JulieChv/ARC
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
9d464fb261af72f49cffac63d9a843765a71b915
ARC/backend/app/sandbox/rules/cwe-top-25.yaml

20055 lines
678 KiB
YAML
Raw Blame History

rules:
- id: generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key
pattern-regex: rk_live_[0-9a-zA-Z]{24}
languages:
- regex
message: Stripe Restricted API Key detected
severity: ERROR
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
category: security
technology:
- secrets
- stripe
confidence: MEDIUM
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key
shortlink: https://sg.run/ZvdL
semgrep.dev:
rule:
r_id: 9079
rv_id: 1262900
rule_id: 5rUOWq
version_id: K3TKkKj
url: https://semgrep.dev/playground/r/K3TKkKj/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key
origin: community
- id: generic.secrets.security.detected-username-and-password-in-uri.detected-username-and-password-in-uri
patterns:
- pattern: $PROTOCOL://$...USERNAME:$...PASSWORD@$END
- metavariable-regex:
metavariable: $...USERNAME
regex: \A({?)([A-Za-z])([A-Za-z0-9_-]){5,31}(}?)\Z
- metavariable-regex:
metavariable: $...PASSWORD
regex: (?!.*[\s])(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~]){6,32}
- metavariable-regex:
metavariable: $PROTOCOL
regex: (.*http.*)|(.*sql.*)|(.*ftp.*)|(.*smtp.*)
languages:
- generic
message: Username and password in URI detected
severity: ERROR
metadata:
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
category: security
technology:
- secrets
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/generic.secrets.security.detected-username-and-password-in-uri.detected-username-and-password-in-uri
shortlink: https://sg.run/8yA4
semgrep.dev:
rule:
r_id: 9084
rv_id: 1262903
rule_id: DbUple
version_id: YDTZeZE
url: https://semgrep.dev/playground/r/YDTZeZE/generic.secrets.security.detected-username-and-password-in-uri.detected-username-and-password-in-uri
origin: community
- id: go.jwt-go.security.jwt.hardcoded-jwt-key
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
options:
interfile: true
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
category: security
technology:
- jwt
- secrets
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key
shortlink: https://sg.run/Rod2
semgrep.dev:
rule:
r_id: 9093
rv_id: 1262920
rule_id: GdU7Ny
version_id: pZT0305
url: https://semgrep.dev/playground/r/pZT0305/go.jwt-go.security.jwt.hardcoded-jwt-key
origin: community
severity: WARNING
languages:
- go
mode: taint
pattern-sources:
- patterns:
- pattern-inside: |
[]byte("$F")
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
$TOKEN.SignedString($F)
- focus-metavariable: $F
- id: go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd
patterns:
- pattern-either:
- patterns:
- pattern: |
exec.Cmd {...,Path: $CMD,...}
- pattern-not: |
exec.Cmd {...,Path: "...",...}
- pattern-not-inside: |
$CMD,$ERR := exec.LookPath("...");
...
- pattern-not-inside: |
$CMD = "...";
...
- patterns:
- pattern: |
exec.Cmd {...,Args: $ARGS,...}
- pattern-not: |
exec.Cmd {...,Args: []string{...},...}
- pattern-not-inside: |
$ARGS = []string{"...",...};
...
- pattern-not-inside: |
$CMD = "...";
...
$ARGS = []string{$CMD,...};
...
- pattern-not-inside: |
$CMD = exec.LookPath("...");
...
$ARGS = []string{$CMD,...};
...
- patterns:
- pattern: |
exec.Cmd {...,Args: []string{$CMD,...},...}
- pattern-not: |
exec.Cmd {...,Args: []string{"...",...},...}
- pattern-not-inside: |
$CMD,$ERR := exec.LookPath("...");
...
- pattern-not-inside: |
$CMD = "...";
...
