ...}
- pattern: |
{..., "Principal": { "AWS": "*" }, ...}
- pattern: |
{..., "Principal": { "AWS": [..., "*", ...] }, ...}
- pattern-not-inside: "{..., \n\"Condition\": {\n \"ArnNotLike\": {\n \"aws:SourceArn\":
...\n }\n},\n...}\n"
- pattern-not-inside: "{..., \n\"Condition\": {\n \"ArnLike\": {\n \"aws:SourceArn\":
...\n }\n},\n...}\n"
- pattern-not-inside: "{..., \n\"Condition\": {\n \"ArnEquals\": {\n \"aws:SourceArn\":
...\n }\n},\n...}\n"
- pattern-not-inside: "{..., \n\"Condition\": {\n \"StringNotLike\": {\n
\ \"aws:PrincipalARN\": ...\n }\n},\n...}\n"
- patterns:
- pattern-inside: policy = jsonencode(...)
- pattern-not-inside: |
{..., Effect = "Deny", ...}
- pattern-not-inside: "{..., \nCondition = {\n ArnNotLike = {\n \"aws:SourceArn\"
= ...\n }\n},\n...}\n"
- pattern-not-inside: "{..., \nCondition = {\n ArnLike = {\n \"aws:SourceArn\"
= ...\n }\n},\n...}\n"
- pattern-not-inside: "{..., \nCondition = {\n ArnEquals = {\n \"aws:SourceArn\"
= ...\n }\n}\n...}\n"
- pattern-not-inside: "{..., \nCondition = {\n StringNotLike = {\n \"aws:PrincipalARN\"
= ...\n }\n},\n...}\n"
- pattern-either:
- pattern: |
{..., Principal = "*", ...}
- pattern: |
{..., Principal = [..., "*", ...], ...}
- pattern: |
{..., Principal = { AWS = "*" }, ...}
- pattern: |
{..., Principal = { AWS = [..., "*", ...] }, ...}
message: Wildcard used in your SQS queue policy principal. This grants access to
all users, including anonymous users (public access). Unless you explicitly require
anyone on the internet to be able to read or write to your queue, limit principals,
actions and resources to what you need according to least privilege.
metadata:
category: security
technology:
- aws
- terraform
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe:
- 'CWE-732: Incorrect Permission Assignment for Critical Resource'
references:
- https://cwe.mitre.org/data/definitions/732.html
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue_policy
- https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-security-best-practices.html
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
rule-origin-note: published from /src/aws-sqs-queue-policy-wildcard-principal.yml
in None
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal
shortlink: https://sg.run/z3eW
semgrep.dev:
rule:
r_id: 53517
rv_id: 1263741
rule_id: PeUl9d
version_id: O9TpxgE
url: https://semgrep.dev/playground/r/O9TpxgE/terraform.aws.security.aws-sqs-queue-policy-wildcard-principal.aws-sqs-queue-policy-wildcard-principal
origin: community
languages:
- hcl
severity: ERROR
- id: terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn
patterns:
- pattern: |
resource "aws_lambda_permission" $ANYTHING {
...
principal = "$PRINCIPAL"
...
}
- pattern-not: |
resource "aws_lambda_permission" $ANYTHING {
...
source_arn = ...
...
}
- metavariable-regex:
metavariable: $PRINCIPAL
regex: .*[.]amazonaws[.]com$
message: The AWS Lambda permission has an AWS service principal but does not specify
a source ARN. If you grant permission to a service principal without specifying
the source, other accounts could potentially configure resources in their account
to invoke your Lambda function. Set the source_arn value to the ARN of the AWS
resource that invokes the function, eg. an S3 bucket, CloudWatch Events Rule,
API Gateway, or SNS topic.
languages:
- hcl
severity: ERROR
metadata:
category: security
technology:
- terraform
- aws
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe:
- 'CWE-732: Incorrect Permission Assignment for Critical Resource'
references:
- https://cwe.mitre.org/data/definitions/732.html
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission
- https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-permission.html
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn
shortlink: https://sg.run/kOP7
semgrep.dev:
rule:
r_id: 54772
rv_id: 1263732
rule_id: OrU9Ox
version_id: 1QTypq5
url: https://semgrep.dev/playground/r/1QTypq5/terraform.aws.security.aws-lambda-permission-unrestricted-source-arn.aws-lambda-permission-unrestricted-source-arn
origin: community
- id: terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active
patterns:
- pattern: |
resource "aws_lambda_function" $ANYTHING {
...
}
- pattern-not: |
resource "aws_lambda_function" $ANYTHING {
...
tracing_config {
...
mode = "Active"
...
}
...
}
message: The AWS Lambda function does not have active X-Ray tracing enabled. X-Ray
tracing enables end-to-end debugging and analysis of all function activity. This
makes it easier to trace the flow of logs and identify bottlenecks, slow downs
and timeouts.
languages:
- hcl
severity: INFO
metadata:
category: security
technology:
- aws
- terraform
owasp:
- A09:2021 Security Logging and Monitoring Failures
cwe:
- 'CWE-778: Insufficient Logging'
references:
- https://cwe.mitre.org/data/definitions/778.html
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function#mode
- https://docs.aws.amazon.com/lambda/latest/dg/services-xray.html
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insufficient Logging
source: https://semgrep.dev/r/terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active
shortlink: https://sg.run/wO2Y
semgrep.dev:
rule:
r_id: 54773
rv_id: 946713
rule_id: eqUl1O
version_id: QkTZ6vk
url: https://semgrep.dev/playground/r/QkTZ6vk/terraform.aws.security.aws-lambda-x-ray-tracing-not-active.aws-lambda-x-ray-tracing-not-active
origin: community
- id: java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization
patterns:
- pattern-either:
- patterns:
- pattern-inside: |
ObjectMapper $OM = new ObjectMapper(...);
...
- pattern-inside: |
$OM.enableDefaultTyping();
...
- pattern: $OM.readValue($JSON, ...);
- patterns:
- pattern-inside: |
class $CLASS {
...
@JsonTypeInfo(use = Id.CLASS,...)
$TYPE $VAR;
...
}
- metavariable-regex:
metavariable: $TYPE
regex: (Object|Serializable|Comparable)
- pattern: $OM.readValue($JSON, $CLASS.class);
- patterns:
- pattern-inside: |
class $CLASS {
...
ObjectMapper $OM;
...
$INITMETHODTYPE $INITMETHOD(...) {
...
$OM = new ObjectMapper();
...
$OM.enableDefaultTyping();
...
}
...
}
- pattern-inside: "$METHODTYPE $METHOD(...) {\n ... \n}\n"
- pattern: $OM.readValue($JSON, ...);
message: When using Jackson to marshall/unmarshall JSON to Java objects, enabling
default typing is dangerous and can lead to RCE. If an attacker can control `$JSON`
it might be possible to provide a malicious JSON which can be used to exploit
unsecure deserialization. In order to prevent this issue, avoid to enable default
typing (globally or by using "Per-class" annotations) and avoid using `Object`
and other dangerous types for member variable declaration which creating classes
for Jackson based deserialization.
languages:
- java
severity: WARNING
metadata:
category: security
subcategory:
- audit
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
confidence: MEDIUM
likelihood: LOW
impact: HIGH
owasp:
- A8:2017 Insecure Deserialization
- A8:2021 Software and Data Integrity Failures
references:
- https://swapneildash.medium.com/understanding-insecure-implementation-of-jackson-deserialization-7b3d409d2038
- https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/
technology:
- jackson
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization
shortlink: https://sg.run/GDop
semgrep.dev:
rule:
r_id: 56948
rv_id: 945724
rule_id: QrUD20
version_id: 2KTYbA9
url: https://semgrep.dev/playground/r/2KTYbA9/java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization
origin: community
- id: java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing
severity: ERROR
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://blog.sonarsource.com/secure-xml-processor
- https://xerces.apache.org/xerces2-j/features.html
category: security
technology:
- java
- xml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing
shortlink: https://sg.run/Gj32
semgrep.dev:
rule:
r_id: 59048
rv_id: 1263061
rule_id: j2Udpk
version_id: YDTZeko
url: https://semgrep.dev/playground/r/YDTZeko/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing
origin: community
message: DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable
to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl`
to true. Alternatively, allow DOCTYPE declarations and only prohibit external
entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities`
and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE -
The previous links are not meant to be clicked. They are the literal config key
values that are supposed to be used to disable these features. For more information,
see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory.
mode: taint
pattern-sources:
- by-side-effect: true
patterns:
- pattern-either:
- pattern: |
$FACTORY = SAXParserFactory.newInstance();
- patterns:
- pattern: $FACTORY
- pattern-inside: |
class $C {
...
$V $FACTORY = SAXParserFactory.newInstance();
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = SAXParserFactory.newInstance();
static {
...
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
...
}
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = SAXParserFactory.newInstance();
static {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
}
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = SAXParserFactory.newInstance();
static {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
}
...
}
pattern-sinks:
- patterns:
- pattern: $FACTORY.newSAXParser();
pattern-sanitizers:
- by-side-effect: true
pattern-either:
- patterns:
- pattern-either:
- pattern: |
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
- pattern: |
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
- pattern: |
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
- focus-metavariable: $FACTORY
- patterns:
- pattern-either:
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl",
true);
...
}
...
}
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
}
...
}
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities",false);
...
}
...
}
- pattern: $M($X)
- focus-metavariable: $X
fix: |
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
$FACTORY.newSAXParser();
languages:
- java
- id: java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled
severity: ERROR
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://blog.sonarsource.com/secure-xml-processor
- https://xerces.apache.org/xerces2-j/features.html
category: security
technology:
- java
- xml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled
shortlink: https://sg.run/1wyQ
semgrep.dev:
rule:
r_id: 59622
rv_id: 1263062
rule_id: v8UeQ1
version_id: 6xT29GK
url: https://semgrep.dev/playground/r/6xT29GK/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled
origin: community
message: DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable
to XML external entity attacks. Disable this by setting the attributes "accessExternalDTD"
and "accessExternalStylesheet" to "".
mode: taint
pattern-sources:
- by-side-effect: true
patterns:
- pattern-either:
- pattern: |
$FACTORY = TransformerFactory.newInstance();
- patterns:
- pattern: $FACTORY
- pattern-inside: |
class $C {
...
$V $FACTORY = TransformerFactory.newInstance();
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = TransformerFactory.newInstance();
static {
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
...
}
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = TransformerFactory.newInstance();
static {
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
...
}
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = TransformerFactory.newInstance();
static {
...
$FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
...
$FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", "");
...
}
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = TransformerFactory.newInstance();
static {
...
$FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", "");
...
$FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
...
}
...
}
pattern-sinks:
- patterns:
- pattern: $FACTORY.newTransformer(...);
pattern-sanitizers:
- by-side-effect: true
pattern-either:
- patterns:
- pattern-either:
- pattern: |
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); ...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
- pattern: |
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
- pattern: |
$FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", ""); ...
$FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
- pattern: |
$FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
...
$FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", "");
- focus-metavariable: $FACTORY
- patterns:
- pattern-either:
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
...
}
...
}
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
...
}
...
}
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", "");
...
$FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
...
}
...
}
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
...
$FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", "");
...
}
...
}
- pattern: $M($X)
- focus-metavariable: $X
fix: |
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
$FACTORY.newTransformer(...);
languages:
- java
- id: javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash
patterns:
- pattern-either:
- pattern: |
window.intercomSettings = {..., email: $EMAIL, ...};
- pattern: |
window.intercomSettings = {..., user_id: $USER_ID, ...};
- pattern: |
Intercom('boot', {..., email: $EMAIL, ...});
- pattern: |
Intercom('boot', {..., user_id: $USER_ID, ...});
- pattern: |
$VAR = {..., email: $EMAIL, ...};
...
Intercom('boot', $VAR);
- pattern: |
$VAR = {..., user_id: $EMAIL, ...};
...
Intercom('boot', $VAR);
- pattern-not: |
window.intercomSettings = {..., user_hash: $USER_HASH, ...};
- pattern-not: |
Intercom('boot', {..., user_hash: $USER_HASH, ...});
- pattern-not: |
$VAR = {..., user_hash: $USER_HASH, ...};
...
Intercom('boot', $VAR);
message: Found an initialization of the Intercom Messenger that identifies a User,
but does not specify a `user_hash`. This configuration allows users to impersonate
one another. See the Intercom Identity Verification docs for more context https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile
languages:
- js
severity: WARNING
metadata:
category: security
subcategory:
- audit
cwe:
- 'CWE-287: Improper Authentication'
confidence: MEDIUM
likelihood: MEDIUM
impact: HIGH
technology:
- intercom
references:
- https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash
shortlink: https://sg.run/Eb5w
semgrep.dev:
rule:
r_id: 60237
rv_id: 945842
rule_id: QrU96W
version_id: nWTpzDk
url: https://semgrep.dev/playground/r/nWTpzDk/javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash
origin: community
- id: java.android.security.exported_activity.exported_activity
patterns:
- pattern-not-inside: <activity ... android:exported="false" ... />
- pattern-inside: "<activity ... /> \n"
- pattern-either:
- pattern: |
<activity ... android:exported="true" ... />
- pattern: |
<activity ... <intent-filter> ... />
message: The application exports an activity. Any application on the device can
launch the exported activity which may compromise the integrity of your application
or its data. Ensure that any exported activities do not have privileged access
to your application's control plane.
languages:
- generic
severity: WARNING
paths:
exclude:
- sources/
- classes3.dex
- '*.so'
include:
- '*AndroidManifest.xml'
metadata:
category: security
subcategory:
- vuln
cwe:
- 'CWE-926: Improper Export of Android Application Components'
confidence: MEDIUM
likelihood: MEDIUM
impact: MEDIUM
owasp:
- A5:2021 Security Misconfiguration
technology:
- Android
references:
- https://cwe.mitre.org/data/definitions/926.html
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/java.android.security.exported_activity.exported_activity
shortlink: https://sg.run/eNGZ
semgrep.dev:
rule:
r_id: 60632
rv_id: 945629
rule_id: v8Ul0r
version_id: rxT6rGR
url: https://semgrep.dev/playground/r/rxT6rGR/java.android.security.exported_activity.exported_activity
origin: community
- id: dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile
patterns:
- pattern: |
RUN sudo ...
message: Avoid using sudo in Dockerfiles. Running processes as a non-root user can
help reduce the potential impact of configuration errors and security vulnerabilities.
metadata:
category: security
technology:
- dockerfile
cwe:
- 'CWE-250: Execution with Unnecessary Privileges'
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
references:
- https://cwe.mitre.org/data/definitions/250.html
- https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile
shortlink: https://sg.run/80Q7
semgrep.dev:
rule:
r_id: 66384
rv_id: 1262661
rule_id: kxUlx1
version_id: pZT03zY
url: https://semgrep.dev/playground/r/pZT03zY/dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile
origin: community
languages:
- dockerfile
severity: WARNING
- id: swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults
message: Potentially sensitive data was observed to be stored in UserDefaults, which
is not adequate protection of sensitive information. For data of a sensitive nature,
applications should leverage the Keychain.
severity: WARNING
metadata:
likelihood: LOW
impact: HIGH
confidence: MEDIUM
category: security
cwe:
- 'CWE-311: Missing Encryption of Sensitive Data'
masvs:
- 'MASVS-STORAGE-1: The app securely stores sensitive data'
owasp:
- A03:2017 - Sensitive Data Exposure
- A04:2021 - Insecure Design
- A06:2025 - Insecure Design
references:
- https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/ValidatingInput.html
- https://mas.owasp.org/MASVS/controls/MASVS-STORAGE-1/
subcategory:
- vuln
technology:
- ios
- macos
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults
shortlink: https://sg.run/qvoO
semgrep.dev:
rule:
r_id: 66512
rv_id: 1263696
rule_id: KxUqoZ
version_id: 3ZT4Xy2
url: https://semgrep.dev/playground/r/3ZT4Xy2/swift.lang.storage.sensitive-storage-userdefaults.swift-user-defaults
origin: community
languages:
- swift
options:
symbolic_propagation: true
patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: |
UserDefaults.standard.set("$VALUE", forKey: "$KEY")
- pattern: |
UserDefaults.standard.set("$VALUE", forKey: $KEY)
- pattern: |
UserDefaults.standard.set($VALUE, forKey: "$KEY")
- pattern: |
UserDefaults.standard.set($VALUE, forKey: $KEY)
- metavariable-regex:
metavariable: $VALUE
regex: (?i).*(passcode|password|pass_word|passphrase|pass_code|pass_word|pass_phrase)$
- focus-metavariable: $VALUE
- patterns:
- pattern-either:
- pattern: |
UserDefaults.standard.set("$VALUE", forKey: "$KEY")
- pattern: |
UserDefaults.standard.set("$VALUE", forKey: $KEY)
- pattern: |
UserDefaults.standard.set($VALUE, forKey: "$KEY")
- pattern: |
UserDefaults.standard.set($VALUE, forKey: $KEY)
- metavariable-regex:
metavariable: $KEY
regex: (?i).*(passcode|password|pass_word|passphrase|pass_code|pass_word|pass_phrase)$
- focus-metavariable: $KEY
- patterns:
- pattern-either:
- pattern: |
UserDefaults.standard.set("$VALUE", forKey: "$KEY")
- pattern: |
UserDefaults.standard.set("$VALUE", forKey: $KEY)
- pattern: |
UserDefaults.standard.set($VALUE, forKey: "$KEY")
- pattern: |
UserDefaults.standard.set($VALUE, forKey: $KEY)
- metavariable-regex:
metavariable: $VALUE
regex: (?i).*(api_key|apikey)$
- focus-metavariable: $VALUE
- patterns:
- pattern-either:
- pattern: |
UserDefaults.standard.set("$VALUE", forKey: "$KEY")
- pattern: |
UserDefaults.standard.set("$VALUE", forKey: $KEY)
- pattern: |
UserDefaults.standard.set($VALUE, forKey: "$KEY")
- pattern: |
UserDefaults.standard.set($VALUE, forKey: $KEY)
- metavariable-regex:
metavariable: $KEY
regex: (?i).*(api_key|apikey)$
- focus-metavariable: $KEY
- patterns:
- pattern-either:
- pattern: |
UserDefaults.standard.set("$VALUE", forKey: "$KEY")
- pattern: |
UserDefaults.standard.set("$VALUE", forKey: $KEY)
- pattern: |
UserDefaults.standard.set($VALUE, forKey: "$KEY")
- pattern: |
UserDefaults.standard.set($VALUE, forKey: $KEY)
- metavariable-regex:
metavariable: $VALUE
regex: (?i).*(secretkey|secret_key|secrettoken|secret_token|clientsecret|client_secret)$
- focus-metavariable: $VALUE
- patterns:
- pattern-either:
- pattern: |
UserDefaults.standard.set("$VALUE", forKey: "$KEY")
- pattern: |
UserDefaults.standard.set("$VALUE", forKey: $KEY)
- pattern: |
UserDefaults.standard.set($VALUE, forKey: "$KEY")
- pattern: |
UserDefaults.standard.set($VALUE, forKey: $KEY)
- metavariable-regex:
metavariable: $KEY
regex: (?i).*(secretkey|secret_key|secrettoken|secret_token|clientsecret|client_secret)$
- focus-metavariable: $KEY
- patterns:
- pattern-either:
- pattern: |
UserDefaults.standard.set("$VALUE", forKey: "$KEY")
- pattern: |
UserDefaults.standard.set("$VALUE", forKey: $KEY)
- pattern: |
UserDefaults.standard.set($VALUE, forKey: "$KEY")
- pattern: |
UserDefaults.standard.set($VALUE, forKey: $KEY)
- metavariable-regex:
metavariable: $VALUE
regex: (?i).*(cryptkey|cryptokey|crypto_key|cryptionkey|symmetrickey|privatekey|symmetric_key|private_key)$
- focus-metavariable: $VALUE
- patterns:
- pattern-either:
- pattern: |
UserDefaults.standard.set("$VALUE", forKey: "$KEY")
- pattern: |
UserDefaults.standard.set("$VALUE", forKey: $KEY)
- pattern: |
UserDefaults.standard.set($VALUE, forKey: "$KEY")
- pattern: |
UserDefaults.standard.set($VALUE, forKey: $KEY)
- metavariable-regex:
metavariable: $KEY
regex: (?i).*(cryptkey|cryptokey|crypto_key|cryptionkey|symmetrickey|privatekey|symmetric_key|private_key)$
- focus-metavariable: $KEY
- id: swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows
message: Webviews were observed that explictly allow JavaScript in an WKWebview
to open windows automatically. Consider disabling this functionality if not required,
following the principle of least privelege.
severity: WARNING
metadata:
likelihood: LOW
impact: LOW
confidence: HIGH
category: security
cwe:
- 'CWE-272: Least Privilege Violation'
masvs:
- 'MASVS-PLATFORM-2: The app uses WebViews securely'
references:
- https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/
- https://developer.apple.com/documentation/webkit/wkpreferences/1536573-javascriptcanopenwindowsautomati
subcategory:
- audit
technology:
- ios
- macos
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows
shortlink: https://sg.run/YWLd
semgrep.dev:
rule:
r_id: 66514
rv_id: 946637
rule_id: lBUOZk
version_id: 9lTy1KE
url: https://semgrep.dev/playground/r/9lTy1KE/swift.webview.webview-js-window.swift-webview-config-allows-js-open-windows
origin: community
languages:
- swift
patterns:
- pattern: |
$P = WKPreferences()
...