- patterns:
- pattern-either:
- pattern: |
exec.Cmd {...,Args: []string{"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$EXE,...},...}
- patterns:
- pattern: |
exec.Cmd {...,Args: []string{$CMD,"-c",$EXE,...},...}
- pattern-inside: |
$CMD,$ERR := exec.LookPath("=~/(sh|bash|ksh|csh|tcsh|zsh)/");
...
- pattern-not: |
exec.Cmd {...,Args: []string{"...","...","...",...},...}
- pattern-not-inside: |
$EXE = "...";
...
- pattern-inside: |
import "os/exec"
...
message: Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'.
If unverified user data can reach this call site, this is a code injection vulnerability.
A malicious actor can inject a malicious script to execute arbitrary code.
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- go
confidence: MEDIUM
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd
shortlink: https://sg.run/Dorj
semgrep.dev:
rule:
r_id: 9108
rv_id: 1262934
rule_id: 2ZUb8l
version_id: e1Tyjeg
url: https://semgrep.dev/playground/r/e1Tyjeg/go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd
origin: community
severity: ERROR
languages:
- go
- id: go.lang.security.audit.net.formatted-template-string.formatted-template-string
message: Found a formatted template string passed to 'template.HTML()'. 'template.HTML()'
does not escape contents. Be absolutely sure there is no user-controlled data
in this template. If user data can reach this template, you may have a XSS vulnerability.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://golang.org/pkg/html/template/#HTML
category: security
technology:
- go
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string
shortlink: https://sg.run/weE0
semgrep.dev:
rule:
r_id: 9129
rv_id: 1262943
rule_id: 8GUjDW
version_id: gETB7Pe
url: https://semgrep.dev/playground/r/gETB7Pe/go.lang.security.audit.net.formatted-template-string.formatted-template-string
origin: community
languages:
- go
severity: WARNING
patterns:
- pattern-not: template.HTML("..." + "...")
- pattern-either:
- pattern: template.HTML($T + $X, ...)
- pattern: template.HTML(fmt.$P("...", ...), ...)
- pattern: |
$T = "..."
...
$T = $FXN(..., $T, ...)
...
template.HTML($T, ...)
- pattern: |
$T = fmt.$P("...", ...)
...
template.HTML($T, ...)
- pattern: |
$T, $ERR = fmt.$P("...", ...)
...
template.HTML($T, ...)
- pattern: |
$T = $X + $Y
...
template.HTML($T, ...)
- pattern: |-
$T = "..."
...
$OTHER, $ERR = fmt.$P(..., $T, ...)
...
template.HTML($OTHER, ...)
- id: go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf
patterns:
- pattern-inside: |
func $FUNC(..., $W http.ResponseWriter, ...) {
...
var $TEMPLATE = "..."
...
$W.Write([]byte(fmt.$PRINTF($TEMPLATE, ...)), ...)
...
}
- pattern-either:
- pattern: |
$PARAMS = r.URL.Query()
...
$DATA, $ERR := $PARAMS[...]
...
$INTERM = $ANYTHING(..., $DATA, ...)
...
$W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...)))
- pattern: |
$PARAMS = r.URL.Query()
...
$DATA, $ERR := $PARAMS[...]
...
$INTERM = $DATA[...]
...
$W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...)))
- pattern: |
$DATA, $ERR := r.URL.Query()[...]
...
$INTERM = $DATA[...]
...
$W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...)))
- pattern: |
$DATA, $ERR := r.URL.Query()[...]
...
$INTERM = $ANYTHING(..., $DATA, ...)
...
$W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...)))
- pattern: |
$PARAMS = r.URL.Query()
...
$DATA, $ERR := $PARAMS[...]
...