- pattern-either:
- patterns:
- pattern-inside: |
$P.JavaScriptCanOpenWindowsAutomatically = $FALSE
...
$P.JavaScriptCanOpenWindowsAutomatically = $TRUE
- pattern-not-inside: |
...
$P.JavaScriptCanOpenWindowsAutomatically = $TRUE
...
$P.JavaScriptCanOpenWindowsAutomatically = $FALSE
- pattern: |
$P.JavaScriptCanOpenWindowsAutomatically = true
- metavariable-regex:
metavariable: $TRUE
regex: ^(true)$
- metavariable-regex:
metavariable: $TRUE
regex: (.*(?!true))
- patterns:
- pattern: |
$P.JavaScriptCanOpenWindowsAutomatically = true
- pattern-not-inside: |
...
$P.JavaScriptCanOpenWindowsAutomatically = ...
...
$P.JavaScriptCanOpenWindowsAutomatically = ...
- id: solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens
message: $VAULT.getPoolTokens() call on a Balancer pool is not protected from the
read-only reentrancy.
metadata:
category: security
technology:
- solidity
cwe: 'CWE-841: Improper Enforcement of Behavioral Workflow'
confidence: HIGH
likelihood: MEDIUM
impact: HIGH
subcategory:
- vuln
references:
- https://quillaudits.medium.com/decoding-sentiment-protocols-1-million-exploit-quillaudits-f36bee77d376
- https://hackmd.io/@sentimentxyz/SJCySo1z2
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens
shortlink: https://sg.run/803Q
semgrep.dev:
rule:
r_id: 67640
rv_id: 946602
rule_id: kxUl7x
version_id: e1T98xQ
url: https://semgrep.dev/playground/r/e1T98xQ/solidity.security.balancer-readonly-reentrancy-getpooltokens.balancer-readonly-reentrancy-getpooltokens
origin: community
patterns:
- pattern-either:
- pattern: |
function $F(...) {
...
$RETURN = $VAULT.getPoolTokens(...);
...
}
- metavariable-pattern:
metavariable: $RETURN
pattern-regex: .*uint256\[].*
- pattern-not-inside: |
contract $C {
...
function $CHECKFUNC(...) {
...
VaultReentrancyLib.ensureNotInVaultContext(...);
...
}
...
function $F(...) {
...
$CHECKFUNC(...);
...
$RETURN = $VAULT.getPoolTokens(...);
...
}
...
}
- pattern-not-inside: |
contract $C {
...
function $CHECKFUNC(...) {
...
VaultReentrancyLib.ensureNotInVaultContext(...);
...
}
...
function $F(...) {
...
$RETURN = $VAULT.getPoolTokens(...);
...
$CHECKFUNC(...);
...
}
...
}
- pattern-not-inside: |
contract $C {
...
function $CHECKFUNC(...) {
...
$VAULT.manageUserBalance(...);
...
}
...
function $F(...) {
...
$RETURN = $VAULT.getPoolTokens(...);
...
$CHECKFUNC(...);
...
}
...
}
- pattern-not-inside: |
contract $C {
...
function $CHECKFUNC(...) {
...
$VAULT.manageUserBalance(...);
...
}
...
function $F(...) {
...
$CHECKFUNC(...);
...
$RETURN = $VAULT.getPoolTokens(...);
...
}
...
}
- pattern-not: |
function $F(...) {
...
VaultReentrancyLib.ensureNotInVaultContext(...);
...
}
- pattern-not: |
function $F(...) {
...
$VAULT.manageUserBalance(...);
...
}
- pattern-not-inside: |
contract LinearPool {
...
}
- pattern-not-inside: |
contract ComposableStablePool {
...
}
- pattern-not-inside: "contract BalancerQueries {\n ...\n} \n"
- pattern-not-inside: |
contract ManagedPool {
...
}
- pattern-not-inside: "contract BaseWeightedPool {\n ...\n} \n"
- pattern-not-inside: |
contract ComposableStablePoolStorage {
...
}
- pattern-not-inside: |
contract RecoveryModeHelper {
...
}
- focus-metavariable:
- $VAULT
languages:
- solidity
severity: ERROR
- id: solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate
message: $VAR.getRate() call on a Balancer pool is not protected from the read-only
reentrancy.
metadata:
category: security
technology:
- solidity
cwe: 'CWE-841: Improper Enforcement of Behavioral Workflow'
confidence: HIGH
likelihood: MEDIUM
impact: HIGH
subcategory:
- vuln
references:
- https://forum.balancer.fi/t/reentrancy-vulnerability-scope-expanded/4345
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate
shortlink: https://sg.run/g9e5
semgrep.dev:
rule:
r_id: 67641
rv_id: 946603
rule_id: wdUx3D
version_id: vdTGn2l
url: https://semgrep.dev/playground/r/vdTGn2l/solidity.security.balancer-readonly-reentrancy-getrate.balancer-readonly-reentrancy-getrate
origin: community
patterns:
- pattern: |
function $F(...) {
...
$VAR.getRate();
...
}
- pattern-not-inside: |
function $F(...) {
...
VaultReentrancyLib.ensureNotInVaultContext(...);
...
}
- pattern-not-inside: |
function $F(...) {
...
$VAULT.manageUserBalance(...);
...
}
- pattern-not-inside: |
function _updateTokenRateCache(...) {
...
}
- pattern-not-inside: |
contract PoolRecoveryHelper {
...
}
- pattern-not-inside: |
contract ComposableStablePoolRates {
...
}
- pattern-not-inside: |
contract WeightedPoolProtocolFees {
...
}
- pattern-not-inside: |
contract $C {
...
function $CHECKFUNC(...) {
...
VaultReentrancyLib.ensureNotInVaultContext(...);
...
}
...
function $F(...) {
...
$CHECKFUNC(...);
...
$VAR.getRate();
...
}
...
}
- pattern-not-inside: |
contract $C {
...
function $CHECKFUNC(...) {
...
VaultReentrancyLib.ensureNotInVaultContext(...);
...
}
...
function $F(...) {
...
$VAR.getRate();
...
$CHECKFUNC(...);
...
}
...
}
- pattern-not-inside: |
contract $C {
...
function $CHECKFUNC(...) {
...
$VAULT.manageUserBalance(...);
...
}
...
function $F(...) {
...
$VAR.getRate();
...
$CHECKFUNC(...);
...
}
...
}
- pattern-not-inside: |
contract $C {
...
function $CHECKFUNC(...) {
...
$VAULT.manageUserBalance(...);
...
}
...
function $F(...) {
...
$CHECKFUNC(...);
...
$VAR.getRate();
...
}
...
}
- focus-metavariable: $VAR
languages:
- solidity
severity: ERROR
- id: solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy
message: Function borrowFresh() in Compound performs state update after doTransferOut()
metadata:
category: security
technology:
- solidity
cwe: 'CWE-841: Improper Enforcement of Behavioral Workflow'
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- vuln
references:
- https://twitter.com/peckshield/status/1509431646818234369
- https://twitter.com/blocksecteam/status/1509466576848064512
- https://slowmist.medium.com/another-day-another-reentrancy-attack-5cde10bbb2b4
- https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy
shortlink: https://sg.run/4A19
semgrep.dev:
rule:
r_id: 67644
rv_id: 946606
rule_id: eqUkx4
version_id: nWTpz74
url: https://semgrep.dev/playground/r/nWTpz74/solidity.security.compound-borrowfresh-reentrancy.compound-borrowfresh-reentrancy
origin: community
patterns:
- pattern-inside: |
function borrowFresh(...) {
...
}
- pattern-not-inside: |
accountBorrows[borrower].interestIndex = borrowIndex;
...
- pattern: doTransferOut(...);
languages:
- solidity
severity: WARNING
- id: solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted
message: Function sweepToken is allowed to be called by anyone
metadata:
category: security
technology:
- solidity
cwe: 'CWE-284: Improper Access Control'
confidence: MEDIUM
likelihood: LOW
impact: HIGH
subcategory:
- vuln
references:
- https://medium.com/chainsecurity/trueusd-compound-vulnerability-bc5b696d29e2
- https://chainsecurity.com/security-audit/compound-ctoken/
- https://blog.openzeppelin.com/compound-comprehensive-protocol-audit/
- https://etherscan.io/address/0xa035b9e130f2b1aedc733eefb1c67ba4c503491f
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted
shortlink: https://sg.run/P4Wv
semgrep.dev:
rule:
r_id: 67645
rv_id: 946607
rule_id: v8Uz2o
version_id: ExTg2nW
url: https://semgrep.dev/playground/r/ExTg2nW/solidity.security.compound-sweeptoken-not-restricted.compound-sweeptoken-not-restricted
origin: community
patterns:
- pattern-inside: |
function sweepToken(...) {
...
}
- pattern-not-inside: |
function sweepToken(...) $M {
...
}
- pattern: token.transfer(...);
- pattern-not-inside: |
require(msg.sender == admin, "...");
...
- pattern-not-inside: |
require(_msgSender() == admin, "...");
...
languages:
- solidity
severity: WARNING
- id: solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy
message: $POOL.get_virtual_price() call on a Curve pool is not protected from the
read-only reentrancy.
metadata:
category: security
technology:
- solidity
cwe: 'CWE-841: Improper Enforcement of Behavioral Workflow'
confidence: HIGH
likelihood: MEDIUM
impact: HIGH
subcategory:
- vuln
references:
- https://chainsecurity.com/heartbreaks-curve-lp-oracles/
- https://chainsecurity.com/curve-lp-oracle-manipulation-post-mortem/
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy
shortlink: https://sg.run/Jk5P
semgrep.dev:
rule:
r_id: 67646
rv_id: 946608
rule_id: d8UGDL
version_id: 7ZTrQO3
url: https://semgrep.dev/playground/r/7ZTrQO3/solidity.security.curve-readonly-reentrancy.curve-readonly-reentrancy
origin: community
patterns:
- pattern: |
$POOL.get_virtual_price()
- pattern-not-inside: |
function $F(...) {
...
$VAR.withdraw_admin_fees(...);
...
}
- pattern-not-inside: |
function $F(...) {
...
$VAR.withdraw_admin_fees(...);
...
}
- pattern-not-inside: |
contract $C {
...
function $CHECKFUNC(...) {
...
$VAR.withdraw_admin_fees(...);
...
}
...
function $F(...) {
...
$CHECKFUNC(...);
...
$POOL.get_virtual_price();
...
}
...
}
- pattern-not-inside: |
contract $C {
...
function $CHECKFUNC(...) {
...
$VAR.withdraw_admin_fees(...);
...
}
...
function $F(...) {
...
$POOL.get_virtual_price();
...
$CHECKFUNC(...);
...
}
...
}
languages:
- solidity
severity: ERROR
- id: solidity.security.encode-packed-collision.encode-packed-collision
message: abi.encodePacked hash collision with variable length arguments in $F()
metadata:
category: security
technology:
- solidity
cwe: 'CWE-20: Improper Input Validation'
confidence: HIGH
likelihood: MEDIUM
impact: MEDIUM
subcategory:
- vuln
references:
- https://swcregistry.io/docs/SWC-133
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/solidity.security.encode-packed-collision.encode-packed-collision
shortlink: https://sg.run/Gr46
semgrep.dev:
rule:
r_id: 67648
rv_id: 946610
rule_id: nJU47w
version_id: 8KTKjb1
url: https://semgrep.dev/playground/r/8KTKjb1/solidity.security.encode-packed-collision.encode-packed-collision
origin: community
patterns:
- pattern-either:
- pattern-inside: |
function $F(..., bytes $A, ..., bytes $B, ...) public {
...
}
- pattern-inside: |
function $F(..., string $A, ..., string $B, ...) public {
...
}
- pattern-inside: |
function $F(..., bytes $A, ..., string $B, ...) public {
...
}
- pattern-inside: |
function $F(..., string $A, ..., bytes $B, ...) public {
...
}
- pattern-inside: |
function $F(..., address[] $A, ..., address[] $B, ...) public {
...
}
- pattern-inside: |
function $F(..., uint256[] $A, ..., uint256[] $B, ...) public {
...
}
- pattern-inside: |
function $F(..., bytes $A, ..., bytes $B, ...) external {
...
}
- pattern-inside: |
function $F(..., string $A, ..., string $B, ...) external {
...
}
- pattern-inside: |
function $F(..., bytes $A, ..., string $B, ...) external {
...
}
- pattern-inside: |
function $F(..., string $A, ..., bytes $B, ...) external {
...
}
- pattern-inside: |
function $F(..., address[] $A, ..., address[] $B, ...) external {
...
}
- pattern-inside: |
function $F(..., uint256[] $A, ..., uint256[] $B, ...) external {
...
}
- pattern-either:
- pattern: |
keccak256(abi.encodePacked(..., $A, $B, ...))
- pattern: |
$X = abi.encodePacked(..., $A, $B, ...);
...
keccak256($X);
languages:
- solidity
severity: ERROR
- id: solidity.security.erc677-reentrancy.erc677-reentrancy
message: ERC677 callAfterTransfer() reentrancy
metadata:
category: security
technology:
- solidity
cwe: 'CWE-841: Improper Enforcement of Behavioral Workflow'
confidence: HIGH
likelihood: MEDIUM
impact: HIGH
subcategory:
- vuln
references:
- https://twitter.com/peckshield/status/1509431646818234369
- https://twitter.com/blocksecteam/status/1509466576848064512
- https://explorer.fuse.io/address/0x139Eb08579eec664d461f0B754c1F8B569044611
- https://explorer.fuse.io/address/0x5De15b5543c178C111915d6B8ae929Af01a8cC58
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.erc677-reentrancy.erc677-reentrancy
shortlink: https://sg.run/BXnR
semgrep.dev:
rule:
r_id: 67651
rv_id: 946613
rule_id: L1Ub0L
version_id: 3ZTOPdd
url: https://semgrep.dev/playground/r/3ZTOPdd/solidity.security.erc677-reentrancy.erc677-reentrancy
origin: community
patterns:
- pattern-inside: |
function transfer(...) {
...
}
- pattern: callAfterTransfer(...);
languages:
- solidity
severity: WARNING
- id: solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom
message: Custom ERC721 implementation lacks access control checks in _transfer()
metadata:
category: security
technology:
- solidity
cwe: 'CWE-284: Improper Access Control'
confidence: MEDIUM
likelihood: HIGH
impact: HIGH
subcategory:
- vuln
references:
- https://twitter.com/BlockSecAlert/status/1516289618605654024
- https://etherscan.io/address/0xf3821adaceb6500c0a202971aecf840a033f236b
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom
shortlink: https://sg.run/D17G
semgrep.dev:
rule:
r_id: 67652
rv_id: 946614
rule_id: 8GUkbo
version_id: 44TZko3
url: https://semgrep.dev/playground/r/44TZko3/solidity.security.erc721-arbitrary-transferfrom.erc721-arbitrary-transferfrom
origin: community
patterns:
- pattern-inside: |
function _transfer(...) {
...
}
- pattern-inside: |
require(prevOwnership.addr == $FROM, ...);
...
- pattern-not-inside: |
(<... _msgSender() == $FROM ...>);
...
- pattern-not-inside: |
(<... _msgSender() == $PREV.$ADDR ...>);
...
- pattern-not-inside: |
(<... msg.sender == $FROM ...>);
...
- pattern-not-inside: |
require(_isApprovedOrOwner(...), ...);
...
- pattern: _approve(...);
languages:
- solidity
severity: WARNING
- id: solidity.security.erc721-reentrancy.erc721-reentrancy
message: ERC721 onERC721Received() reentrancy
metadata:
category: security
technology:
- solidity
cwe: 'CWE-841: Improper Enforcement of Behavioral Workflow'
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- vuln
references:
- https://blocksecteam.medium.com/when-safemint-becomes-unsafe-lessons-from-the-hypebears-security-incident-2965209bda2a
- https://etherscan.io/address/0x14e0a1f310e2b7e321c91f58847e98b8c802f6ef
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.erc721-reentrancy.erc721-reentrancy
shortlink: https://sg.run/WBoE
semgrep.dev:
rule:
r_id: 67653
rv_id: 946615
rule_id: gxU2qG
version_id: PkTQZYA
url: https://semgrep.dev/playground/r/PkTQZYA/solidity.security.erc721-reentrancy.erc721-reentrancy
origin: community
patterns:
- pattern: _checkOnERC721Received(...)
languages:
- solidity
severity: WARNING
- id: solidity.security.erc777-reentrancy.erc777-reentrancy
message: ERC777 tokensReceived() reentrancy
metadata:
category: security
technology:
- solidity
cwe: 'CWE-841: Improper Enforcement of Behavioral Workflow'
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- vuln
references:
- https://mirror.xyz/baconcoin.eth/LHaPiX38mnx8eJ2RVKNXHttHfweQMKNGmEnX4KUksk0
- https://etherscan.io/address/0xf53f00f844b381963a47fde3325011566870b31f
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.erc777-reentrancy.erc777-reentrancy
shortlink: https://sg.run/0Jpw
semgrep.dev:
rule:
r_id: 67654
rv_id: 946616
rule_id: QrUrJj
version_id: JdTDyg1
url: https://semgrep.dev/playground/r/JdTDyg1/solidity.security.erc777-reentrancy.erc777-reentrancy
origin: community
patterns:
- pattern: $X.tokensReceived(...);
languages:
- solidity
severity: WARNING
- id: solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash
message: blockhash(block.number) and blockhash(block.number + N) always returns
0.
metadata:
category: security
technology:
- solidity
cwe: 'CWE-341: Predictable from Observable State'
confidence: HIGH
likelihood: LOW
impact: MEDIUM
subcategory:
- vuln
references:
- https://blog.positive.com/predicting-random-numbers-in-ethereum-smart-contracts-e5358c6b8620
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash
shortlink: https://sg.run/qvPO
semgrep.dev:
rule:
r_id: 67656
rv_id: 946618
rule_id: 4bUPoB
version_id: GxTP7wj
url: https://semgrep.dev/playground/r/GxTP7wj/solidity.security.incorrect-use-of-blockhash.incorrect-use-of-blockhash
origin: community
patterns:
- pattern-either:
- pattern: blockhash(block.number)
- pattern: blockhash(block.number + $N)
- pattern: blockhash(block.number * $N)
- pattern: block.blockhash(block.number)
- pattern: block.blockhash(block.number + $N)
- pattern: block.blockhash(block.number * $N)
severity: ERROR
languages:
- solidity
- id: solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation
message: Keep3rV2.current() call has high data freshness, but it has low security, an
exploiter simply needs to manipulate 2 data points to be able to impact the feed.
metadata:
category: security
technology:
- solidity
cwe: 'CWE-682: Incorrect Calculation'
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- vuln
references:
- https://twitter.com/peckshield/status/1510232640338608131
- https://twitter.com/FrankResearcher/status/1510239094777032713
- https://twitter.com/larry0x/status/1510263618180464644
- https://andrecronje.medium.com/keep3r-network-on-chain-oracle-price-feeds-3c67ed002a9
- https://etherscan.io/address/0x210ac53b27f16e20a9aa7d16260f84693390258f
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation
shortlink: https://sg.run/lkEo
semgrep.dev:
rule:
r_id: 67657
rv_id: 946619
rule_id: PeUrYv
version_id: RGTAgvQ
url: https://semgrep.dev/playground/r/RGTAgvQ/solidity.security.keeper-network-oracle-manipulation.keeper-network-oracle-manipulation
origin: community
patterns:
- pattern: $KEEPER.current($TOKENIN, $AMOUNTIN, $TOKENOUT);
languages:
- solidity
severity: WARNING
- id: solidity.security.no-bidi-characters.no-bidi-characters
message: The code must not contain any of Unicode Direction Control Characters
metadata:
category: security
technology:
- solidity
cwe: 'CWE-837: Improper Enforcement of a Single, Unique Action'
confidence: HIGH
likelihood: LOW
impact: LOW
subcategory:
- audit
references:
- https://entethalliance.org/specs/ethtrust-sl/v1/#req-1-unicode-bdo
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.no-bidi-characters.no-bidi-characters
shortlink: https://sg.run/6DyK
semgrep.dev:
rule:
r_id: 67659
rv_id: 946622
rule_id: 5rUD6Z
version_id: DkTNp8K
url: https://semgrep.dev/playground/r/DkTNp8K/solidity.security.no-bidi-characters.no-bidi-characters
origin: community
patterns:
- pattern-either:
- pattern-regex: "\u202A"
- pattern-regex: "\u202B"
- pattern-regex: "\u202D"
- pattern-regex: "\u202E"
- pattern-regex: "\u2066"
- pattern-regex: "\u2067"
- pattern-regex: "\u2068"
- pattern-regex: "\u202C"
- pattern-regex: "\u2069"
languages:
- solidity
severity: WARNING
- id: solidity.security.no-slippage-check.no-slippage-check
message: No slippage check in a Uniswap v2/v3 trade
metadata:
category: security
technology:
- solidity
cwe: 'CWE-682: Incorrect Calculation'
confidence: MEDIUM
likelihood: HIGH
impact: MEDIUM
subcategory:
- vuln
references:
- https://uniswapv3book.com/docs/milestone_3/slippage-protection/
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.no-slippage-check.no-slippage-check
shortlink: https://sg.run/oO8X
semgrep.dev:
rule:
r_id: 67660
rv_id: 946623
rule_id: GdUE2p
version_id: WrTEoxy
url: https://semgrep.dev/playground/r/WrTEoxy/solidity.security.no-slippage-check.no-slippage-check
origin: community
patterns:
- pattern-either:
- pattern: $X.swapExactTokensForTokens($A, $LIMIT, $B, $C, $D)
- pattern: $X.swapExactTokensForTokensSupportingFeeOnTransferTokens($A, $LIMIT,
$B, $C, $D)
- pattern: $X.swapExactTokensForETH($A, $LIMIT, $B, $C, $D)
- pattern: $X.swapExactTokensForETHSupportingFeeOnTransferTokens($A, $LIMIT, $B,
$C, $D)
- pattern: $X.swapExactETHForTokens{$VALUE:...}($LIMIT, $A, $B, $C)
- pattern: $X.swapExactETHForTokensSupportingFeeOnTransferTokens{$VALUE:...}($LIMIT,
$A, $B, $C)
- pattern: $X.swapTokensForExactTokens($A, $LIMIT, $B, $C, $D)
- pattern: $X.swapTokensForExactETH($A, $LIMIT, $B, $C, $D)
- pattern: "function $FUNC(...) {\n ...\n $Y = $SWAPROUTER.ExactInputSingleParams({\n
\ tokenIn: $A, \n tokenOut: $B, \n fee: $C, \n recipient: $D, \n
\ deadline: $E, \n amountIn: $F, \n amountOutMinimum: $LIMIT, \n sqrtPriceLimitX96:
0\n });\n ...\n $X.exactInputSingle($Y);\n ...\n}\n"
- pattern: |
$X.exactInputSingle($SWAPROUTER.ExactInputSingleParams({
tokenIn: $A,
tokenOut: $B,
fee: $C,
recipient: $D,
deadline: $E,
amountIn: $F,
amountOutMinimum: $LIMIT,
sqrtPriceLimitX96: 0
}));
- pattern: |
function $FUNC(...) {
...
$Y = $SWAPROUTER.ExactOutputSingleParams({
tokenIn: $A,
tokenOut: $B,
fee: $C,
recipient: $D,
deadline: $E,
amountOut: $F,
amountInMaximum: $LIMIT,
sqrtPriceLimitX96: 0
});
...
$X.exactOutputSingle($Y);
...
}
- pattern: |
$X.exactOutputSingle($SWAPROUTER.ExactOutputSingleParams({
tokenIn: $A,
tokenOut: $B,
fee: $C,
recipient: $D,
deadline: $E,
amountOut: $F,
amountInMaximum: $LIMIT,
sqrtPriceLimitX96: 0
}));
- pattern: $X.swap($RECIPIENT, $ZEROFORONE, $AMOUNTIN, $LIMIT, $DATA)
- metavariable-regex:
metavariable: $LIMIT
regex: ^(0)|(0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff)|(type\(uint(256)?\)\.max)|(uint(256)?\(-1)|(115792089237316195423570985008687907853269984665640564039457584007913129639935)|(2\s?\*\*\s?256\s?-\s?1)$
languages:
- solidity
severity: ERROR
- id: solidity.security.proxy-storage-collision.proxy-storage-collision
message: Proxy declares a state var that may override a storage slot of the implementation
metadata:
category: security
technology:
- solidity
cwe: 'CWE-787: Out-of-bounds Write'
confidence: HIGH
likelihood: MEDIUM
impact: HIGH
subcategory:
- vuln
references:
- https://blog.audius.co/article/audius-governance-takeover-post-mortem-7-23-22
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.proxy-storage-collision.proxy-storage-collision
shortlink: https://sg.run/2GXr
semgrep.dev:
rule:
r_id: 67663
rv_id: 946626
rule_id: BYU0EL
version_id: qkT4jqp
url: https://semgrep.dev/playground/r/qkT4jqp/solidity.security.proxy-storage-collision.proxy-storage-collision
origin: community
patterns:
- pattern-either:
- pattern: |
contract $CONTRACT is ..., $PROXY, ... {
...
$TYPE $VAR;
...
constructor(...) {
...
}
...
}
- pattern: |
contract $CONTRACT is ..., $PROXY, ... {
...
$TYPE $VAR = ...;
...
constructor(...) {
...
}
...
}
- pattern-not: |
contract $CONTRACT is ..., $PROXY, ... {
$TYPE immutable $VAR;
...
constructor(...) {
...
}
...
}
- pattern-not: |
contract $CONTRACT is ..., $PROXY, ... {
$TYPE immutable $VAR = ...;
...
constructor(...) {
...
}
...
}
- pattern-not: |
contract $CONTRACT is ..., $PROXY, ... {
$TYPE constant $VAR = ...;
...
constructor(...) {
...
}
...
}
- metavariable-regex:
metavariable: $CONTRACT
regex: ^(?!AdminUpgradeabilityProxy|OwnedUpgrade*abilityProxy).*$
- metavariable-regex:
metavariable: $PROXY
regex: (UpgradeabilityProxy|AdminUpgradeabilityProxy|OwnedUpgrade*abilityProxy|TransparentUpgradeableProxy|ERC1967Proxy)
- focus-metavariable: $PROXY
languages:
- solidity
severity: WARNING
- id: solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug
message: transferFrom() can steal allowance of other accounts
metadata:
category: security
technology:
- solidity
cwe: 'CWE-688: Function Call With Incorrect Variable or Reference as Argument'
confidence: HIGH
likelihood: HIGH
impact: HIGH
subcategory:
- vuln
references:
- https://medium.com/immunefi/redacted-cartel-custom-approval-logic-bugfix-review-9b2d039ca2c5
- https://etherscan.io/address/0x186E55C0BebD2f69348d94C4A27556d93C5Bd36C
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug
shortlink: https://sg.run/XDzj
semgrep.dev:
rule:
r_id: 67664
rv_id: 946627
rule_id: DbU0Qb
version_id: l4Tx9Px
url: https://semgrep.dev/playground/r/l4Tx9Px/solidity.security.redacted-cartel-custom-approval-bug.redacted-cartel-custom-approval-bug
origin: community
patterns:
- pattern-inside: |
function transferFrom(...) {
...
}
- pattern: _approve(..., allowance(sender, recipient).sub(amount, ...), ...);
languages:
- solidity
severity: ERROR
- id: solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control
message: setMultipleAllowances() is missing onlyOwner modifier
metadata:
category: security
technology:
- solidity
cwe: 'CWE-284: Improper Access Control'
confidence: HIGH
likelihood: HIGH
impact: HIGH
subcategory:
- vuln
references:
- https://twitter.com/danielvf/status/1494317265835147272
- https://etherscan.io/address/0x876b9ebd725d1fa0b879fcee12560a6453b51dc8
- https://play.secdim.com/game/dapp/challenge/rigoownsol
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control
shortlink: https://sg.run/jbZP
semgrep.dev:
rule:
r_id: 67665
rv_id: 946628
rule_id: WAUpbw
version_id: YDTvRP2
url: https://semgrep.dev/playground/r/YDTvRP2/solidity.security.rigoblock-missing-access-control.rigoblock-missing-access-control
origin: community
patterns:
- pattern: function setMultipleAllowances(...) {...}
- pattern-not: function setMultipleAllowances(...) onlyOwner {...}
languages:
- solidity
severity: ERROR
- id: solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control
message: Oracle update is not restricted in $F()
metadata:
category: security
technology:
- solidity
cwe: 'CWE-284: Improper Access Control'
confidence: MEDIUM
likelihood: HIGH
impact: HIGH
subcategory:
- vuln
author: https://twitter.com/ArbazKiraak
references:
- https://medium.com/immunefi/sense-finance-access-control-issue-bugfix-review-32e0c806b1a0
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control
shortlink: https://sg.run/1521
semgrep.dev:
rule:
r_id: 67666
rv_id: 946629
rule_id: 0oUbvd
version_id: 6xTxjKQ
url: https://semgrep.dev/playground/r/6xTxjKQ/solidity.security.sense-missing-oracle-access-control.sense-missing-oracle-access-control
origin: community
patterns:
- pattern-either:
- pattern-inside: |
function $F(...,$D $REQUEST,...) external {
...
}
- pattern-inside: |
function $F(...,$D $REQUEST,...) public {
...
}
- pattern-not-inside: |
function $F(...,$D $REQUEST,...) external onlyVault(...) {
...
}
- patterns:
- pattern: _updateOracle($LASTBLOCK,...,...)
- pattern-not-inside: |
...
if (msg.sender == $BALANCER) { ... }
...
- pattern-not-inside: |
...
require(msg.sender == address($BALANCER),...);
...
- pattern-not-inside: |
...
if (_msgSender() == $BALANCER) { ... }
...
- pattern-not-inside: |
...
require(_msgSender() == address($BALANCER),...);
...
languages:
- solidity
severity: ERROR
- id: solidity.security.superfluid-ctx-injection.superfluid-ctx-injection
message: A specially crafted calldata may be used to impersonate other accounts
metadata:
category: security
technology:
- solidity
cwe: 'CWE-20: Improper Input Validation'
confidence: HIGH
likelihood: HIGH
impact: HIGH
subcategory:
- vuln
references:
- https://rekt.news/superfluid-rekt/
- https://medium.com/superfluid-blog/08-02-22-exploit-post-mortem-15ff9c97cdd
- https://polygonscan.com/address/0x07711bb6dfbc99a1df1f2d7f57545a67519941e7
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/solidity.security.superfluid-ctx-injection.superfluid-ctx-injection
shortlink: https://sg.run/9KNy
semgrep.dev:
rule:
r_id: 67667
rv_id: 946630
rule_id: KxUqld
version_id: o5TZexb
url: https://semgrep.dev/playground/r/o5TZexb/solidity.security.superfluid-ctx-injection.superfluid-ctx-injection
origin: community
patterns:
- pattern: $T.decodeCtx(ctx);
- pattern-not-inside: |
require($T.isCtxValid(...), "...");
...
languages:
- solidity
severity: ERROR
- id: solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug
message: Parameter "from" is checked at incorrect position in "_allowances" mapping
metadata:
category: security
technology:
- solidity
cwe: 'CWE-688: Function Call With Incorrect Variable or Reference as Argument'
confidence: MEDIUM
likelihood: HIGH
impact: HIGH
subcategory:
- vuln
references:
- https://twitter.com/Mauricio_0218/status/1490082073096462340
- https://etherscan.io/address/0xe38b72d6595fd3885d1d2f770aa23e94757f91a1
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug
shortlink: https://sg.run/yBWA
semgrep.dev:
rule:
r_id: 67668
rv_id: 946631
rule_id: qNUnN0
version_id: zyTlkRL
url: https://semgrep.dev/playground/r/zyTlkRL/solidity.security.tecra-coin-burnfrom-bug.tecra-coin-burnfrom-bug
origin: community
patterns:
- pattern-inside: |
function $BURN(..., address $FROM, ...) {
...
_burn($FROM, ...);
...
}
- pattern-either:
- pattern: require(_allowances[$S][$FROM] >= $X, ...)
- pattern: require(allowance($S, $FROM) >= $X, ...)
languages:
- solidity
severity: ERROR
- id: java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request
message: Detected input from a HTTPServletRequest going into the environment variables
of an 'exec' command. Instead, call the command with user-supplied arguments
by using the overloaded method with one String array as the argument. `exec({"command",
"arg1", "arg2"})`.
languages:
- java
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
(HttpServletRequest $REQ)
- patterns:
- pattern-inside: |
(javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);
...
for (javax.servlet.http.Cookie $COOKIE: $COOKIES) {
...
}
- pattern: |
$COOKIE.getValue(...)
pattern-sinks:
- patterns:
- pattern: (java.lang.Runtime $R).exec($CMD, $ENV_ARGS, ...);
- focus-metavariable: $ENV_ARGS
metadata:
category: security
technology:
- java
cwe:
- 'CWE-454: External Initialization of Trusted Variables or Data Stores'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: false
cwe2021-top25: false
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request
shortlink: https://sg.run/EJAB
semgrep.dev:
rule:
r_id: 70981
rv_id: 1409391
rule_id: nJULjy
version_id: LjTRL6W
url: https://semgrep.dev/playground/r/LjTRL6W/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request
origin: community
- patterns:
- pattern-either:
- pattern: |
provisioner "remote-exec" {
...
}
- pattern: |
provisioner "local-exec" {
...
}
- pattern-inside: |
resource "aws_instance" "..." {
...
}
id: terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec
message: Provisioners are a tool of last resort and should be avoided where possible.
Provisioner behavior cannot be mapped by Terraform as part of a plan, and execute
arbitrary shell commands by design.
languages:
- terraform
severity: WARNING
metadata:
category: security
owasp:
- A03:2021 - Injection
- A01:2017 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-77: Improper Neutralization of Special Elements used in a Command (''Command
Injection'')'
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
subcategory:
- audit
confidence: HIGH
likelihood: HIGH
impact: MEDIUM
technology:
- terraform
references:
- https://developer.hashicorp.com/terraform/language/resources/provisioners/remote-exec
- https://developer.hashicorp.com/terraform/language/resources/provisioners/local-exec
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
- Other
source: https://semgrep.dev/r/terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec
shortlink: https://sg.run/7EjQ
semgrep.dev:
rule:
r_id: 70982
rv_id: 1263736
rule_id: EwUxO1
version_id: bZT53j1
url: https://semgrep.dev/playground/r/bZT53j1/terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec
origin: community
- id: terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy
metadata:
category: security
subcategory:
- audit
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
technology:
- terraform
- aws
owasp:
- A05:2017 - Sensitive Data Exposure
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-1220: Insufficient Granularity of Access Control'
references:
- https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#configuring-the-role-and-trust-policy
- https://dagrz.com/writing/aws-security/hacking-github-aws-oidc/
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy
shortlink: https://sg.run/LWlY
semgrep.dev:
rule:
r_id: 70983
rv_id: 1263748
rule_id: 7KU3dr
version_id: 7ZTE346
url: https://semgrep.dev/playground/r/7ZTE346/terraform.aws.security.unrestricted-github-oidc-policy.unrestricted-github-oidc-policy
origin: community
message: '`$POLICY` is missing a `condition` block which scopes users of this policy
to specific GitHub repositories. Without this, `$POLICY` is open to all users
on GitHub. Add a `condition` block on the variable `token.actions.githubusercontent.com:sub`
which scopes it to prevent this.'
languages:
- hcl
severity: WARNING
match:
where:
- metavariable: $IDENTIFIER
regex: .*oidc-provider/token\.actions\.githubusercontent\.com
all:
- inside: |
data "aws_iam_policy_document" $POLICY {
...
}
- |
statement {
...
principals {
...
type = "Federated"
identifiers = [..., $IDENTIFIER, ...]
}
}
- not: |
statement {
...
condition {
...
variable = "token.actions.githubusercontent.com:sub"
}
}
- id: clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe
languages:
- clojure
severity: ERROR
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://xerces.apache.org/xerces2-j/features.html
source-rule-url: https://github.com/clj-holmes/clj-holmes-rules/blob/main/security/xxe-clojure-xml/xxe-clojure-xml.yml
category: security
technology:
- clojure
- xml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe
shortlink: https://sg.run/v7An
semgrep.dev:
rule:
r_id: 71533
rv_id: 1262608
rule_id: bwU3Gj
version_id: WrTqKyD
url: https://semgrep.dev/playground/r/WrTqKyD/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe
origin: community
message: DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory.
Without prohibiting external entity declarations, this is vulnerable to XML external
entity attacks. Disable this by setting the feature "http://apache.org/xml/features/disallow-doctype-decl"
to true. Alternatively, allow DOCTYPE declarations and only prohibit external
entities declarations. This can be done by setting the features "http://xml.org/sax/features/external-general-entities"
and "http://xml.org/sax/features/external-parameter-entities" to false.
patterns:
- pattern-inside: |
(ns ... (:require [clojure.xml :as ...]))
...
- pattern-either:
- pattern-inside: |
(def ... ... ( ... ))
- pattern-inside: |
(defn ... ... ( ... ))
- pattern-either:
- pattern: (clojure.xml/parse $INPUT)
- patterns:
- pattern-inside: |
(doto (javax.xml.parsers.SAXParserFactory/newInstance) ...)
- pattern: (.setFeature "http://apache.org/xml/features/disallow-doctype-decl"
false)
- pattern-not-inside: |
(doto (javax.xml.parsers.SAXParserFactory/newInstance)
...
(.setFeature "http://xml.org/sax/features/external-general-entities" false)
...
(.setFeature "http://xml.org/sax/features/external-parameter-entities" false)
...)
- pattern-not-inside: |
(doto (javax.xml.parsers.SAXParserFactory/newInstance)
...
(.setFeature "http://xml.org/sax/features/external-parameter-entities" false)
...
(.setFeature "http://xml.org/sax/features/external-general-entities" false)
...)
- id: clojure.lang.security.use-of-sha1.use-of-sha1
languages:
- clojure
severity: WARNING
message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not
collision resistant and is therefore not suitable as a cryptographic signature.
Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function
applications.
metadata:
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html
- https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
technology:
- clojure
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
- 'CWE-328: Use of Weak Hash'
category: security
subcategory:
- vuln
confidence: HIGH
likelihood: MEDIUM
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/clojure.lang.security.use-of-sha1.use-of-sha1
shortlink: https://sg.run/dvwX
semgrep.dev:
rule:
r_id: 71534
rv_id: 1262610
rule_id: NbUy12
version_id: K3TKk7E
url: https://semgrep.dev/playground/r/K3TKk7E/clojure.lang.security.use-of-sha1.use-of-sha1
origin: community
patterns:
- pattern-either:
- pattern: (MessageDigest/getInstance $ALGO)
- pattern: (java.security.MessageDigest/getInstance $ALGO)
- metavariable-regex:
metavariable: $ALGO
regex: (((org\.apache\.commons\.codec\.digest\.)?MessageDigestAlgorithms/)?"?(SHA-1|SHA1)"?)