$W.Write([]byte(fmt.$PRINTF(..., $DATA, ...)))
message: Found data going from url query parameters into formatted data written
to ResponseWriter. This could be XSS and should not be done. If you must do this,
ensure your data is sanitized or escaped.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- go
confidence: MEDIUM
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf
shortlink: https://sg.run/Zvon
semgrep.dev:
rule:
r_id: 9135
rv_id: 1262949
rule_id: JDUyXB
version_id: 5PTo1qr
url: https://semgrep.dev/playground/r/5PTo1qr/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf
origin: community
severity: WARNING
languages:
- go
- id: java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
technology:
- java
- secrets
- jwt
category: security
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret
shortlink: https://sg.run/RoDK
semgrep.dev:
rule:
r_id: 9149
rv_id: 1262980
rule_id: oqUeAn
version_id: d6Tyx8j
url: https://semgrep.dev/playground/r/d6Tyx8j/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret
origin: community
languages:
- java
severity: WARNING
patterns:
- pattern-either:
- pattern: |
(Algorithm $ALG) = $ALGO.$HMAC("$Y");
- pattern: |
$SECRET = "$Y";
...
(Algorithm $ALG) = $ALGO.$HMAC($SECRET);
- pattern: |
class $CLASS {
...
$TYPE $SECRET = "$Y";
...
$RETURNTYPE $FUNC (...) {
...
(Algorithm $ALG) = $ALGO.$HMAC($SECRET);
...
}
...
}
- focus-metavariable: $Y
- metavariable-regex:
metavariable: $HMAC
regex: (HMAC384|HMAC256|HMAC512)
- id: java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal
metadata:
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN
references:
- https://www.owasp.org/index.php/Path_Traversal
category: security
technology:
- jax-rs
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: LOW
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal
shortlink: https://sg.run/DoWj
semgrep.dev:
rule:
r_id: 9152
rv_id: 1262984
rule_id: 2ZUb9l
version_id: 7ZTE3KW
url: https://semgrep.dev/playground/r/7ZTE3KW/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal
origin: community
message: Detected a potential path traversal. A malicious actor could control the
location of this file, to include going backwards in the directory with '../'.
To address this, ensure that user-controlled variables in file paths are sanitized.
You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...)
to only retrieve the file name from the path.
severity: WARNING
languages:
- java
pattern-either:
- pattern: |
$RETURNTYPE $FUNC (..., @PathParam(...) $TYPE $VAR, ...) {
...
new File(..., $VAR, ...);
...
}
- pattern: |-
$RETURNTYPE $FUNC (..., @javax.ws.rs.PathParam(...) $TYPE $VAR, ...) {
...
new File(..., $VAR, ...);
...
}
- id: java.jboss.security.session_sqli.find-sql-string-concatenation
message: In $METHOD, $X is used to construct a SQL query via string concatenation.
languages:
- java
severity: ERROR
pattern-either:
- pattern: |
$RETURN $METHOD(...,String $X,...){
...
Session $SESSION = ...;
...
String $QUERY = ... + $X + ...;
...
PreparedStatement $PS = $SESSION.connection().prepareStatement($QUERY);
...
ResultSet $RESULT = $PS.executeQuery();
...
}
- pattern: |
$RETURN $METHOD(...,String $X,...){
...
String $QUERY = ... + $X + ...;
...
Session $SESSION = ...;
...
PreparedStatement $PS = $SESSION.connection().prepareStatement($QUERY);
...
ResultSet $RESULT = $PS.executeQuery();
...
}
metadata:
category: security
technology:
- jboss
confidence: MEDIUM
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/java.jboss.security.session_sqli.find-sql-string-concatenation
shortlink: https://sg.run/W8kA
semgrep.dev:
rule:
r_id: 9153
rv_id: 1262986
rule_id: X5U8rQ
version_id: 8KT5r3v
url: https://semgrep.dev/playground/r/8KT5r3v/java.jboss.security.session_sqli.find-sql-string-concatenation
origin: community
- id: java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal
metadata:
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN
references:
- https://www.owasp.org/index.php/Path_Traversal
category: security
technology:
- java
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal
shortlink: https://sg.run/oxXN
semgrep.dev:
rule:
r_id: 9160
rv_id: 1263064
rule_id: NbUk7X
version_id: zyTb2rq
url: https://semgrep.dev/playground/r/zyTb2rq/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal
origin: community
message: Detected a potential path traversal. A malicious actor could control the
location of this file, to include going backwards in the directory with '../'.