- id: generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs
languages:
- generic
severity: WARNING
message: 'Consuming CDNs without including a SubResource Integrity (SRI) can expose
your application and its users to compromised code. SRIs allow you to consume
specific versions of content where if even a single byte is compromised, the resource
will not be loaded. Add an integrity attribute to your <script> and <link> tags
pointing to CDN content to ensure the resources have not been compromised. A crossorigin
attribute should also be added. For a more thorough explanation along with explicit
instructions on remediating, follow the directions from Mozilla here: https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/'
metadata:
cwe:
- 'CWE-346: Origin Validation Error'
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe2020-top25': true
cwe2021-top25': true
cwe2022-top25': true
impact: MEDIUM
likelihood: MEDIUM
confidence: MEDIUM
category: security
subcategory:
- vuln
technology:
- salesforce
- visualforce
references:
- https://cwe.mitre.org/data/definitions/352.html
- https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs
shortlink: https://sg.run/1pXb
semgrep.dev:
rule:
r_id: 72422
rv_id: 1262905
rule_id: AbU20Y
version_id: 5PTo1or
url: https://semgrep.dev/playground/r/5PTo1or/generic.visualforce.security.ncino.html.usesriforcdns.use-SRI-for-CDNs
origin: community
patterns:
- pattern-either:
- pattern: <link...href="$URL..."...>
- pattern: <script...src="$URL..."...>
- metavariable-regex:
metavariable: $URL
regex: http[A-Za-z0-9\/\.\-\:]
- pattern-not: <script...integrity="..."...src="..."...>
- pattern-not: <script...src="..."...integrity="..."...>
- pattern-not: <link...integrity="..."...href="..."...>
- pattern-not: <link...href="..."...integrity="..."...>
paths:
include:
- '*.component'
- '*.page'
- id: generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param
languages:
- generic
severity: ERROR
message: To remediate this issue, ensure that all URL parameters are properly escaped
before including them in scripts. Please update your code to use either the JSENCODE
method to escape URL parameters or the escape="true" attribute on <apex:outputText>
tags. Passing URL parameters directly into scripts and DOM sinks creates an opportunity
for Cross-Site Scripting attacks. Cross-Site Scripting (XSS) attacks are a type
of injection, in which malicious scripts are injected into otherwise benign and
trusted websites. To remediate this issue, ensure that all URL parameters are
properly escaped before including them in scripts.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/pages_security_tips_xss.htm
category: security
subcategory:
- vuln
technology:
- salesforce
- visualforce
cwe2022-top25: true
cwe2021-top25: true
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param
shortlink: https://sg.run/9bGk
semgrep.dev:
rule:
r_id: 72423
rv_id: 1262906
rule_id: BYUAJ2
version_id: GxTkekB
url: https://semgrep.dev/playground/r/GxTkekB/generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param
origin: community
patterns:
- pattern-either:
- pattern: <apex:outputText...escape="false"...value="{!...CurrentPage.parameters.$URL_PARAM}".../>
- pattern: <apex:outputText...value="{!...CurrentPage.parameters.$URL_PARAM}"...escape="false".../>
- pattern: <script>...'{!...CurrentPage.parameters.$URL_PARAM}'...</script>
- pattern-not: <script>...'{!...JSENCODE(...CurrentPage.parameters.$URL_PARAM})'...</script>
paths:
include:
- '*.component'
- '*.page'
- id: generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute
languages:
- generic
severity: INFO
message: Visualforce Pages must have the cspHeader attribute set to true. This attribute
is available in API version 55 or higher.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://help.salesforce.com/s/articleView?id=sf.csp_trusted_sites.htm&type=5
category: security
subcategory:
- vuln
technology:
- salesforce
- visualforce
cwe2022-top25: true
cwe2021-top25: true
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute
shortlink: https://sg.run/yoj8
semgrep.dev:
rule:
r_id: 72424
rv_id: 1262907
rule_id: DbUj7d
version_id: RGT0L0r
url: https://semgrep.dev/playground/r/RGT0L0r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute
origin: community
patterns:
- pattern: <apex:page...>...</apex:page>
- pattern-not: <apex:page...cspHeader="true"...>...</apex:page>
- pattern-not: <apex:page...>...<!--deprecated-->...</apex:page>
- pattern-not: <apex:page...>...<!-- deprecated -->...</apex:page>
paths:
include:
- '*.page'
- id: generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version
languages:
- generic
severity: WARNING
message: Visualforce Pages must use API version 55 or higher for required use of
the cspHeader attribute set to true.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_pages.htm
category: security
subcategory:
- vuln
technology:
- salesforce
- visualforce
cwe2022-top25: true
cwe2021-top25: true
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version
shortlink: https://sg.run/rWr6
semgrep.dev:
rule:
r_id: 72425
rv_id: 1262908
rule_id: WAUwJW
version_id: A8Tgdgn
url: https://semgrep.dev/playground/r/A8Tgdgn/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version
origin: community
patterns:
- pattern-inside: <apiVersion.../apiVersion>
- pattern-either:
- pattern-regex: '[>][0-9].[0-9][<]'
- pattern-regex: '[>][1-4][0-9].[0-9][<]'
- pattern-regex: '[>][5][0-4].[0-9][<]'
paths:
include:
- '*.page-meta.xml'
- id: python.django.security.hashids-with-django-secret.hashids-with-django-secret
languages:
- python
message: The Django secret key is used as salt in HashIDs. The HashID mechanism
is not secure. By observing sufficient HashIDs, the salt used to construct them
can be recovered. This means the Django secret key can be obtained by attackers,
through the HashIDs.
metadata:
category: security
subcategory:
- vuln
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- "A02:2021 \u2013 Cryptographic Failures"
references:
- https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SECRET_KEY
- http://carnage.github.io/2015/08/cryptanalysis-of-hashids
technology:
- django
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.django.security.hashids-with-django-secret.hashids-with-django-secret
shortlink: https://sg.run/bxeZ
semgrep.dev:
rule:
r_id: 72426
rv_id: 946163
rule_id: 0oUXqy
version_id: 0bT15nn
url: https://semgrep.dev/playground/r/0bT15nn/python.django.security.hashids-with-django-secret.hashids-with-django-secret
origin: community
pattern-either:
- pattern: hashids.Hashids(..., salt=django.conf.settings.SECRET_KEY, ...)
- pattern: hashids.Hashids(django.conf.settings.SECRET_KEY, ...)
severity: ERROR
- id: python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret
languages:
- python
message: The Flask secret key is used as salt in HashIDs. The HashID mechanism is
not secure. By observing sufficient HashIDs, the salt used to construct them can
be recovered. This means the Flask secret key can be obtained by attackers, through
the HashIDs.
metadata:
category: security
subcategory:
- vuln
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- "A02:2021 \u2013 Cryptographic Failures"
references:
- https://flask.palletsprojects.com/en/2.2.x/config/#SECRET_KEY
- http://carnage.github.io/2015/08/cryptanalysis-of-hashids
technology:
- flask
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret
shortlink: https://sg.run/N0Rx
semgrep.dev:
rule:
r_id: 72427
rv_id: 946220
rule_id: KxUX3z
version_id: 0bT15Px
url: https://semgrep.dev/playground/r/0bT15Px/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret
origin: community
pattern-either:
- pattern: hashids.Hashids(..., salt=flask.current_app.config['SECRET_KEY'], ...)
- pattern: hashids.Hashids(flask.current_app.config['SECRET_KEY'], ...)
- patterns:
- pattern-inside: |
$APP = flask.Flask(...)
...
- pattern-either:
- pattern: hashids.Hashids(..., salt=$APP.config['SECRET_KEY'], ...)
- pattern: hashids.Hashids($APP.config['SECRET_KEY'], ...)
severity: ERROR
- id: python.lang.security.use-defused-xml-parse.use-defused-xml-parse
metadata:
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
references:
- https://docs.python.org/3/library/xml.html
- https://github.com/tiran/defusedxml
- https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
category: security
technology:
- python
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse
shortlink: https://sg.run/n3jG
semgrep.dev:
rule:
r_id: 72436
rv_id: 1263541
rule_id: X5Uqnx
version_id: vdT06ER
url: https://semgrep.dev/playground/r/vdT06ER/python.lang.security.use-defused-xml-parse.use-defused-xml-parse
origin: community
message: The native Python `xml` library is vulnerable to XML External Entity (XXE)
attacks. These attacks can leak confidential data and "XML bombs" can cause denial
of service. Do not use this library to parse untrusted input. Instead the Python
documentation recommends using `defusedxml`.
languages:
- python
severity: ERROR
patterns:
- pattern: xml.etree.ElementTree.parse($...ARGS)
- pattern-not: xml.etree.ElementTree.parse("...")
fix: defusedxml.etree.ElementTree.parse($...ARGS)
- id: php.lang.security.tainted-exec.tainted-exec
mode: taint
pattern-sources:
- pattern: $_REQUEST
- pattern: $_GET
- pattern: $_POST
- pattern: $_COOKIE
pattern-sinks:
- pattern: exec(...)
- pattern: system(...)
- pattern: popen(...)
- pattern: passthru(...)
- pattern: shell_exec(...)
- pattern: pcntl_exec(...)
- pattern: proc_open(...)
pattern-sanitizers:
- pattern: escapeshellarg(...)
message: Executing non-constant commands. This can lead to command injection. You
should use `escapeshellarg()` when using command.
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
references:
- https://www.stackhawk.com/blog/php-command-injection/
- https://brightsec.com/blog/code-injection-php/
- https://www.acunetix.com/websitesecurity/php-security-2/
category: security
technology:
- php
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/php.lang.security.tainted-exec.tainted-exec
shortlink: https://sg.run/JAkP
semgrep.dev:
rule:
r_id: 73146
rv_id: 1263300
rule_id: 9AUw06
version_id: BjTkZ4y
url: https://semgrep.dev/playground/r/BjTkZ4y/php.lang.security.tainted-exec.tainted-exec
origin: community
languages:
- php
severity: ERROR
- id: php.lang.security.injection.tainted-session.tainted-session
severity: WARNING
message: Session key based on user input risks session poisoning. The user can determine
the key used for the session, and thus write any session variable. Session variables
are typically trusted to be set only by the application, and manipulating the
session can result in access control issues.
metadata:
technology:
- php
category: security
cwe:
- 'CWE-284: Improper Access Control'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://en.wikipedia.org/wiki/Session_poisoning
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/php.lang.security.injection.tainted-session.tainted-session
shortlink: https://sg.run/bxNp
semgrep.dev:
rule:
r_id: 73470
rv_id: 1263289
rule_id: 4bUdoP
version_id: 8KT5rPE
url: https://semgrep.dev/playground/r/8KT5rPE/php.lang.security.injection.tainted-session.tainted-session
origin: community
languages:
- php
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: $_GET
- pattern: $_POST
- pattern: $_COOKIE
- pattern: $_REQUEST
pattern-sanitizers:
- patterns:
- pattern-either:
- pattern: $A . $B
- pattern: bin2hex(...)
- pattern: crc32(...)
- pattern: crypt(...)
- pattern: filter_input(...)
- pattern: filter_var(...)
- pattern: hash(...)
- pattern: md5(...)
- pattern: preg_filter(...)
- pattern: preg_grep(...)
- pattern: preg_match_all(...)
- pattern: sha1(...)
- pattern: sprintf(...)
- pattern: str_contains(...)
- pattern: str_ends_with(...)
- pattern: str_starts_with(...)
- pattern: strcasecmp(...)
- pattern: strchr(...)
- pattern: stripos(...)
- pattern: stristr(...)
- pattern: strnatcasecmp(...)
- pattern: strnatcmp(...)
- pattern: strncmp(...)
- pattern: strpbrk(...)
- pattern: strpos(...)
- pattern: strripos(...)
- pattern: strrpos(...)
- pattern: strspn(...)
- pattern: strstr(...)
- pattern: strtok(...)
- pattern: substr_compare(...)
- pattern: substr_count(...)
- pattern: vsprintf(...)
pattern-sinks:
- patterns:
- pattern-inside: $_SESSION[$KEY] = $VAL;
- pattern: $KEY
- id: python.django.security.django-no-csrf-token.django-no-csrf-token
patterns:
- pattern: <form...>...</form>
- pattern-either:
- pattern: |
<form ... method="$METHOD" ...>...</form>
- pattern: |
<form ... method='$METHOD' ...>...</form>
- pattern: |
<form ... method=$METHOD ...>...</form>
- metavariable-regex:
metavariable: $METHOD
regex: (?i)(post|put|delete|patch)
- pattern-not-inside: <form...>...{% csrf_token %}...</form>
- pattern-not-inside: <form...>...{{ $VAR.csrf_token }}...</form>
message: Manually-created forms in django templates should specify a csrf_token
to prevent CSRF attacks.
languages:
- generic
severity: WARNING
metadata:
category: security
cwe: 'CWE-352: Cross-Site Request Forgery (CSRF)'
references:
- https://docs.djangoproject.com/en/4.2/howto/csrf/
confidence: MEDIUM
likelihood: MEDIUM
impact: MEDIUM
subcategory:
- audit
technology:
- django
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site Request Forgery (CSRF)
source: https://semgrep.dev/r/python.django.security.django-no-csrf-token.django-no-csrf-token
shortlink: https://sg.run/N0Bp
semgrep.dev:
rule:
r_id: 73471
rv_id: 946160
rule_id: PeUyYG
version_id: BjT1NRl
url: https://semgrep.dev/playground/r/BjT1NRl/python.django.security.django-no-csrf-token.django-no-csrf-token
origin: community
paths:
include:
- '*.html'
- id: python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid
patterns:
- pattern-inside: |
def $FUNC(request, ...):
...
- pattern-inside: |
if $FORM.is_valid():
...
- pattern-either:
- pattern: request.POST[...]
- pattern: request.POST.get(...)
message: Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid()
has been executed to only access sanitized data
languages:
- python
severity: WARNING
metadata:
category: security
cwe: 'CWE-20: Improper Input Validation'
references:
- https://docs.djangoproject.com/en/4.2/ref/forms/api/#accessing-clean-data
confidence: MEDIUM
likelihood: MEDIUM
impact: MEDIUM
subcategory:
- audit
technology:
- django
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Validation
source: https://semgrep.dev/r/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid
shortlink: https://sg.run/kJn7
semgrep.dev:
rule:
r_id: 73472
rv_id: 946161
rule_id: JDUjqx
version_id: DkTNpEJ
url: https://semgrep.dev/playground/r/DkTNpEJ/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid
origin: community
- id: yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions
patterns:
- pattern: |
"*"
- pattern-inside: |
resources: $A
...
- pattern-inside: |
verbs: $A
...
- pattern-inside: |
- apiGroups: [""]
...
- pattern-inside: |
apiVersion: rbac.authorization.k8s.io/v1
...
- pattern-inside: |
kind: ClusterRole
...
message: 'Semgrep detected a Kubernetes core API ClusterRole with excessive permissions.
Attaching excessive permissions to a ClusterRole associated with the core namespace
allows the V1 API to perform arbitrary actions on arbitrary resources attached
to the cluster. Prefer explicit allowlists of verbs/resources when configuring
the core API namespace. '
languages:
- yaml
severity: WARNING
metadata:
cwe:
- 'CWE-269: Improper Privilege Management'
owasp:
- A05:2021 - Security Misconfiguration
- A06:2017 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
references:
- https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole
- https://kubernetes.io/docs/concepts/security/rbac-good-practices/#general-good-practice
- https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#api-groups
category: security
technology:
- kubernetes
cwe2021-top25: false
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions
shortlink: https://sg.run/x6Dz
semgrep.dev:
rule:
r_id: 73474
rv_id: 1263935
rule_id: GdUR2A
version_id: 9lT4bw7
url: https://semgrep.dev/playground/r/9lT4bw7/yaml.kubernetes.security.legacy-api-clusterrole-excessive-permissions.legacy-api-clusterrole-excessive-permissions
origin: community
- id: ocaml.lang.security.unsafe.ocamllint-unsafe
pattern-either:
- pattern: $X.unsafe_get
- pattern: $X.unsafe_set
- pattern: $X.unsafe_to_string
- pattern: $X.unsafe_of_string
- pattern: $X.unsafe_blit
- pattern: $X.unsafe_blit_string
- pattern: $X.unsafe_fill
- pattern: $X.unsafe_to_string
- pattern: $X.unsafe_getenv
- pattern: $X.unsafe_environment
- pattern: $X.unsafe_chr
- pattern: $X.unsafe_of_int
- pattern: $X.unsafe_output
- pattern: $X.unsafe_output_string
- pattern: $X.unsafe_read
- pattern: $X.unsafe_recv
- pattern: $X.unsafe_recvfrom
- pattern: $X.unsafe_send
- pattern: $X.unsafe_sendto
- pattern: $X.unsafe_set
- pattern: $X.unsafe_set_int16
- pattern: $X.unsafe_set_int32
- pattern: $X.unsafe_set_int64
- pattern: $X.unsafe_set_int8
- pattern: $X.unsafe_set_uint16_ne
- pattern: $X.unsafe_set_uint8
- pattern: $X.unsafe_single_write
- pattern: $X.unsafe_string
- pattern: $X.unsafe_sub
- pattern: $X.unsafe_write
message: Unsafe functions do not perform boundary checks or have other side effects,
use with care.
languages:
- ocaml
severity: WARNING
metadata:
category: security
references:
- https://v2.ocaml.org/api/Bigarray.Array1.html#VALunsafe_get
- https://v2.ocaml.org/api/Bytes.html#VALunsafe_to_string
technology:
- ocaml
cwe: 'CWE-242: Use of Inherently Dangerous Function (4.12)'
confidence: MEDIUM
likelihood: MEDIUM
impact: MEDIUM
subcategory:
- audit
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/ocaml.lang.security.unsafe.ocamllint-unsafe
shortlink: https://sg.run/d8K80
semgrep.dev:
rule:
r_id: 92978
rv_id: 945981
rule_id: 6JUvjv6
version_id: zyTlkwv
url: https://semgrep.dev/playground/r/zyTlkwv/ocaml.lang.security.unsafe.ocamllint-unsafe
origin: community
- id: python.fastapi.security.wildcard-cors.wildcard-cors
languages:
- python
message: CORS policy allows any origin (using wildcard '*'). This is insecure and
should be avoided.
mode: taint
pattern-sources:
- pattern: '[..., "*", ...]'
pattern-sinks:
- patterns:
- pattern: |
$APP.add_middleware(
CORSMiddleware,
allow_origins=$ORIGIN,
...);
- focus-metavariable: $ORIGIN
severity: WARNING
metadata:
cwe:
- 'CWE-942: Permissive Cross-domain Policy with Untrusted Domains'
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
category: security
technology:
- python
- fastapi
references:
- https://owasp.org/Top10/A05_2021-Security_Misconfiguration
- https://cwe.mitre.org/data/definitions/942.html
likelihood: HIGH
impact: LOW
confidence: MEDIUM
vulnerability_class:
- Configuration
subcategory:
- vuln
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/python.fastapi.security.wildcard-cors.wildcard-cors
shortlink: https://sg.run/KxApY
semgrep.dev:
rule:
r_id: 112311
rv_id: 1263413
rule_id: lBU4JQ3
version_id: A8Tgd1R
url: https://semgrep.dev/playground/r/A8Tgd1R/python.fastapi.security.wildcard-cors.wildcard-cors
origin: community
- id: go.lang.security.injection.open-redirect.open-redirect
languages:
- go
severity: WARNING
message: An HTTP redirect was found to be crafted from user-input `$REQUEST`. This
can lead to open redirect vulnerabilities, potentially allowing attackers to redirect
users to malicious web sites. It is recommend where possible to not allow user-input
to craft the redirect URL. When user-input is necessary to craft the request,
it is recommended to follow OWASP best practices to restrict the URL to domains
in an allowlist.
options:
interfile: true
metadata:
cwe:
- 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')'
references:
- https://knowledge-base.secureflag.com/vulnerabilities/unvalidated_redirects___forwards/open_redirect_go_lang.html
category: security
technology:
- go
confidence: HIGH
description: An HTTP redirect was found to be crafted from user-input leading
to an open redirect vulnerability
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Open Redirect
source: https://semgrep.dev/r/go.lang.security.injection.open-redirect.open-redirect
shortlink: https://sg.run/2ZW45
semgrep.dev:
rule:
r_id: 113619
rv_id: 945608
rule_id: DbU6RlN
version_id: GxTP7J7
url: https://semgrep.dev/playground/r/GxTP7J7/go.lang.security.injection.open-redirect.open-redirect
origin: community
mode: taint
pattern-sources:
- label: INPUT
patterns:
- pattern-either:
- pattern: |
($REQUEST : *http.Request).$ANYTHING
- pattern: |
($REQUEST : http.Request).$ANYTHING
- metavariable-regex:
metavariable: $ANYTHING
regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
- label: CLEAN
requires: INPUT
patterns:
- pattern-either:
- pattern: |
"$URLSTR" + $INPUT
- patterns:
- pattern-either:
- pattern: fmt.Fprintf($F, "$URLSTR", $INPUT, ...)
- pattern: fmt.Sprintf("$URLSTR", $INPUT, ...)
- pattern: fmt.Printf("$URLSTR", $INPUT, ...)
- metavariable-regex:
metavariable: $URLSTR
regex: .*//[a-zA-Z0-10]+\..*
pattern-sinks:
- requires: INPUT and not CLEAN
patterns:
- pattern: http.Redirect($W, $REQ, $URL, ...)
- focus-metavariable: $URL
- id: php.lang.security.base-convert-loses-precision.base-convert-loses-precision
message: The function base_convert uses 64-bit numbers internally, and does not
correctly convert large numbers. It is not suitable for random tokens such as
those used for session tokens or CSRF tokens.
metadata:
references:
- https://www.php.net/base_convert
- https://www.sjoerdlangkemper.nl/2017/03/15/dont-use-base-convert-on-random-tokens/
category: security
technology:
- php
cwe:
- 'CWE-190: Integer Overflow or Wraparound'
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/php.lang.security.base-convert-loses-precision.base-convert-loses-precision
shortlink: https://sg.run/kxpGo
semgrep.dev:
rule:
r_id: 115928
rv_id: 945988
rule_id: 7KUgBAk
version_id: yeT0n4K
url: https://semgrep.dev/playground/r/yeT0n4K/php.lang.security.base-convert-loses-precision.base-convert-loses-precision
origin: community
languages:
- php
severity: WARNING
mode: taint
pattern-sources:
- pattern: hash(...)
- pattern: hash_hmac(...)
- pattern: sha1(...)
- pattern: md5(...)
- patterns:
- pattern: random_bytes($N)
- metavariable-comparison:
metavariable: $N
comparison: $N > 7
- patterns:
- pattern: openssl_random_pseudo_bytes($N)
- metavariable-comparison:
metavariable: $N
comparison: $N > 7
- patterns:
- pattern: $OBJ->get_random_bytes($N)
- metavariable-comparison:
metavariable: $N
comparison: $N > 7
pattern-sinks:
- pattern: base_convert(...)
pattern-sanitizers:
- patterns:
- pattern: substr(..., $LENGTH)
- metavariable-comparison:
metavariable: $LENGTH
comparison: $LENGTH <= 7
- id: javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify
message: Detected the decoding of a JWT token without a verify step. JWT tokens
must be verified before use, otherwise the token's integrity is unknown. This
means a malicious actor could forge a JWT token with any claims. Set 'verify'
to `true` before using the token.
severity: ERROR
metadata:
owasp:
- A05:2021 - Security Misconfiguration
- A07:2021 - Identification and Authentication Failures
- A02:2025 - Security Misconfiguration
- A07:2025 - Authentication Failures
cwe:
- 'CWE-287: Improper Authentication'
- 'CWE-345: Insufficient Verification of Data Authenticity'
- 'CWE-347: Improper Verification of Cryptographic Signature'
category: security
subcategory:
- vuln
technology:
- jwt-simple
- jwt
confidence: HIGH
likelihood: MEDIUM
impact: HIGH
references:
- https://www.npmjs.com/package/jwt-simple
- https://cwe.mitre.org/data/definitions/287
- https://cwe.mitre.org/data/definitions/345
- https://cwe.mitre.org/data/definitions/347
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
- Improper Authentication
source: https://semgrep.dev/r/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify
shortlink: https://sg.run/zdjod
semgrep.dev:
rule:
r_id: 120561
rv_id: 1263191
rule_id: r6UyNLy
version_id: 3ZT4Xxv
url: https://semgrep.dev/playground/r/3ZT4Xxv/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify
origin: community
languages:
- javascript
- typescript
patterns:
- pattern-inside: |
$JWT = require('jwt-simple');
...
- pattern: $JWT.decode($TOKEN, $SECRET, $NOVERIFY, ...)
- metavariable-pattern:
metavariable: $NOVERIFY
patterns:
- pattern-either:
- pattern: |
true
- pattern: |
"..."
- id: php.lang.security.injection.printed-request.printed-request
mode: taint
message: '`Printing user input risks cross-site scripting vulnerability. You should
use `htmlentities()` when showing data to users.'
languages:
- php
severity: ERROR
pattern-sources:
- pattern: $_REQUEST
- pattern: $_GET
- pattern: $_POST
pattern-sinks:
- pattern: print($...VARS);
pattern-sanitizers:
- pattern: htmlentities(...)
- pattern: htmlspecialchars(...)
- pattern: strip_tags(...)
- pattern: isset(...)
- pattern: empty(...)
- pattern: esc_html(...)
- pattern: esc_attr(...)
- pattern: wp_kses(...)
- pattern: e(...)
- pattern: twig_escape_filter(...)
- pattern: xss_clean(...)
- pattern: html_escape(...)
- pattern: Html::escape(...)
- pattern: Xss::filter(...)
- pattern: escapeHtml(...)
- pattern: escapeHtml(...)
- pattern: escapeHtmlAttr(...)
fix: print(htmlentities($...VARS));
metadata:
technology:
- php
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
references:
- https://www.php.net/manual/en/function.htmlentities.php
- https://www.php.net/manual/en/reserved.variables.request.php
- https://www.php.net/manual/en/reserved.variables.post.php
- https://www.php.net/manual/en/reserved.variables.get.php
- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/php.lang.security.injection.printed-request.printed-request
shortlink: https://sg.run/QrxEJ
semgrep.dev:
rule:
r_id: 128886
rv_id: 1263284
rule_id: KxUvRBw
version_id: ZRTKAk4
url: https://semgrep.dev/playground/r/ZRTKAk4/php.lang.security.injection.printed-request.printed-request
origin: community
- id: go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone
patterns:
- pattern-inside: |
&sessions.Options{
...,
SameSite: http.SameSiteNoneMode,
...,
}
- pattern: |
&sessions.Options{
...,
}
message: Found SameSiteNoneMode setting in Gorilla session options. Consider setting
SameSite to Lax, Strict or Default for enhanced security.
metadata:
cwe:
- 'CWE-1275: Sensitive Cookie with Improper SameSite Attribute'
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
references:
- https://pkg.go.dev/github.com/gorilla/sessions#Options
category: security
technology:
- gorilla
confidence: MEDIUM
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cookie Security
source: https://semgrep.dev/r/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone
shortlink: https://sg.run/x8Nwj
semgrep.dev:
rule:
r_id: 133074
rv_id: 1262913
rule_id: YGUpGd4
version_id: K3TKkKB
url: https://semgrep.dev/playground/r/K3TKkKB/go.gorilla.security.audit.session-cookie-samesitenone.session-cookie-samesitenone
origin: community
fix-regex:
regex: (SameSite\s*:\s+)http.SameSiteNoneMode
replacement: \1http.SameSiteDefaultMode
severity: WARNING
languages:
- go
- id: solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx
languages:
- solidity
message: Missing check for 'from' and 'to' being the same before updating balances
could lead to incorrect balance manipulation on self-transfers. Include a check
to ensure 'from' and 'to' are not the same before updating balances to prevent
balance manipulation during self-transfers.
severity: ERROR
metadata:
category: security
technology:
- blockchain
- solidity
cwe: 'CWE-682: Incorrect Calculation'
subcategory:
- vuln
confidence: HIGH
likelihood: HIGH
impact: HIGH
owasp:
- A7:2021 Identification and Authentication Failures
references:
- https://blog.verichains.io/p/miner-project-attacked-by-vulnerabilities
- https://x.com/shoucccc/status/1757777764646859121
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx
shortlink: https://sg.run/Or6X7
semgrep.dev:
rule:
r_id: 133075
rv_id: 946620
rule_id: 6JUv7Nz
version_id: A8TJzYz
url: https://semgrep.dev/playground/r/A8TJzYz/solidity.security.missing-self-transfer-check-ercx.missing-self-transfer-check-ercx
origin: community
patterns:
- pattern-either:
- pattern: |
_balances[$FROM] = $FROM_BALANCE - value;
- pattern: |
_balances[$TO] = $TO_BALANCE + value;
- pattern-not-inside: |
if ($FROM != $TO) {
...
_balances[$FROM] = $FROM_BALANCE - value;
...
_balances[$TO] = $TO_BALANCE + value;
...
}
- pattern-inside: |
function _update(address $FROM, address $TO, uint256 value, bool mint) internal virtual {
...
}
- id: yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication
languages:
- yaml
message: Basic authentication is considered weak and should be avoided. Use a different
authentication scheme, such of OAuth2, OpenID Connect, or mTLS.
severity: ERROR
patterns:
- pattern-inside: |
openapi: $VERSION
...
components:
...
securitySchemes:
...
$SCHEME:
...
- metavariable-regex:
metavariable: $VERSION
regex: 3.*
- pattern: |
type: http
...
scheme: basic
metadata:
category: security
subcategory:
- vuln
technology:
- openapi
likelihood: MEDIUM
impact: HIGH
confidence: HIGH
cwe: 'CWE-287: Improper Authentication'
owasp:
- A04:2021 Insecure Design
- A07:2021 Identification and Authentication Failures
references:
- https://cwe.mitre.org/data/definitions/287.html
- https://owasp.org/Top10/A04_2021-Insecure_Design/
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication
shortlink: https://sg.run/v8wNW
semgrep.dev:
rule:
r_id: 133077
rv_id: 947072
rule_id: zdUKgEX
version_id: 0bT1ErG
url: https://semgrep.dev/playground/r/0bT1ErG/yaml.openapi.security.use-of-basic-authentication.use-of-basic-authentication
origin: community
- id: python.twilio.security.twiml-injection.twiml-injection
languages:
- python
severity: WARNING
message: Using non-constant TwiML (Twilio Markup Language) argument when creating
a Twilio conversation could allow the injection of additional TwiML commands
metadata:
cwe:
- 'CWE-91: XML Injection'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- python
- twilio
- twiml
confidence: MEDIUM
likelihood: HIGH
impact: MEDIUM
subcategory:
- vuln
references:
- https://codeberg.org/fennix/funjection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/python.twilio.security.twiml-injection.twiml-injection
shortlink: https://sg.run/GdEEy
semgrep.dev:
rule:
r_id: 134692
rv_id: 1263580
rule_id: oqUgjj2
version_id: kbTzGp1
url: https://semgrep.dev/playground/r/kbTzGp1/python.twilio.security.twiml-injection.twiml-injection
origin: community
mode: taint
pattern-sources:
- pattern: |
f"..."
- pattern: |
"..." % ...
- pattern: |
"...".format(...)
- patterns:
- pattern: $ARG
- pattern-inside: |
def $F(..., $ARG, ...):
...
pattern-sanitizers:
- pattern: xml.sax.saxutils.escape(...)
- pattern: html.escape(...)
pattern-sinks:
- patterns:
- pattern: |
$CLIENT.calls.create(..., twiml=$SINK, ...)
- focus-metavariable: $SINK
- id: kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded
message: A secret is hard-coded in the application. Secrets stored in source code,
such as credentials, identifiers, and other types of sensitive data, can be leaked
and used by internal or external malicious actors. It is recommended to rotate
the secret and retrieve them from a secure secret vault or Hardware Security Module
(HSM), alternatively environment variables can be used if allowed by your company
policy.
severity: WARNING
metadata:
likelihood: LOW
impact: HIGH
confidence: MEDIUM
category: security
subcategory:
- vuln
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
cwe2020-top25: true
cwe2021-top25: true
cwe2022-top25: true
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
technology:
- secrets
vulnerability_class:
- Hard-coded Secrets
source_rule_url: https://semgrep.dev/playground/r/d8Ur5BA/achufistov6_personal_org.build-gradle-password-hardcoded
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded
shortlink: https://sg.run/qN29x
semgrep.dev:
rule:
r_id: 137856
rv_id: 1263257
rule_id: ReUD6Kg
version_id: DkTRbLX
url: https://semgrep.dev/playground/r/DkTRbLX/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded
origin: community
languages:
- kotlin
options:
symbolic_propagation: true
patterns:
- pattern-either:
- pattern: '$PASS = env[...] ?: $VALUE'
- metavariable-regex:
metavariable: $PASS
regex: (password|pass|passwd|loginPassword)
- metavariable-pattern:
language: generic
metavariable: $VALUE
patterns:
- pattern-either:
- pattern-regex: ^[A-Za-z0-9/+=]+$
paths:
include:
- '*build.gradle.kts'
- id: generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token
pattern-regex: (?:api_live(?:_[a-zA-Z]{2})?\.[a-zA-Z0-9-_]{11}\.[-_a-zA-Z0-9]{32})
languages:
- regex
message: Onfido live API Token detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
category: security
technology:
- secrets
- onfido
confidence: HIGH
references:
- https://documentation.onfido.com/api/latest/#api-tokens
subcategory:
- audit
likelihood: HIGH
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token
shortlink: https://sg.run/lBoKD
semgrep.dev:
rule:
r_id: 141957
rv_id: 945509
rule_id: WAUW9q3
version_id: A8TJzE2
url: https://semgrep.dev/playground/r/A8TJzE2/generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token
origin: community
- id: php.lang.security.injection.tainted-callable.tainted-callable
severity: WARNING
message: Callable based on user input risks remote code execution.
metadata:
technology:
- php
category: security
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://www.php.net/manual/en/language.types.callable.php
subcategory:
- vuln
impact: HIGH
likelihood: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/php.lang.security.injection.tainted-callable.tainted-callable
shortlink: https://sg.run/YGb33
semgrep.dev:
rule:
r_id: 141958
rv_id: 1263285
rule_id: 0oULBKK
version_id: nWT2L5x
url: https://semgrep.dev/playground/r/nWT2L5x/php.lang.security.injection.tainted-callable.tainted-callable
origin: community
languages:
- php
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: $_GET
- pattern: $_POST
- pattern: $_COOKIE
- pattern: $_REQUEST
- pattern: file_get_contents('php://input')
pattern-sinks:
- patterns:
- pattern: $CALLABLE
- pattern-either:
- pattern-inside: $ARRAYITERATOR->uasort($CALLABLE)
- pattern-inside: $ARRAYITERATOR->uksort($CALLABLE)
- pattern-inside: $EVENTHTTP->setCallback($CALLABLE, ...)
- pattern-inside: $EVENTHTTPCONNECTION->setCloseCallback($CALLABLE, ...)
- pattern-inside: $EVLOOP->fork($CALLABLE, ...)
- pattern-inside: $EVLOOP->idle($CALLABLE, ...)
- pattern-inside: $EVLOOP->prepare($CALLABLE, ...)
- pattern-inside: $EVWATCHER->setCallback($CALLABLE)
- pattern-inside: $GEARMANCLIENT->setClientCallback($CALLABLE)
- pattern-inside: $GEARMANCLIENT->setCompleteCallback($CALLABLE)
- pattern-inside: $GEARMANCLIENT->setCreatedCallback($CALLABLE)
- pattern-inside: $GEARMANCLIENT->setDataCallback($CALLABLE)
- pattern-inside: $GEARMANCLIENT->setExceptionCallback($CALLABLE)
- pattern-inside: $GEARMANCLIENT->setFailCallback($CALLABLE)
- pattern-inside: $GEARMANCLIENT->setStatusCallback($CALLABLE)
- pattern-inside: $GEARMANCLIENT->setWarningCallback($CALLABLE)
- pattern-inside: $GEARMANCLIENT->setWorkloadCallback($CALLABLE)
- pattern-inside: $IMAGICK->setProgressMonitor($CALLABLE)
- pattern-inside: $OAUTHPROVIDER->consumerHandler($CALLABLE)
- pattern-inside: $OAUTHPROVIDER->tokenHandler($CALLABLE)
- pattern-inside: $PDO->sqliteCreateCollation($NAME, $CALLABLE)
- pattern-inside: $PDOSTATEMENT->fetchAll(PDO::FETCH_FUNC, $CALLABLE)
- pattern-inside: $SQLITE3->createCollation($NAME, $CALLABLE)
- pattern-inside: $SQLITE3->setAuthorizer($CALLABLE)
- pattern-inside: $ZIPARCHIVE->registerCancelCallback($CALLABLE)
- pattern-inside: $ZIPARCHIVE->registerProgressCallback($RATE, $CALLABLE)
- pattern-inside: $ZMQDEVICE->setIdleCallback($CALLABLE, ...)
- pattern-inside: $ZMQDEVICE->setTimerCallback($CALLABLE, ...)
- pattern-inside: apcu_entry($KEY, $CALLABLE, ...)
- pattern-inside: array_filter($ARRAY, $CALLABLE, ...)
- pattern-inside: array_map($CALLABLE, ...)
- pattern-inside: array_reduce($ARRAY, $CALLABLE, ...)
- pattern-inside: array_walk_recursive($ARRAY, $CALLABLE, ...)
- pattern-inside: array_walk($ARRAY, $CALLABLE, ...)
- pattern-inside: call_user_func_array($CALLABLE, ...)
- pattern-inside: call_user_func($CALLABLE, ...)
- pattern-inside: Closure::fromCallable($CALLABLE)
- pattern-inside: createCollation($NAME, $CALLABLE)
- pattern-inside: eio_grp($CALLABLE, ...)
- pattern-inside: eio_nop($PRI, $CALLABLE, ...)
- pattern-inside: eio_sync($PRI, $CALLABLE, ...)
- pattern-inside: EvPrepare::createStopped($CALLABLE, ...)
- pattern-inside: fann_set_callback($ANN, $CALLABLE)
- pattern-inside: fdf_enum_values($FDF_DOCUMENT, $CALLABLE, ...)
- pattern-inside: forward_static_call_array($CALLABLE, ...)
- pattern-inside: forward_static_call($CALLABLE, ...)
- pattern-inside: header_register_callback($CALLABLE)
- pattern-inside: ibase_set_event_handler($CALLABLE, ...)
- pattern-inside: IntlChar::enumCharTypes($CALLABLE)
- pattern-inside: iterator_apply($ITERATOR, $CALLABLE)
- pattern-inside: ldap_set_rebind_proc($LDAP, $CALLABLE)
- pattern-inside: libxml_set_external_entity_loader($CALLABLE, ...)
- pattern-inside: new CallbackFilterIterator($ITERATOR, $CALLABLE)
- pattern-inside: new EvCheck($CALLABLE, ...)
- pattern-inside: new EventHttpRequest($CALLABLE, ...)
- pattern-inside: new EvFork($CALLABLE, ...)
- pattern-inside: new EvIdle($CALLABLE, ...)
- pattern-inside: new Fiber($CALLABLE)
- pattern-inside: new Memcached($PERSISTENT_ID, $CALLABLE, ...)
- pattern-inside: new RecursiveCallbackFilterIterator($ITERATOR, $CALLABLE)
- pattern-inside: new Zookeeper($HOST, $CALLABLE, ...)
- pattern-inside: ob_start($CALLABLE, ...)
- pattern-inside: oci_register_taf_callback($CONNECTION, $CALLABLE)
- pattern-inside: readline_callback_handler_install($PROMPT, $CALLABLE)
- pattern-inside: readline_completion_function($CALLABLE)
- pattern-inside: register_shutdown_function($CALLABLE, ...)
- pattern-inside: register_tick_function($CALLABLE, ...)
- pattern-inside: rnp_ffi_set_pass_provider($FFI, $CALLABLE)
- pattern-inside: sapi_windows_set_ctrl_handler($CALLABLE, ...)
- pattern-inside: set_error_handler($CALLABLE, ...)
- pattern-inside: set_exception_handler($CALLABLE)
- pattern-inside: setAuthorizer($CALLABLE)
- pattern-inside: spl_autoload_register($CALLABLE, ...)
- pattern-inside: uasort($ARRAY, $CALLABLE)
- pattern-inside: uksort($ARRAY, $CALLABLE)
- pattern-inside: usort($ARRAY, $CALLABLE)
- pattern-inside: xml_set_character_data_handler($PARSER, $CALLABLE)
- pattern-inside: xml_set_default_handler($PARSER, $CALLABLE)
- pattern-inside: xml_set_element_handler($PARSER, $CALLABLE, $CALLABLE)
- pattern-inside: xml_set_notation_decl_handler($PARSER, $CALLABLE)
- pattern-inside: Yar_Concurrent_Client::loop($CALLABLE, ...)