To address this, ensure that user-controlled variables in file paths are sanitized.
You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...)
to only retrieve the file name from the path.
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
(HttpServletRequest $REQ)
- patterns:
- pattern-inside: |
(javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);
...
for (javax.servlet.http.Cookie $COOKIE: $COOKIES) {
...
}
- pattern: |
$COOKIE.getValue(...)
- patterns:
- pattern-inside: |
$TYPE[] $VALS = (HttpServletRequest $REQ).$GETFUNC(...);
...
- pattern: |
$PARAM = $VALS[$INDEX];
pattern-sanitizers:
- pattern: org.apache.commons.io.FilenameUtils.getName(...)
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
(java.io.File $FILE) = ...
- pattern: |
(java.io.FileOutputStream $FOS) = ...
- pattern: |
new java.io.FileInputStream(...)
severity: ERROR
languages:
- java
- id: java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization
severity: WARNING
languages:
- java
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.3 Insecue Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf
category: security
technology:
- java
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization
shortlink: https://sg.run/zvO1
semgrep.dev:
rule:
r_id: 9161
rv_id: 1263065
rule_id: kxUk12
version_id: pZT03A1
url: https://semgrep.dev/playground/r/pZT03A1/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization
origin: community
message: JMS Object messages depend on Java Serialization for marshalling/unmarshalling
of the message payload when ObjectMessage.getObject() is called. Deserialization
of untrusted data can lead to security flaws; a remote attacker could via a crafted
JMS ObjectMessage to execute arbitrary code with the permissions of the application
listening/consuming JMS Messages. In this case, the JMS MessageListener consume
an ObjectMessage type received inside the onMessage method, which may lead to
arbitrary code execution when calling the $Y.getObject method.
patterns:
- pattern-inside: |
public class $JMS_LISTENER implements MessageListener {
...
public void onMessage(Message $JMS_MSG) {
...
}
}
- pattern-either:
- pattern-inside: $X = $Y.getObject(...);
- pattern-inside: $X = ($Z) $Y.getObject(...);
- id: java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss
message: 'Cross-site scripting detected in HttpServletResponse writer with variable
''$VAR''. User input was detected going directly from the HttpServletRequest into
output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml:
''Encode.forHtml($VAR)''.'
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XSS_SERVLET
category: security
technology:
- java
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss
shortlink: https://sg.run/pxjN
semgrep.dev:
rule:
r_id: 9162
rv_id: 1263066
rule_id: wdUJOk
version_id: 2KTv2EG
url: https://semgrep.dev/playground/r/2KTv2EG/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss
origin: community
severity: ERROR
patterns:
- pattern-inside: $TYPE $FUNC(..., HttpServletResponse $RESP, ...) { ... }
- pattern-inside: $VAR = $REQ.getParameter(...); ...
- pattern-either:
- pattern: $RESP.getWriter(...).write(..., $VAR, ...);
- pattern: |
$WRITER = $RESP.getWriter(...);
...
$WRITER.write(..., $VAR, ...);
languages:
- java
- id: java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe
severity: WARNING
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf
- https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser
category: security
technology:
- java
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe
shortlink: https://sg.run/XBwA
semgrep.dev:
rule:
r_id: 9164
rv_id: 1263069
rule_id: OrU35O
version_id: 1QTypQZ
url: https://semgrep.dev/playground/r/1QTypQZ/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe
origin: community
message: XML external entities are not explicitly disabled for this XMLInputFactory.
This could be vulnerable to XML external entity vulnerabilities. Explicitly disable
external entities by setting "javax.xml.stream.isSupportingExternalEntities" to
false.
patterns:
- pattern-not-inside: |
$METHOD(...) {
...
$XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", false);
...
}
- pattern-not-inside: |
$METHOD(...) {
...
$XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
...
}
- pattern-not-inside: |
$METHOD(...) {
...
$XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", Boolean.FALSE);
...
}
- pattern-not-inside: |
$METHOD(...) {
...
$XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE);
...
}
- pattern-either:
- pattern: javax.xml.stream.XMLInputFactory.newFactory(...)
- pattern: new XMLInputFactory(...)
languages:
- java
- id: java.lang.security.audit.formatted-sql-string.formatted-sql-string
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SQL_INJECTION
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.5 Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
- https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps
- https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement
category: security
technology:
- java
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string
shortlink: https://sg.run/OPXp
semgrep.dev:
rule:
r_id: 9175
rv_id: 1409389
rule_id: QrUzxR
version_id: ExTeyBP
url: https://semgrep.dev/playground/r/ExTeyBP/java.lang.security.audit.formatted-sql-string.formatted-sql-string
origin: community
options:
taint_assume_safe_numbers: true
taint_assume_safe_booleans: true
message: Detected a formatted string in a SQL statement. This could lead to SQL
injection if variables in the SQL statement are not properly sanitized. Use a
prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement
using 'connection.prepareStatement'.
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
(HttpServletRequest $REQ)
- patterns:
- pattern-inside: |
$ANNOT $FUNC (..., $INPUT, ...) {
...
}
- pattern: (String $INPUT)
- focus-metavariable: $INPUT
label: INPUT
- patterns:
- pattern-either:
- pattern: $X + $INPUT
- pattern: $X += $INPUT
- pattern: String.format(..., $INPUT, ...)
- pattern: String.join(..., $INPUT, ...)
- pattern: (String $STR).concat($INPUT)
- pattern: $INPUT.concat(...)
- patterns:
- pattern-either:
- pattern: $STRB.append($INPUT)
- pattern: new $STRB(..., $INPUT, ...)
- metavariable-type:
metavariable: $STRB
type: StringBuilder
label: CONCAT
requires: INPUT
pattern-propagators:
- pattern: (StringBuffer $S).append($X)
from: $X
to: $S
- pattern: (StringBuilder $S).append($X)
from: $X
to: $S
pattern-sinks:
- patterns:
- pattern-not: $S.$SQLFUNC(<... "=~/.*TABLE *$/" ...>)
- pattern-not: $S.$SQLFUNC(<... "=~/.*TABLE %s$/" ...>)
- pattern-either:
- pattern: (Statement $S).$SQLFUNC(...)
- pattern: (PreparedStatement $P).$SQLFUNC(...)
- pattern: (Connection $C).createStatement(...).$SQLFUNC(...)
- pattern: (Connection $C).prepareStatement(...).$SQLFUNC(...)
- pattern: (EntityManager $EM).$SQLFUNC(...)
- metavariable-regex:
metavariable: $SQLFUNC
regex: execute|executeQuery|createQuery|query|addBatch|nativeSQL|create|prepare
requires: CONCAT
pattern-sanitizers:
- patterns:
- pattern: (CriteriaBuilder $CB).$ANY(...)
severity: ERROR
languages:
- java
- id: java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer
message: Detected a request with potential user-input going into a OutputStream
or Writer object. This bypasses any view or template environments, including HTML
escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities.
Consider using a view technology such as JavaServer Faces (JSFs) which automatically
escapes HTML views.
severity: WARNING
options:
interfile: true
metadata:
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
category: security
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
cwe2021-top25: true
cwe2022-top25: true
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html
subcategory:
- vuln
technology:
- java
- servlets
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer
shortlink: https://sg.run/KlRL
semgrep.dev:
rule:
r_id: 9211
rv_id: 1263055
rule_id: j2Uv7B
version_id: DkTRbXy
url: https://semgrep.dev/playground/r/DkTRbXy/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer
origin: community
languages:
- java
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
(HttpServletRequest $REQ).$REQFUNC(...)
- pattern: "(ServletRequest $REQ).$REQFUNC(...) \n"
- metavariable-regex:
metavariable: $REQFUNC
regex: (getInputStream|getParameter|getParameterMap|getParameterValues|getReader|getCookies|getHeader|getHeaderNames|getHeaders|getPart|getParts|getQueryString)
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
(HttpServletResponse $RESPONSE).getWriter(...).$WRITE(...)
- pattern: |
(HttpServletResponse $RESPONSE).getOutputStream(...).$WRITE(...)
- pattern: |
(java.io.PrintWriter $WRITER).$WRITE(...)
- pattern: |
(PrintWriter $WRITER).$WRITE(...)
- pattern: |
(javax.servlet.ServletOutputStream $WRITER).$WRITE(...)
- pattern: |
(ServletOutputStream $WRITER).$WRITE(...)
- pattern: |
(java.io.OutputStream $WRITER).$WRITE(...)
- pattern: |
(OutputStream $WRITER).$WRITE(...)
pattern-sanitizers:
- pattern-either:
- pattern: Encode.forHtml(...)
- pattern: (PolicyFactory $POLICY).sanitize(...)
- pattern: (AntiSamy $AS).scan(...)
- pattern: JSoup.clean(...)
- pattern: org.apache.commons.lang.StringEscapeUtils.escapeHtml(...)
- pattern: org.springframework.web.util.HtmlUtils.htmlEscape(...)
- pattern: org.owasp.esapi.ESAPI.encoder().encodeForHTML(...)
- id: java.spring.security.audit.spring-sqli.spring-sqli
mode: taint
pattern-sources:
- patterns:
- pattern: $ARG
- pattern-inside: |
public $T $M (..., String $ARG,...){...}
pattern-sanitizers:
- not_conflicting: true
pattern-either:
- patterns:
- focus-metavariable: $A
- pattern-inside: |
new $TYPE(...,$A,...);
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- focus-metavariable: $A
- pattern: |
new PreparedStatementCreatorFactory($A,...);
- patterns:
- focus-metavariable: $A
- pattern: |
(JdbcTemplate $T).$M($A,...)
- patterns:
- pattern: (String $A)
- pattern-inside: |
(JdbcTemplate $T).batchUpdate(...)
- patterns:
- focus-metavariable: $A
- pattern: |
NamedParameterBatchUpdateUtils.$M($A,...)
- patterns:
- focus-metavariable: $A
- pattern: |
BatchUpdateUtils.$M($A,...)
message: Detected a string argument from a public method contract in a raw SQL statement.
This could lead to SQL injection if variables in the SQL statement are not properly
sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You
can obtain a PreparedStatement using 'connection.prepareStatement'.
languages:
- java
severity: WARNING
options:
taint_assume_safe_numbers: true
taint_assume_safe_booleans: true
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
category: security
technology:
- spring
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/java.spring.security.audit.spring-sqli.spring-sqli
shortlink: https://sg.run/1Z3x
semgrep.dev:
rule:
r_id: 9222
rv_id: 1263082
rule_id: eqU8N2
version_id: ZRTKAWW
url: https://semgrep.dev/playground/r/ZRTKAWW/java.spring.security.audit.spring-sqli.spring-sqli
origin: community
- id: javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled
message: $sceProvider is set to false. Disabling Strict Contextual escaping (SCE)
in an AngularJS application could provide additional attack surface for XSS vulnerabilities.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://docs.angularjs.org/api/ng/service/$sce
- https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
category: security
technology:
- angular
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled
shortlink: https://sg.run/N4DG
semgrep.dev:
rule:
r_id: 9227
rv_id: 1263094
rule_id: EwU20Z
version_id: 5PTo1EW
url: https://semgrep.dev/playground/r/5PTo1EW/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled
origin: community
languages:
- javascript
- typescript
severity: ERROR
pattern: |
$sceProvider.enabled(false);
- id: javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method
message: The use of $sce.trustAs can be dangerous if unsanitized user input flows
through this API.
metadata:
references:
- https://docs.angularjs.org/api/ng/service/$sce
- https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
category: security
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
technology:
- angular
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method
shortlink: https://sg.run/OPW2
semgrep.dev:
rule:
r_id: 9231
rv_id: 1263098
rule_id: gxU1QX
version_id: BjTkZv0
url: https://semgrep.dev/playground/r/BjTkZv0/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-inside: |
app.controller(..., function($scope,$sce) {
...