- id: dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount
message: The Dockerfile(image) mounts docker.sock to the container which may allow
an attacker already inside of the container to escape container and execute arbitrary
commands on the host machine.
languages:
- dockerfile
- yaml
severity: ERROR
metadata:
cwe:
- 'CWE-862: Missing Authorization'
- 'CWE-269: Improper Privilege Management'
confidence: HIGH
likelihood: MEDIUM
impact: HIGH
subcategory:
- audit
technology:
- dockerfile
category: security
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html
- https://redfoxsec.com/blog/insecure-volume-mounts-in-docker/
- https://blog.quarkslab.com/why-is-exposing-the-docker-socket-a-really-bad-idea.html
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount
shortlink: https://sg.run/10AAQ
semgrep.dev:
rule:
r_id: 146566
rv_id: 945266
rule_id: oqUgAAk
version_id: WrTEoEq
url: https://semgrep.dev/playground/r/WrTEoEq/dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount
origin: community
pattern-either:
- patterns:
- pattern: VOLUME $X
- metavariable-regex:
metavariable: $X
regex: /var/run/docker.sock
- patterns:
- pattern-regex: '- "/var/run/docker.sock:.*"'
- pattern-inside: |
volumes:
...
- id: go.lang.security.reverseproxy-director.reverseproxy-director
message: ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite
instead of ReverseProxy.Director.
languages:
- go
severity: WARNING
patterns:
- pattern-inside: |
import "net/http/httputil"
...
- pattern-either:
- pattern: $PROXY.Director = $FUNC
- patterns:
- pattern-inside: |
httputil.ReverseProxy{
...
}
- pattern: |
Director: $FUNC
metadata:
cwe:
- 'CWE-115: Misinterpretation of Input'
category: security
subcategory:
- audit
technology:
- go
confidence: MEDIUM
likelihood: LOW
impact: LOW
references:
- https://github.com/golang/go/issues/50580
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/go.lang.security.reverseproxy-director.reverseproxy-director
shortlink: https://sg.run/9AYYR
semgrep.dev:
rule:
r_id: 146567
rv_id: 945612
rule_id: zdUKzzA
version_id: DkTNpvx
url: https://semgrep.dev/playground/r/DkTNpvx/go.lang.security.reverseproxy-director.reverseproxy-director
origin: community
- id: javascript.node-crypto.security.aead-no-final.aead-no-final
message: The 'final' call of a Decipher object checks the authentication tag in
a mode for authenticated encryption. Failing to call 'final' will invalidate all
integrity guarantees of the released ciphertext.
metadata:
cwe:
- 'CWE-310: CWE CATEGORY: Cryptographic Issues'
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
category: security
subcategory:
- vuln
technology:
- node-crypto
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
references:
- https://nodejs.org/api/crypto.html#deciphersetauthtagbuffer-encoding
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures/
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/javascript.node-crypto.security.aead-no-final.aead-no-final
shortlink: https://sg.run/r6EEA
semgrep.dev:
rule:
r_id: 146569
rv_id: 1263222
rule_id: 2ZUz884
version_id: zyTb2X0
url: https://semgrep.dev/playground/r/zyTb2X0/javascript.node-crypto.security.aead-no-final.aead-no-final
origin: community
languages:
- javascript
- typescript
severity: ERROR
patterns:
- pattern: |
$DECIPHER = $CRYPTO.createDecipheriv('$ALGO', ...)
...
$DECIPHER.update(...)
- pattern-not-inside: |
$DECIPHER = $CRYPTO.createDecipheriv('$ALGO', ...)
...
$DECIPHER.final(...)
- metavariable-regex:
metavariable: $ALGO
regex: .*(-gcm|-ccm|-ocb|chacha20-poly1305)$
- id: javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv
message: The deprecated functions 'createCipher' and 'createDecipher' generate the
same initialization vector every time. For counter modes such as CTR, GCM, or
CCM this leads to break of both confidentiality and integrity, if the key is used
more than once. Other modes are still affected in their strength, though they're
not completely broken. Use 'createCipheriv' or 'createDecipheriv' instead.
metadata:
cwe:
- 'CWE-1204: Generation of Weak Initialization Vector (IV)'
category: security
subcategory:
- vuln
technology:
- node-crypto
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
references:
- https://nodejs.org/api/crypto.html#cryptocreatecipheralgorithm-password-options
- https://nodejs.org/api/crypto.html#cryptocreatedecipheralgorithm-password-options
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv
shortlink: https://sg.run/bw33r
semgrep.dev:
rule:
r_id: 146570
rv_id: 945898
rule_id: X5UQRR7
version_id: ZRT3510
url: https://semgrep.dev/playground/r/ZRT3510/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv
origin: community
languages:
- javascript
- typescript
severity: ERROR
patterns:
- pattern-either:
- pattern: |
$CRYPTO.createCipher(...)
- pattern: |
$CRYPTO.createDecipher(...)
- id: javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length
message: The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode
of operation is missing an expected authentication tag length. If the expected
authentication tag length is not specified or otherwise checked, the application
might be tricked into verifying a shorter-than-expected authentication tag. This
can be abused by an attacker to spoof ciphertexts or recover the implicit authentication
key of GCM, allowing arbitrary forgeries.
metadata:
cwe:
- 'CWE-310: CWE CATEGORY: Cryptographic Issues'
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
category: security
subcategory:
- vuln
technology:
- node-crypto
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
references:
- https://www.securesystems.de/blog/forging_ciphertexts_under_Galois_Counter_Mode_for_the_Node_js_crypto_module/
- https://nodejs.org/api/crypto.html#cryptocreatedecipherivalgorithm-key-iv-options
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures/
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length
shortlink: https://sg.run/NbGG1
semgrep.dev:
rule:
r_id: 146571
rv_id: 1263223
rule_id: j2UgPP3
version_id: pZT03qd
url: https://semgrep.dev/playground/r/pZT03qd/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length
origin: community
languages:
- javascript
- typescript
severity: ERROR
patterns:
- pattern: |
$CRYPTO.createDecipheriv('$ALGO', $KEY, $IV)
- metavariable-regex:
metavariable: $ALGO
regex: .*(-gcm)$
- id: php.lang.security.injection.tainted-exec.tainted-exec
languages:
- php
severity: WARNING
message: User input is passed to a function that executes a shell command. This
can lead to remote code execution.
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
category: security
technology:
- php
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
subcategory:
- vuln
impact: HIGH
likelihood: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/php.lang.security.injection.tainted-exec.tainted-exec
shortlink: https://sg.run/kxEEz
semgrep.dev:
rule:
r_id: 146572
rv_id: 1263286
rule_id: 10UOGG5
version_id: ExTExyR
url: https://semgrep.dev/playground/r/ExTExyR/php.lang.security.injection.tainted-exec.tainted-exec
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: $_GET
- pattern: $_POST
- pattern: $_COOKIE
- pattern: $_REQUEST
- pattern: file_get_contents('php://input')
pattern-sanitizers:
- patterns:
- pattern-either:
- pattern: escapeshellcmd(...)
- pattern: escapeshellarg(...)
pattern-sinks:
- patterns:
- pattern-either:
- pattern: exec(...)
- pattern: system(...)
- pattern: passthru(...)
- patterns:
- pattern: proc_open(...)
- pattern-not: proc_open([...], ...)
- pattern: popen(...)
- pattern: expect_popen(...)
- pattern: shell_exec(...)
- pattern: |
`...`
- id: yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false
languages:
- yaml
message: 'Found ''x-openai-isConsequential: false'' in a state-changing HTTP method:
$METHOD $PATH. This Action configuration will enable the ''Always Allow'' option
for state-changing HTTP methods, such as POST, PUT, PATCH, or DELETE. The risk
of a user selecting the ''Always Allow'' button is that the agent could perform
unintended actions on behalf of the user. When working with sensitive functionality,
it is always best to include a Human In The Loop (HITL) type of control. Consider
the trade-off between security and user friction and then make a risk-based decision
about this function.'
severity: WARNING
pattern-either:
- pattern-inside: |
post:
...
x-openai-isConsequential: false
- pattern-inside: |
put:
...
x-openai-isConsequential: false
- pattern-inside: |
patch:
...
x-openai-isConsequential: false
- pattern-inside: |
delete:
...
x-openai-isConsequential: false
metadata:
category: security
subcategory:
- audit
technology:
- openapi
- openai
likelihood: HIGH
impact: HIGH
confidence: HIGH
cwe: 'CWE-441: Unintended Proxy or Intermediary (''Confused Deputy'')'
owasp:
- A04:2021 Insecure Design
- LLM08:2023 - Excessive Agency
references:
- https://platform.openai.com/docs/actions/consequential-flag
- https://owasp.org/Top10/A04_2021-Insecure_Design/
- https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-2023-v1_1.pdf
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false
shortlink: https://sg.run/x8EEP
semgrep.dev:
rule:
r_id: 146574
rv_id: 947071
rule_id: yyURooD
version_id: WrTEZN8
url: https://semgrep.dev/playground/r/WrTEZN8/yaml.openapi.security.openai-consequential-action-false.openai-consequential-action-false
origin: community
- id: python.lang.security.insecure-uuid-version.insecure-uuid-version
patterns:
- pattern: uuid.uuid1(...)
message: Using UUID version 1 for UUID generation can lead to predictable UUIDs
based on system information (e.g., MAC address, timestamp). This may lead to security
risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better
randomness and security.
metadata:
references:
- https://www.landh.tech/blog/20230811-sandwich-attack/
cwe:
- 'CWE-330: Use of Insufficiently Random Values'
owasp:
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.3.2 Insecure UUID Generation
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v63-random-values
version: '4'
category: security
technology:
- python
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.lang.security.insecure-uuid-version.insecure-uuid-version
shortlink: https://sg.run/BYBgW
semgrep.dev:
rule:
r_id: 148295
rv_id: 1263539
rule_id: kxUd1yD
version_id: O9Tpx97
url: https://semgrep.dev/playground/r/O9Tpx97/python.lang.security.insecure-uuid-version.insecure-uuid-version
origin: community
languages:
- python
severity: WARNING
fix-regex:
regex: uuid1
replacement: uuid4
- id: go.lang.security.audit.crypto.sha224-hash.sha224-hash
pattern-either:
- patterns:
- pattern-inside: |
import "crypto/sha256"
...
- pattern-either:
- pattern: |
sha256.New224()
- pattern: |
sha256.Sum224(...)
- patterns:
- pattern-inside: |
import "golang.org/x/crypto/sha3"
...
- pattern-either:
- pattern: |
sha3.New224()
- pattern: |
sha3.Sum224(...)
message: This code uses a 224-bit hash function, which is deprecated or disallowed
in some security policies. Consider updating to a stronger hash function such
as SHA-384 or higher to ensure compliance and security.
languages:
- go
severity: WARNING
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-328: Use of Weak Hash'
category: security
technology:
- go
references:
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf
- https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography
subcategory:
- vuln
likelihood: LOW
impact: LOW
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/go.lang.security.audit.crypto.sha224-hash.sha224-hash
shortlink: https://sg.run/ReJwY
semgrep.dev:
rule:
r_id: 151749
rv_id: 1262925
rule_id: GdUvElR
version_id: 9lT4b4w
url: https://semgrep.dev/playground/r/9lT4b4w/go.lang.security.audit.crypto.sha224-hash.sha224-hash
origin: community
- id: java.lang.security.audit.crypto.use-of-sha224.use-of-sha224
message: This code uses a 224-bit hash function, which is deprecated or disallowed
in some security policies. Consider updating to a stronger hash function such
as SHA-384 or higher to ensure compliance and security.
languages:
- java
severity: WARNING
metadata:
functional-categories:
- crypto::search::hash-algorithm::javax.crypto
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-328: Use of Weak Hash'
asvs:
section: V6 Stored Cryptography Verification Requirements
control_id: 6.2.5 Insecure Algorithm
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
version: '4'
category: security
technology:
- java
references:
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf
- https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography
subcategory:
- vuln
likelihood: LOW
impact: LOW
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha224.use-of-sha224
shortlink: https://sg.run/Ab2KQ
semgrep.dev:
rule:
r_id: 151750
rv_id: 1263017
rule_id: ReUDGEz
version_id: YDTZewo
url: https://semgrep.dev/playground/r/YDTZewo/java.lang.security.audit.crypto.use-of-sha224.use-of-sha224
origin: community
pattern-either:
- pattern: org.apache.commons.codec.digest.DigestUtils.getSha3_224Digest()
- pattern: org.apache.commons.codec.digest.DigestUtils.getSha512_224Digest()
- pattern: org.apache.commons.codec.digest.DigestUtils.sha3_224(...)
- pattern: org.apache.commons.codec.digest.DigestUtils.sha3_224Hex(...)
- pattern: org.apache.commons.codec.digest.DigestUtils.sha512_224(...)
- pattern: org.apache.commons.codec.digest.DigestUtils.sha512_224Hex(...)
- pattern: new org.apache.commons.codec.digest.DigestUtils(org.apache.commons.codec.digest.MessageDigestAlgorithms.SHA_224)
- pattern: new org.apache.commons.codec.digest.DigestUtils(org.apache.commons.codec.digest.MessageDigestAlgorithms.SHA_512_224)
- pattern: new org.apache.commons.codec.digest.DigestUtils(org.apache.commons.codec.digest.MessageDigestAlgorithms.SHA3_224)
- patterns:
- pattern: java.security.MessageDigest.getInstance("$ALGO", ...);
- metavariable-regex:
metavariable: $ALGO
regex: .*224
- id: php.lang.security.audit.sha224-hash.sha224-hash
pattern-either:
- pattern: hash('sha224', ...);
- pattern: hash('sha512/224', ...);
- pattern: hash('sha3-224', ...);
- pattern: hash_hmac('sha224', ...);
- pattern: hash_hmac('sha512/224', ...);
- pattern: hash_hmac('sha3-224', ...);
message: This code uses a 224-bit hash function, which is deprecated or disallowed
in some security policies. Consider updating to a stronger hash function such
as SHA-384 or higher to ensure compliance and security.
metadata:
cwe:
- 'CWE-328: Use of Weak Hash'
references:
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf
- https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography
category: security
technology:
- php
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/php.lang.security.audit.sha224-hash.sha224-hash
shortlink: https://sg.run/BYXqv
semgrep.dev:
rule:
r_id: 151751
rv_id: 1263275
rule_id: AbU97EA
version_id: bZT53Jo
url: https://semgrep.dev/playground/r/bZT53Jo/php.lang.security.audit.sha224-hash.sha224-hash
origin: community
languages:
- php
severity: WARNING
- id: python.lang.security.audit.sha224-hash.sha224-hash
message: This code uses a 224-bit hash function, which is deprecated or disallowed
in some security policies. Consider updating to a stronger hash function such
as SHA-384 or higher to ensure compliance and security.
metadata:
cwe:
- 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
references:
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf
- https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography
category: security
technology:
- python
subcategory:
- vuln
likelihood: LOW
impact: LOW
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/python.lang.security.audit.sha224-hash.sha224-hash
shortlink: https://sg.run/Db1Yv
semgrep.dev:
rule:
r_id: 151752
rv_id: 1263511
rule_id: BYUX0y9
version_id: 5PTo1QL
url: https://semgrep.dev/playground/r/5PTo1QL/python.lang.security.audit.sha224-hash.sha224-hash
origin: community
severity: WARNING
languages:
- python
pattern-either:
- pattern: hashlib.sha224(...)
- pattern: hashlib.sha3_224(...)
- id: ruby.lang.security.audit.sha224-hash.sha224-hash
message: This code uses a 224-bit hash function, which is deprecated or disallowed
in some security policies. Consider updating to a stronger hash function such
as SHA-384 or higher to ensure compliance and security.
metadata:
cwe:
- 'CWE-328: Use of Weak Hash'
references:
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf
- https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography
category: security
technology:
- ruby
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
subcategory:
- vuln
likelihood: LOW
impact: LOW
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Insecure Hashing Algorithm
source: https://semgrep.dev/r/ruby.lang.security.audit.sha224-hash.sha224-hash
shortlink: https://sg.run/WABbo
semgrep.dev:
rule:
r_id: 151753
rv_id: 1263592
rule_id: DbU60wQ
version_id: 8KT5rRY
url: https://semgrep.dev/playground/r/8KT5rRY/ruby.lang.security.audit.sha224-hash.sha224-hash
origin: community
languages:
- ruby
severity: WARNING
pattern-either:
- pattern: Digest::SHA224.$FUNC
- pattern: OpenSSL::Digest::SHA224.$FUNC
- pattern: SHA3::Digest::SHA224(...)
- patterns:
- pattern-either:
- pattern: OpenSSL::HMAC.hexdigest("$ALGO", ...)
- pattern: OpenSSL::HMAC.digest("$ALGO", ...)
- pattern: OpenSSL::HMAC.new($KEY, "$ALGO")
- pattern: OpenSSL::Digest.digest("$ALGO", ...)
- pattern: OpenSSL::Digest.new("$ALGO", ...)
- metavariable-regex:
metavariable: $ALGO
regex: .*224
- id: terraform.gcp.security.gcp-sql-database-ssl-insecure-value-postgres-mysql.gcp-sql-database-ssl-insecure-value-postgres-mysql
patterns:
- pattern-inside: |
resource "google_sql_database_instance" "..." {
...
database_version = "$DB"
...
}
- pattern-inside: |
resource "google_sql_database_instance" "..." {
...
ip_configuration {
...
ssl_mode = $VALUE
...
}
...
}
- pattern-not-inside: |
resource "google_sql_database_instance" "..." {
...
ip_configuration {
...
ssl_mode = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
...
}
...
}
- metavariable-regex:
metavariable: $DB
regex: .*(MYSQL|POSTGRES).*
- focus-metavariable: $VALUE
fix: |
"TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
message: Ensure all Cloud SQL database instance require incoming connections to
use SSL. To enable this for PostgresSQL and MySQL, use `ssl_mode="TRUSTED_CLIENT_CERTIFICATE_REQUIRED"`.
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-326: Inadequate Encryption Strength'
category: security
technology:
- terraform
- gcp
references:
- https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1/instances#ipconfiguration
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.gcp.security.gcp-sql-database-ssl-insecure-value-postgres-mysql.gcp-sql-database-ssl-insecure-value-postgres-mysql
shortlink: https://sg.run/WANR2
semgrep.dev:
rule:
r_id: 153509
rv_id: 1263874
rule_id: 5rUdGAz
version_id: 2KTv22E
url: https://semgrep.dev/playground/r/2KTv22E/terraform.gcp.security.gcp-sql-database-ssl-insecure-value-postgres-mysql.gcp-sql-database-ssl-insecure-value-postgres-mysql
origin: community
languages:
- hcl
severity: WARNING
- id: terraform.gcp.security.gcp-sql-database-ssl-insecure-value-sqlserver.gcp-sql-database-ssl-insecure-value-sqlserver
patterns:
- pattern-inside: |
resource "google_sql_database_instance" "..." {
...
database_version = "$DB"
...
}
- pattern-inside: |
resource "google_sql_database_instance" "..." {
...
ip_configuration {
...
ssl_mode = $VALUE
...
}
...
}
- pattern-not-inside: |
resource "google_sql_database_instance" "..." {
...
ip_configuration {
...
ssl_mode = "ENCRYPTED_ONLY"
...
}
...
}
- metavariable-regex:
metavariable: $DB
regex: .*(SQLSERVER).*
- focus-metavariable: $VALUE
fix: |
"ENCRYPTED_ONLY"
message: Ensure all Cloud SQL database instance require incoming connections to
use SSL. For SQL Server, `ssl_mode="ENCRYPTED_ONLY"` is the most secure value
that is supported.
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
- A04:2025 - Cryptographic Failures
cwe:
- 'CWE-326: Inadequate Encryption Strength'
category: security
technology:
- terraform
- gcp
references:
- https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1/instances#ipconfiguration
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
source: https://semgrep.dev/r/terraform.gcp.security.gcp-sql-database-ssl-insecure-value-sqlserver.gcp-sql-database-ssl-insecure-value-sqlserver
shortlink: https://sg.run/0o92j
semgrep.dev:
rule:
r_id: 153510
rv_id: 1263875
rule_id: GdUvX6A
version_id: X0Tzyyl
url: https://semgrep.dev/playground/r/X0Tzyyl/terraform.gcp.security.gcp-sql-database-ssl-insecure-value-sqlserver.gcp-sql-database-ssl-insecure-value-sqlserver
origin: community
languages:
- hcl
severity: WARNING
- id: python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true
message: Function `flask.url_for` with `_external=True` argument will generate URLs
using the `Host` header of the HTTP request, which may lead to security risks
such as Host header injection
metadata:
cwe:
- 'CWE-673: External Influence of Sphere Definition'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- flask
references:
- https://flask.palletsprojects.com/en/latest/api/#flask.url_for
- https://portswigger.net/kb/issues/00500300_host-header-injection
subcategory:
- audit
likelihood: MEDIUM
impact: LOW
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true
shortlink: https://sg.run/gEGeR
semgrep.dev:
rule:
r_id: 191541
rv_id: 1263418
rule_id: JDU5oql
version_id: K3TKk6n
url: https://semgrep.dev/playground/r/K3TKk6n/python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-not: flask.url_for(..., _external=False, ...)
- pattern-not: url_for(..., _external=False, ...)
- pattern-either:
- pattern: flask.url_for(..., _external=$VAR, ...)
- pattern: url_for(..., _external=$VAR, ...)
- id: php.wordpress-plugins.security.audit.wp-ssrf-audit.wp-ssrf-audit
languages:
- php
severity: WARNING
message: Detected usage of vulnerable functions with user input, which could lead
to SSRF vulnerabilities.
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: $_GET[...]
- pattern: $_POST[...]
- pattern: $_REQUEST[...]
- pattern: get_option(...)
- pattern: get_user_meta(...)
- pattern: get_query_var(...)
pattern-sinks:
- patterns:
- focus-metavariable: $URL
- pattern-either:
- pattern: wp_remote_get($URL, ...)
- pattern: wp_safe_remote_get($URL, ...)
- pattern: wp_safe_remote_request($URL, ...)
- pattern: wp_safe_remote_head($URL, ...)
- pattern: wp_oembed_get($URL, ...)
- pattern: vip_safe_wp_remote_get($URL, ...)
- pattern: wp_safe_remote_post($URL, ...)
paths:
include:
- '**/wp-content/plugins/**/*.php'
metadata:
cwe: 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp: A10:2021 - Server-Side Request Forgery (SSRF)
category: security
confidence: MEDIUM
likelihood: MEDIUM
impact: HIGH
subcategory:
- audit
technology:
- Wordpress Plugins
references:
- https://developer.wordpress.org/reference/functions/wp_safe_remote_get/
- https://developer.wordpress.org/reference/functions/wp_remote_get/
- https://patchstack.com/articles/exploring-the-unpatched-wordpress-ssrf/
vulnerability_class:
- Server-Side Request Forgery (SSRF)
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/php.wordpress-plugins.security.audit.wp-ssrf-audit.wp-ssrf-audit
shortlink: https://sg.run/K3y06
semgrep.dev:
rule:
r_id: 191611
rv_id: 1039233
rule_id: 6JUZyKX
version_id: JdTp6rq
url: https://semgrep.dev/playground/r/JdTp6rq/php.wordpress-plugins.security.audit.wp-ssrf-audit.wp-ssrf-audit
origin: community
- id: dockerfile.audit.dockerfile-pip-extra-index-url.dockerfile-pip-extra-index-url
patterns:
- pattern: |
RUN ... $PIP install ... --extra-index-url ...
- metavariable-regex:
metavariable: $PIP
regex: pip|pip3
message: 'When `--extra-index-url` is used in a `pip install` command, this is usually
meant to install a package from a package index other than the public one. However,
if a package is added with the same name to the public PyPi repository, and if
the version number is high enough, this package will be installed when building
this docker image. This package may be a malicious dependency. Such an attack
is called a dependency confusion attack. If using a private package index, prefer
to use `--index-url` if possible. '
languages:
- dockerfile
severity: INFO
metadata:
references:
- https://pip.pypa.io/en/stable/cli/pip_install/#cmdoption-extra-index-url
- https://github.com/semgrep/semgrep-rules/issues/3032
category: security
subcategory:
- audit
confidence: MEDIUM
impact: HIGH
likelihood: LOW
technology:
- docker
cwe:
- 'CWE-427: Uncontrolled Search Path Element'
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/dockerfile.audit.dockerfile-pip-extra-index-url.dockerfile-pip-extra-index-url
shortlink: https://sg.run/qk4p8
semgrep.dev:
rule:
r_id: 197112
rv_id: 1039209
rule_id: pKUkLD3
version_id: 1QTY5L3
url: https://semgrep.dev/playground/r/1QTY5L3/dockerfile.audit.dockerfile-pip-extra-index-url.dockerfile-pip-extra-index-url
origin: community
- id: yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor
languages:
- yaml
message: The Shai-hulud backdoor creates a purposefully vulnerable github action
with the name `discussion.yaml`.
paths:
include:
- '**/.github/workflows/discussion.yaml'
metadata:
category: security
cwe:
- 'CWE-509: Replicating Malicious Code (Virus or Worm)'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
technology:
- github-actions
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source_rule_url: https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
references:
- https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
source: https://semgrep.dev/r/yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor
shortlink: https://sg.run/JdYPZ
semgrep.dev:
rule:
r_id: 238946
rv_id: 1263927
rule_id: 7KUDRPj
version_id: 6xT29ol
url: https://semgrep.dev/playground/r/6xT29ol/yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor
origin: community
patterns:
- pattern-inside: 'steps: [...]'
- pattern-inside: |
- run: ...
...
- pattern: 'run: $SHELL'
- metavariable-pattern:
language: generic
metavariable: $SHELL
patterns:
- pattern-either:
- pattern: ${{ github.event.issue.title }}
- pattern: ${{ github.event.issue.body }}
- pattern: ${{ github.event.pull_request.title }}
- pattern: ${{ github.event.pull_request.body }}
- pattern: ${{ github.event.comment.body }}
- pattern: ${{ github.event.review.body }}
- pattern: ${{ github.event.review_comment.body }}
- pattern: ${{ github.event.pages. ... .page_name}}
- pattern: ${{ github.event.head_commit.message }}
- pattern: ${{ github.event.head_commit.author.email }}
- pattern: ${{ github.event.head_commit.author.name }}
- pattern: ${{ github.event.commits ... .author.email }}
- pattern: ${{ github.event.commits ... .author.name }}
- pattern: ${{ github.event.pull_request.head.ref }}
- pattern: ${{ github.event.pull_request.head.label }}
- pattern: ${{ github.event.pull_request.head.repo.default_branch }}
- pattern: ${{ github.head_ref }}
- pattern: ${{ github.event.inputs ... }}
- pattern: ${{ github.event.discussion.title }}
- pattern: ${{ github.event.discussion.body }}
- pattern: ${{ inputs ... }}
severity: ERROR
- id: go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface
languages:
- go
message: Deserializing into `interface{}` allows arbitrary data structures and types,
which can lead to security vulnerabilities (CWE-502). Use a concrete struct type
instead.
severity: WARNING
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
category: security
technology:
- go
confidence: HIGH
likelihood: MEDIUM
impact: HIGH
subcategory:
- vuln
references:
- https://cwe.mitre.org/data/definitions/502.html
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface
shortlink: https://sg.run/6WbKL
semgrep.dev:
rule:
r_id: 274359
rv_id: 1409387
rule_id: 4bUAQDG
version_id: ZRTDkjk
url: https://semgrep.dev/playground/r/ZRTDkjk/go.lang.security.deserialization.unsafe-deserialization-interface.go-unsafe-deserialization-interface
origin: community
patterns:
- pattern-either:
- pattern: |
var $VAR interface{}
...
json.Unmarshal($DATA, &$VAR)
- pattern: |
var $VAR interface{}
...
yaml.Unmarshal($DATA, &$VAR)
- pattern: |
var $VAR interface{}
...
xml.Unmarshal($DATA, &$VAR)
- id: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
message: "GitHub Actions step uses a mutable tag or branch reference. Tags and branch
names can be silently repointed by the action owner, enabling supply-chain attacks
\u2014 as seen in the trivy-action and kics-github-action compromises. Pin the
reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`."
severity: WARNING
languages:
- yaml
metadata:
category: security
cwe:
- 'CWE-1357: Reliance on Insufficiently Trustworthy Component'
- 'CWE-353: Missing Support for Integrity Check'
owasp:
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software and Data Integrity Failures
references:
- https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
technology:
- github-actions
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cryptographic Issues
- Other
source: https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
shortlink: https://sg.run/2LgAL
semgrep.dev:
rule:
r_id: 288863
rv_id: 1413422
rule_id: GdUxYDx
version_id: xyTRDAd
url: https://semgrep.dev/playground/r/xyTRDAd/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
origin: community
patterns:
- pattern-inside: '{steps: ...}'
- pattern: |
uses: "$ACTION"
- metavariable-pattern:
metavariable: $ACTION
language: generic
patterns:
- pattern-not-regex: ^\./
- pattern-not-regex: ^docker://
- pattern-not-regex: '@[0-9a-f]{40}(\s|$)'
- id: yaml.github-actions.security.secrets-inherit.secrets-inherit
languages:
- yaml
severity: ERROR
message: 'This workflow uses `secrets: inherit` to pass all of the calling workflow''s
secrets to a reusable workflow. This violates the principle of least privilege
because the called workflow receives access to every secret in the repository,
not just the ones it needs. If the called workflow is compromised or sourced from
a third party, an attacker gains access to all repository secrets. Instead, explicitly
pass only the secrets that the called workflow requires using the `secrets:` map,
e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`.'
metadata:
category: security
cwe:
- 'CWE-250: Execution with Unnecessary Privileges'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://docs.github.com/en/actions/sharing-automations/reusing-workflows#passing-inputs-and-secrets-to-a-reusable-workflow
- https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions
technology:
- github-actions
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/yaml.github-actions.security.secrets-inherit.secrets-inherit
shortlink: https://sg.run/X2PZB
semgrep.dev:
rule:
r_id: 288864
rv_id: 1413424
rule_id: ReUQnKg
version_id: e1T42L1
url: https://semgrep.dev/playground/r/e1T42L1/yaml.github-actions.security.secrets-inherit.secrets-inherit
origin: community
patterns:
- pattern-inside: |
jobs:
...
- pattern: 'secrets: inherit'
- id: package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age
pattern-either:
- patterns:
- pattern-regex: (?ms)\[install\](?P<TARGET>[^\[]*?)(?=\[|\z)
- metavariable-regex:
metavariable: $TARGET
regex: ^(?![\s\S]*minimumReleaseAge)
- focus-metavariable: $TARGET
- patterns:
- pattern-regex: minimumReleaseAge\s*=\s*\d+
- pattern-regex: =\s*(?P<AGE>\d+)
- metavariable-comparison:
metavariable: $AGE
comparison: int($AGE) < 604800
- focus-metavariable: $AGE
- patterns:
- pattern-regex: (?m)minimumReleaseAge[ \t]*=[ \t]*(?P<VAL>[^\s\d][^\n]*)
- focus-metavariable: $VAL
- patterns:
- pattern-regex: (?m)minimumReleaseAge\s*=\s*$
message: 'This bunfig.toml does not set a minimum release age or sets it too low.
Newly published packages can be malicious or unstable. Add `minimumReleaseAge
= 604800` under the `[install]` section to wait 7 days before resolving newly
published package versions. Added in: v1.3 Reference: https://bun.sh/docs/runtime/bunfig'
languages:
- generic
severity: MEDIUM
paths:
include:
- '**/bunfig.toml'
- '**/.bunfig.toml'
metadata:
category: security
technology:
- bun
- javascript
cwe:
- 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere'
owasp:
- A08:2021 - Software and Data Integrity Failures
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- audit
vulnerability_class:
- Insecure Configuration
references:
- https://bun.sh/docs/runtime/bunfig
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age
shortlink: https://sg.run/JqPrR
semgrep.dev:
rule:
r_id: 291646
rv_id: 1423385
rule_id: oqUyJOb
version_id: BjTyRe5
url: https://semgrep.dev/playground/r/BjTyRe5/package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age
origin: community
- id: package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown
pattern-either:
- patterns:
- pattern-inside: |
updates:
...
- pattern: |
- package-ecosystem: $ECOSYSTEM
...
- pattern-not: |
- package-ecosystem: $ECOSYSTEM
...
cooldown:
...
...
- patterns:
- pattern-inside: |
updates:
...
- pattern-regex: default-days\s*:\s*(?P<DAYS>\d+)
- metavariable-comparison:
metavariable: $DAYS
comparison: int($DAYS) < 7
- focus-metavariable: $DAYS
- patterns:
- pattern-inside: |
updates:
...
- pattern: |
cooldown:
default-days: $DAYS
- metavariable-regex:
metavariable: $DAYS
regex: ^\D
- focus-metavariable: $DAYS
message: 'This Dependabot configuration does not set a cooldown period. Newly published
packages can be malicious or unstable. Add a `cooldown` block with `default-days:
7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing
updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown'
languages:
- yaml
severity: MEDIUM
paths:
include:
- '**/.github/dependabot.yml'
- '**/.github/dependabot.yaml'
metadata:
category: security
technology:
- dependabot
cwe:
- 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere'
owasp:
- A08:2021 - Software and Data Integrity Failures
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- audit
vulnerability_class:
- Insecure Configuration
references:
- https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown
shortlink: https://sg.run/5WvGK
semgrep.dev:
rule:
r_id: 291647
rv_id: 1423386
rule_id: zdUArOL
version_id: DkTwEGl
url: https://semgrep.dev/playground/r/DkTwEGl/package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown
origin: community
- id: package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age
pattern-either:
- patterns:
- pattern-regex: (?:(?:^---\n)(?:[^\n]*\n)|^)(?P<TARGET>(?:(?!\n---)[\s\S])*\S(?:(?!\n---)[\s\S])*)
- pattern-not-regex: min-release-age
- focus-metavariable: $TARGET
- patterns:
- pattern-regex: min-release-age\s*=\s*\d+
- pattern-regex: =\s*(?P<AGE>\d+)
- metavariable-comparison:
metavariable: $AGE
comparison: int($AGE) < 7
- focus-metavariable: $AGE
- patterns:
- pattern-regex: (?m)min-release-age[ \t]*=[ \t]*(?P<VAL>[^\s\d][^\n]*)
- focus-metavariable: $VAL
- patterns:
- pattern-regex: (?m)min-release-age\s*=\s*$
message: 'This .npmrc does not set a minimum release age or sets it too low. Newly
published packages can be malicious or unstable. Add `min-release-age = 7` to
wait 7 days before resolving newly published package versions. Added in: v11.10
Reference: https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/'
languages:
- generic
severity: MEDIUM
paths:
include:
- '**/.npmrc'
metadata:
category: security
technology:
- npm
- javascript
cwe:
- 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere'
owasp:
- A08:2021 - Software and Data Integrity Failures
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- audit
vulnerability_class:
- Insecure Configuration
references:
- https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/
- https://github.com/npm/cli/pull/8965
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age
shortlink: https://sg.run/GRo1z
semgrep.dev:
rule:
r_id: 291648
rv_id: 1423387
rule_id: pKU6A82
version_id: WrT7LdL
url: https://semgrep.dev/playground/r/WrT7LdL/package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age
origin: community
- id: package_managers.pnpm.pnpm-block-exotic-sub-dependencies.pnpm-block-exotic-sub-dependencies
message: 'Missing or incorrect blockExoticSubdeps. Set `blockExoticSubdeps: true`
to transitive dependencies from being installed from untrusted sources. Added
in: v10.26.0 Reference: https://pnpm.io/settings#blockexoticsubdeps'
languages:
- yaml
severity: MEDIUM
paths:
include:
- '**/pnpm-workspace.yaml'
pattern-either:
- patterns:
- pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^blockExoticSubdeps\s*:)(?!^---$)[\s\S])*?(?P<TARGET>^(?:packages|catalog)\s*:)(?:(?!^blockExoticSubdeps\s*:)(?!^---$)[\s\S])*?(?=^---$|\z)
- focus-metavariable: $TARGET
- patterns:
- pattern: |
blockExoticSubdeps: $VAL
- metavariable-regex:
metavariable: $VAL
regex: ^(?!true$).+
- focus-metavariable: $VAL
- patterns:
- pattern-regex: (?m)^\s*blockExoticSubdeps\s*:\s*$
metadata:
category: security
technology:
- pnpm
cwe:
- 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere'
owasp:
- A08:2021 - Software and Data Integrity Failures
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- audit
vulnerability_class:
- Insecure Configuration
references:
- https://pnpm.io/settings#blockexoticsubdeps
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/package_managers.pnpm.pnpm-block-exotic-sub-dependencies.pnpm-block-exotic-sub-dependencies
shortlink: https://sg.run/RrWRv
semgrep.dev:
rule:
r_id: 291649
rv_id: 1423388
rule_id: 2ZUQEZ5
version_id: 0bTGnwj
url: https://semgrep.dev/playground/r/0bTGnwj/package_managers.pnpm.pnpm-block-exotic-sub-dependencies.pnpm-block-exotic-sub-dependencies
origin: community
- id: package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age
message: 'This pnpm workspace configuration does not set a minimum release age.
Newly published packages can be malicious or unstable. Add `minimumReleaseAge:
10080` (minutes) to wait at least seven days before installing newly published
package versions. Added in: v10.16.0 Reference: https://pnpm.io/settings#minimumreleaseage'
languages:
- yaml
severity: MEDIUM
paths:
include:
- '**/pnpm-workspace.yaml'
pattern-either:
- patterns:
- pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^minimumReleaseAge\s*:)(?!^---$)[\s\S])*?(?P<TARGET>^(?:packages|catalog)\s*:)(?:(?!^minimumReleaseAge\s*:)(?!^---$)[\s\S])*?(?=^---$|\z)
- focus-metavariable: $TARGET
- patterns:
- pattern-regex: ^\s*minimumReleaseAge\s*:\s*(?P<AGE>\d+)
- metavariable-comparison:
metavariable: $AGE
comparison: int($AGE) < 10080
- focus-metavariable: $AGE
- patterns:
- pattern: |
minimumReleaseAge: $AGE
- metavariable-regex:
metavariable: $AGE
regex: ^\D
- focus-metavariable: $AGE
- patterns:
- pattern-regex: (?m)^\s*minimumReleaseAge\s*:\s*$
metadata:
category: security
technology:
- pnpm
cwe:
- 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere'
owasp:
- A08:2021 - Software and Data Integrity Failures
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- audit
vulnerability_class:
- Insecure Configuration
references:
- https://pnpm.io/settings#minimumreleaseage
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age
shortlink: https://sg.run/Aj0o0
semgrep.dev:
rule:
r_id: 291650
rv_id: 1423389
rule_id: X5Uwn1n
version_id: K3TgxrW
url: https://semgrep.dev/playground/r/K3TgxrW/package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age
origin: community
- id: package_managers.pnpm.pnpm-trust-policy.pnpm-trust-policy
message: 'Missing or incorrect trustPolicy. Set `trustPolicy: no-downgrade` to prevent
malicious package updates from downgrading security settings. Added in: v10.21.0
Reference: https://pnpm.io/settings#trustpolicy'
languages:
- yaml
severity: MEDIUM
paths:
include:
- '**/pnpm-workspace.yaml'
pattern-either:
- patterns:
- pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^trustPolicy\s*:)(?!^---$)[\s\S])*?(?P<TARGET>^(?:packages|catalog)\s*:)(?:(?!^trustPolicy\s*:)(?!^---$)[\s\S])*?(?=^---$|\z)
- focus-metavariable: $TARGET
- patterns:
- pattern: |
trustPolicy: $VAL
- metavariable-regex:
metavariable: $VAL
regex: ^(?!no-downgrade$).+
- focus-metavariable: $VAL
- patterns:
- pattern-regex: (?m)^\s*trustPolicy\s*:\s*$
metadata:
category: security
technology:
- pnpm
cwe:
- 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere'
owasp:
- A08:2021 - Software and Data Integrity Failures
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- audit
vulnerability_class:
- Insecure Configuration
references:
- https://pnpm.io/settings#minimumreleaseage
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/package_managers.pnpm.pnpm-trust-policy.pnpm-trust-policy
shortlink: https://sg.run/B2Kz7
semgrep.dev:
rule:
r_id: 291651
rv_id: 1423390
rule_id: j2U6J8N
version_id: qkTvDQn
url: https://semgrep.dev/playground/r/qkTvDQn/package_managers.pnpm.pnpm-trust-policy.pnpm-trust-policy
origin: community
- id: package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age
pattern-either:
- patterns:
- pattern-inside: |
"packageRules": [
...
]
- pattern-either:
- pattern: |
{ ..., "matchPackageNames": [...], ... }
- pattern: |
{ ..., "matchPackagePatterns": [...], ... }
- pattern: |
{ ..., "matchDepTypes": [...], ... }
- pattern-not: |
{
...,
"minimumReleaseAge": $AGE,
...
}
- pattern-not: |
{
...,
"minimumReleaseAge": false,
...
}
- patterns:
- pattern-inside: |
"packageRules": [
...
]
- pattern-regex: '"minimumReleaseAge":\s*"(?P<AGE>\d+) days?"'
- metavariable-comparison:
metavariable: $AGE
comparison: int($AGE) < 7
- focus-metavariable: $AGE
- patterns:
- pattern-inside: |
"packageRules": [
...
]
- pattern: |
"minimumReleaseAge": "$AGE"
- metavariable-regex:
metavariable: $AGE
regex: ^(?!\d+ days?$)
- focus-metavariable: $AGE
message: 'This Renovate configuration does not set a minimum release age. Newly
published packages can be malicious or unstable. Add `"minimumReleaseAge": "7
days"` within a `packageRules` entry to wait 7 days before proposing updates to
newly published package versions. Set `"minimumReleaseAge": false` to set an exception
for minimal release age for the package rule. Added in: v42'
languages:
- json
severity: MEDIUM
paths:
include:
- '**/renovate.json'
- '**/renovate.json5'
- '**/.renovaterc'
- '**/.renovaterc.json'
- '**/.renovaterc.json5'
metadata:
category: security
technology:
- renovate
cwe:
- 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere'
owasp:
- A08:2021 - Software and Data Integrity Failures
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- audit
vulnerability_class:
- Insecure Configuration
references:
- https://docs.renovatebot.com/configuration-options/#minimumreleaseage
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age
shortlink: https://sg.run/D8l2q
semgrep.dev:
rule:
r_id: 291652
rv_id: 1443454
rule_id: 10UbQrX
version_id: jQT1KAX
url: https://semgrep.dev/playground/r/jQT1KAX/package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age
origin: community
- id: package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown
pattern-either:
- patterns:
- pattern-regex: (?ms)\[tool\.uv\](?P<TARGET>[^\[]*?)(?=\[|\z)
- metavariable-regex:
metavariable: $TARGET
regex: ^(?![\s\S]*exclude-newer)
- focus-metavariable: $TARGET
- patterns:
- pattern-regex: exclude-newer\s*=\s*"(?P<DAYS>\d+) days?"
- metavariable-comparison:
metavariable: $DAYS
comparison: int($DAYS) < 7
- focus-metavariable: $DAYS
- patterns:
- pattern-regex: exclude-newer\s*=\s*"(?P<VAL>[^"]+)"
- metavariable-regex:
metavariable: $VAL
regex: ^(?!\d+ days?$)(?!\d{4}-\d{2}-\d{2}$)(?!\d{4}-\d{2}-\d{2}T)
- focus-metavariable: $VAL
message: 'This pyproject.toml configures uv but does not set a dependency cooldown.
Newly published packages can be malicious or unstable. Add `exclude-newer = "7
days"` under `[tool.uv]` to wait 7 days before resolving newly published package
versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns'
languages:
- generic
severity: MEDIUM
paths:
include:
- '**/pyproject.toml'
- '**/uv.toml'
metadata:
category: security
technology:
- uv
- python
cwe:
- 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere'
owasp:
- A08:2021 - Software and Data Integrity Failures
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- audit
vulnerability_class:
- Insecure Configuration
references:
- https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown
shortlink: https://sg.run/WeY0Z
semgrep.dev:
rule:
r_id: 291653
rv_id: 1423392
rule_id: 9AUo6vE
version_id: YDTwLle
url: https://semgrep.dev/playground/r/YDTwLle/package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown
origin: community
- id: package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate
pattern-either:
- patterns:
- pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^npmMinimalAgeGate\s*:)(?!^---$)[\s\S])*?(?P<TARGET>^(?:nodeLinker|yarnPath|enableGlobalCache|npmScopes|npmRegistryServer)\s*:)(?:(?!^npmMinimalAgeGate\s*:)(?!^---$)[\s\S])*?(?=^---$|\z)
- focus-metavariable: $TARGET
- patterns:
- pattern-regex: (?m)npmMinimalAgeGate\s*:\s*['"]?(?P<DAYS>\d+)d['"]?
- metavariable-comparison:
metavariable: $DAYS
comparison: int($DAYS) < 7
- focus-metavariable: $DAYS
- patterns:
- pattern-regex: (?m)npmMinimalAgeGate[ \t]*:[ \t]*(?P<VAL>\S+)
- metavariable-regex:
metavariable: $VAL
regex: ^(?!['"]?\d+d['"]?$)
- focus-metavariable: $VAL
- patterns:
- pattern-regex: (?m)^npmMinimalAgeGate\s*:\s*$
message: 'This .yarnrc.yml does not set a minimal age gate or sets it too low. Newly
published packages can be malicious or unstable. Add `npmMinimalAgeGate: "7d"`
to wait 7 days before resolving newly published package versions. Added in: 4.10
Reference: https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate'
languages:
- yaml
severity: MEDIUM
paths:
include:
- '**/.yarnrc.yml'
metadata:
category: security
technology:
- yarn
- javascript
cwe:
- 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere'
owasp:
- A08:2021 - Software and Data Integrity Failures
confidence: HIGH
likelihood: LOW
impact: HIGH
subcategory:
- audit
vulnerability_class:
- Insecure Configuration
references:
- https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate
shortlink: https://sg.run/0gvNq
semgrep.dev:
rule:
r_id: 291654
rv_id: 1423393
rule_id: yyUBeEz
version_id: JdTnXlj
url: https://semgrep.dev/playground/r/JdTnXlj/package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate
origin: community
- id: package_managers.poetry.poetry-missing-solver-min-release-age.poetry-missing-solver-min-release-age
message: "This poetry.toml does not set a dependency cooldown via `solver.min-release-age`.
Without a cooldown, Poetry may resolve newly published package versions that have
not yet been vetted by the community. Supply chain attacks frequently involve
publishing a malicious version of a popular package and waiting for it to be pulled
in \u2014 most are detected and removed within days. Set `min-release-age = 7`
under `[solver]` to require that package versions are at least 7 days old before
they are considered during dependency resolution. Added in: v2.4.0"
languages:
- generic
severity: MEDIUM
paths:
include:
- '**/poetry.toml'
- '**/config.toml'
pattern-either:
- pattern-regex: (?m)^\[solver\]\n(?:^(?!min-release-age|\[|---).*\n)*(?=^\[|^---|\z)
- pattern-regex: (?ms)^\[solver\](?:[^\[]*?)min-release-age\s*=\s*(?P<TARGET>"[^"]*"|[0-6](?:\s|#|$)|false)
metadata:
category: security
technology:
- poetry
- python
cwe:
- 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere'
owasp:
- A08:2021 - Software and Data Integrity Failures
confidence: MEDIUM
likelihood: LOW
impact: MEDIUM
subcategory:
- audit
vulnerability_class:
- Insecure Configuration
references:
- https://python-poetry.org/docs/configuration/#solvermin-release-age
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/package_managers.poetry.poetry-missing-solver-min-release-age.poetry-missing-solver-min-release-age
shortlink: https://sg.run/JqnYZ
semgrep.dev:
rule:
r_id: 309390
rv_id: 1443453
rule_id: kxUjBPy
version_id: X0TYPX6
url: https://semgrep.dev/playground/r/X0TYPX6/package_managers.poetry.poetry-missing-solver-min-release-age.poetry-missing-solver-min-release-age
origin: community
- id: package_managers.ruby.bundler-gemfile-missing-cooldown.bundler-gemfile-missing-cooldown
message: 'A Gemfile `source` declaration without a `cooldown` (or with a cooldown
below 7 days) allows Bundler to resolve newly published gem versions immediately,
before the community has had time to detect malicious releases. The May 2026 RubyGems
supply-chain attack demonstrated that threat actors can push compromised gem versions
and have them automatically pulled into builds within minutes. Add `cooldown:
7` to each public source declaration so Bundler ignores gem versions published
within the last 7 days during dependency resolution (e.g. `source "https://rubygems.org",
cooldown: 7`). If you operate an internal or private registry where the supply-chain
risk is lower, use `cooldown: 0` as an explicit bypass. Note: this feature requires
Bundler >= 4.0.13. Cooldown only applies during `bundle update` and `bundle add`;
`bundle install` with an existing lockfile is unaffected.'
languages:
- ruby
severity: MEDIUM
paths:
include:
- '**/Gemfile'
- '**/gems.rb'
exclude:
- '**/vendor/**'
- '**/.bundle/**'
pattern-either:
- patterns:
- pattern: source "...", ...
- pattern-not: 'source "...", ..., cooldown: $N, ...'
- patterns:
- pattern: 'source "...", ..., cooldown: $N, ...'
- metavariable-comparison:
metavariable: $N
comparison: $N > 0 and $N < 7
- focus-metavariable: $N
metadata:
category: security
technology:
- bundler
- ruby
cwe:
- 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere'
owasp:
- A08:2021 - Software and Data Integrity Failures
confidence: MEDIUM
likelihood: LOW
impact: MEDIUM
subcategory:
- audit
vulnerability_class:
- Insecure Configuration
references:
- https://blog.rubygems.org/2026/06/03/cooldown-let-new-gems-be-vetted.html
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/package_managers.ruby.bundler-gemfile-missing-cooldown.bundler-gemfile-missing-cooldown
shortlink: https://sg.run/5Wlkl
semgrep.dev:
rule:
r_id: 309391
rv_id: 1443455
rule_id: wdUzPbP
version_id: 1QTEjAN
url: https://semgrep.dev/playground/r/1QTEjAN/package_managers.ruby.bundler-gemfile-missing-cooldown.bundler-gemfile-missing-cooldown
origin: community
- id: yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell
languages:
- yaml
message: "A `run:` step pipes the output of `curl` or `wget` directly into a shell
interpreter. This is the \"curl | bash\" install pattern \u2014 if the remote
server is compromised or the URL is hijacked, an attacker can execute arbitrary
code in your CI runner. Consider downloading the file first, verifying its checksum
or signature, and then executing it."
metadata:
category: security
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A03:2021 - Injection
- A03:2025 - Injection
references:
- https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
- https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/
technology:
- github-actions
- bash
- curl
cwe2021-top25: true
cwe2022-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell
shortlink: https://sg.run/GR8K1
semgrep.dev:
rule:
r_id: 309392
rv_id: 1443456
rule_id: x8UAgrE
version_id: 9lT3zYb
url: https://semgrep.dev/playground/r/9lT3zYb/yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell
origin: community
patterns:
- pattern-inside: 'steps: [...]'
- pattern-inside: |
- run: ...
...
- pattern: 'run: $SHELL'
- metavariable-pattern:
language: bash
metavariable: $SHELL
patterns:
- pattern-either:
- pattern: curl ... | $CMD ...
- pattern: wget ... | $CMD ...
- metavariable-regex:
metavariable: $CMD
regex: ^(bash|sh|python3?|ruby|perl)$
severity: ERROR
- id: yaml.github-actions.security.gha-workflow-env-secret.gha-workflow-env-secret
languages:
- yaml
message: "A secret is exposed in the workflow-level `env:` block, making it available
to every job and step in this workflow \u2014 including any untrusted code run
in pull-request workflows. Scope secrets as narrowly as possible: prefer step-level
`env:` so the secret is only available where it is actually needed."
metadata:
category: security
cwe:
- 'CWE-732: Incorrect Permission Assignment for Critical Resource'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-secrets
- https://docs.github.com/en/actions/learn-github-actions/variables#defining-environment-variables-for-a-single-workflow
technology:
- github-actions
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/yaml.github-actions.security.gha-workflow-env-secret.gha-workflow-env-secret
shortlink: https://sg.run/Rrn12
semgrep.dev:
rule:
r_id: 309393
rv_id: 1443457
rule_id: OrUnq7z
version_id: yeTqX9r
url: https://semgrep.dev/playground/r/yeTqX9r/yaml.github-actions.security.gha-workflow-env-secret.gha-workflow-env-secret
origin: community
patterns:
- pattern-inside: |
env:
...
- pattern-regex: \$\{\{\s*secrets\.
- pattern-not-inside: 'jobs: ...'
severity: WARNING
- id: javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html
message: Dynamically rendering arbitrary HTML on your website can be very dangerous
because it can easily lead to XSS vulnerabilities. Only use HTML interpolation
on trusted content and never on user-provided content.
metadata:
references:
- https://vuejs.org/v2/guide/syntax.html#Raw-HTML
category: security
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
technology:
- vue
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html
shortlink: https://sg.run/0QEw
semgrep.dev:
rule:
r_id: 9354
rv_id: 1263250
rule_id: 2ZUb2o
version_id: PkTR3Kj
url: https://semgrep.dev/playground/r/PkTR3Kj/javascript.vue.security.audit.xss.templates.avoid-v-html.avoid-v-html
origin: community
languages:
- regex
severity: WARNING
paths:
include:
- '*.vue'
pattern-regex: <[^<>]*v-html=
- id: javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection
message: If unverified user data can reach the `wkhtmltoimage` it can result in
Server-Side Request Forgery vulnerabilities
metadata:
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
category: security
technology:
- wkhtmltoimage
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
references:
- https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection
shortlink: https://sg.run/KlDn
semgrep.dev:
rule:
r_id: 9355
rv_id: 1263251
rule_id: X5U8yj
version_id: JdTzx4D
url: https://semgrep.dev/playground/r/JdTzx4D/javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
$WK = require('wkhtmltoimage');
...
- pattern-not-inside: |
var $INPUT = "...";
...
- pattern: $WK.generate($INPUT,...)
- pattern-not: $WK.generate("...",...)
- id: javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection
message: If unverified user data can reach the `wkhtmltopdf` it can result in Server-Side
Request Forgery vulnerabilities
metadata:
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
category: security
technology:
- wkhtmltopdf
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
references:
- https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection
shortlink: https://sg.run/qx8O
semgrep.dev:
rule:
r_id: 9356
rv_id: 1263252
rule_id: j2Uv58
version_id: 5PTo1xA
url: https://semgrep.dev/playground/r/5PTo1xA/javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
$WK = require('wkhtmltopdf');
...
- pattern-not-inside: |
var $INPUT = "...";
...
- pattern: $WK($INPUT,...)
- pattern-not: $WK("...",...)
- id: javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe
message: If unverified user data can reach the XML Parser it can result in XML External
or Internal Entity (XXE) Processing vulnerabilities
metadata:
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
category: security
technology:
- xml2json
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
references:
- https://owasp.org/Top10/A05_2021-Security_Misconfiguration
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe
shortlink: https://sg.run/l27o
semgrep.dev:
rule:
r_id: 9357
rv_id: 1263253
rule_id: 10UKpB
version_id: GxTkeg8
url: https://semgrep.dev/playground/r/GxTkeg8/javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern: |
var $XML = require('xml2json');
...
$XML.toJson(...);
- pattern-not: |
var $XML = require('xml2json');
...
$XML.toJson("...",...);
- pattern-not: |-
var $XML = require('xml2json');
...
var $S = "...";
...
$XML.toJson($S,...);
- id: json.aws.security.public-s3-policy-statement.public-s3-policy-statement
pattern: |
{
"Effect": "Allow",
"Principal": "*",
"Resource": [
..., "=~/arn:aws:s3.*/", ...
],
...
}
message: Detected public S3 bucket policy. This policy allows anyone to access certain
properties of or items in the bucket. Do not do this unless you will never have
sensitive data inside the bucket.
metadata:
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-264: CWE CATEGORY: Permissions, Privileges, and Access Controls'
references:
- https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteAccessPermissionsReqd.html
category: security
technology:
- aws
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/json.aws.security.public-s3-policy-statement.public-s3-policy-statement
shortlink: https://sg.run/Yv1d
semgrep.dev:
rule:
r_id: 9358
rv_id: 1263255
rule_id: 9AU1br
version_id: A8Tgdxq
url: https://semgrep.dev/playground/r/A8Tgdxq/json.aws.security.public-s3-policy-statement.public-s3-policy-statement
origin: community
severity: WARNING
languages:
- json
- id: kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call
message: A formatted or concatenated string was detected as input to a java.lang.Runtime
call. This is dangerous if a variable is controlled by user input and could result
in a command injection. Ensure your variables are not controlled by users or sufficiently
sanitized.
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#COMMAND_INJECTION.
category: security
technology:
- kt
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call
shortlink: https://sg.run/6nEK
semgrep.dev:
rule:
r_id: 9359
rv_id: 1263259
rule_id: yyUnpo
version_id: 0bTKzZ9
url: https://semgrep.dev/playground/r/0bTKzZ9/kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call
origin: community
severity: ERROR
languages:
- kt
pattern-either:
- pattern: $RUNTIME.exec($X + $Y)
- pattern: $RUNTIME.exec(String.format(...))
- pattern: $RUNTIME.loadLibrary($X + $Y)
- pattern: $RUNTIME.loadLibrary(String.format(...))
- id: kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly
metadata:
cwe:
- 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag'
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#HTTPONLY_COOKIE
category: security
technology:
- kt
references:
- https://owasp.org/Top10/A05_2021-Security_Misconfiguration
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cookie Security
source: https://semgrep.dev/r/kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly
shortlink: https://sg.run/ox7X
semgrep.dev:
rule:
r_id: 9360
rv_id: 1263260
rule_id: r6UrKQ
version_id: K3TKkRO
url: https://semgrep.dev/playground/r/K3TKkRO/kotlin.lang.security.cookie-missing-httponly.cookie-missing-httponly
origin: community
message: A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly'
flag for cookies instructs the browser to forbid client-side scripts from reading
the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'
severity: WARNING
languages:
- kt
patterns:
- pattern-not-inside: |
$COOKIE.setValue("")
...
- pattern-either:
- pattern: $COOKIE.setHttpOnly(false)
- patterns:
- pattern-not-inside: |
$COOKIE.setHttpOnly(...)
...
- pattern: $RESPONSE.addCookie($COOKIE)
- id: kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag
metadata:
cwe:
- 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute'
owasp:
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#INSECURE_COOKIE
category: security
technology:
- kt
references:
- https://owasp.org/Top10/A05_2021-Security_Misconfiguration
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cookie Security
source: https://semgrep.dev/r/kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag
shortlink: https://sg.run/zv7n
semgrep.dev:
rule:
r_id: 9361
rv_id: 1263261
rule_id: bwUw3j
version_id: qkTR7r9
url: https://semgrep.dev/playground/r/qkTR7r9/kotlin.lang.security.cookie-missing-secure-flag.cookie-missing-secure-flag
origin: community
message: A cookie was detected without setting the 'secure' flag. The 'secure' flag
for cookies prevents the client from transmitting the cookie over insecure channels
such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'
severity: WARNING
languages:
- kt
patterns:
- pattern-not-inside: |
$COOKIE.setValue("")
...
- pattern-either:
- pattern: $COOKIE.setSecure(false)
- patterns:
- pattern-not-inside: |
$COOKIE.setSecure(...)
...
- pattern: $RESPONSE.addCookie($COOKIE)
- id: ocaml.lang.compatibility.deprecated.deprecated-pervasives
pattern: Pervasives.$X
message: Pervasives is deprecated and will not be available after 4.10. Use Stdlib.
languages:
- ocaml
severity: ERROR
metadata:
category: compatibility
technology:
- ocaml
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/ocaml.lang.compatibility.deprecated.deprecated-pervasives
shortlink: https://sg.run/dKe0
semgrep.dev:
rule:
r_id: 9378
rv_id: 945962
rule_id: 3qUP1E
version_id: K3TJbDY
url: https://semgrep.dev/playground/r/K3TJbDY/ocaml.lang.compatibility.deprecated.deprecated-pervasives
origin: community
Reference in New Issue View Git Blame Copy Permalink