});
- pattern: $scope.$X
pattern-sinks:
- pattern: $sce.trustAs(...)
- pattern: $sce.trustAsHtml(...)
- id: javascript.browser.security.raw-html-concat.raw-html-concat
message: User controlled data in a HTML string may result in XSS
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/www-community/attacks/xss/
category: security
technology:
- browser
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.browser.security.raw-html-concat.raw-html-concat
shortlink: https://sg.run/4xAx
semgrep.dev:
rule:
r_id: 9244
rv_id: 1263123
rule_id: 0oU5b5
version_id: 2KTv2wp
url: https://semgrep.dev/playground/r/2KTv2wp/javascript.browser.security.raw-html-concat.raw-html-concat
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: location.href
- pattern: location.hash
- pattern: location.search
- pattern: $WINDOW. ... .location.href
- pattern: $WINDOW. ... .location.hash
- pattern: $WINDOW. ... .location.search
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: $STRING + $EXPR
- pattern-not: $STRING + "..."
- metavariable-pattern:
patterns:
- pattern: <$TAG ...
- pattern-not: <$TAG ...>...</$TAG>...
metavariable: $STRING
language: generic
- patterns:
- pattern: $EXPR + $STRING
- pattern-not: '"..." + $STRING'
- metavariable-pattern:
patterns:
- pattern: '... </$TAG'
metavariable: $STRING
language: generic
- patterns:
- pattern: '[..., $STRING, ...].join(...)'
- metavariable-pattern:
patterns:
- pattern: <$TAG ...
metavariable: $STRING
language: generic
- patterns:
- pattern: '[..., $STRING, ...].join(...)'
- metavariable-pattern:
patterns:
- pattern: '... </$TAG'
metavariable: $STRING
language: generic
- patterns:
- pattern: $VAR += $STRING
- metavariable-pattern:
patterns:
- pattern: <$TAG ...
metavariable: $STRING
language: generic
- patterns:
- pattern: $VAR += $STRING
- metavariable-pattern:
patterns:
- pattern: '... </$TAG'
metavariable: $STRING
language: generic
pattern-sanitizers:
- patterns:
- pattern-either:
- pattern-inside: |
import $S from "underscore.string"
...
- pattern-inside: |
import * as $S from "underscore.string"
...
- pattern-inside: |
import $S from "underscore.string"
...
- pattern-inside: |
$S = require("underscore.string")
...
- pattern-either:
- pattern: $S.escapeHTML(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from "dompurify"
...
- pattern-inside: |
import { ..., $S,... } from "dompurify"
...
- pattern-inside: |
import * as $S from "dompurify"
...
- pattern-inside: |
$S = require("dompurify")
...
- pattern-inside: |
import $S from "isomorphic-dompurify"
...
- pattern-inside: |
import * as $S from "isomorphic-dompurify"
...
- pattern-inside: |
$S = require("isomorphic-dompurify")
...
- pattern-either:
- patterns:
- pattern-inside: |
$VALUE = $S(...)
...
- pattern: $VALUE.sanitize(...)
- patterns:
- pattern-inside: |
$VALUE = $S.sanitize
...
- pattern: $S(...)
- pattern: $S.sanitize(...)
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'xss';
...
- pattern-inside: |
import * as $S from 'xss';
...
- pattern-inside: |
$S = require("xss")
...
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'sanitize-html';
...
- pattern-inside: |
import * as $S from "sanitize-html";
...
- pattern-inside: |
$S = require("sanitize-html")
...
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
$S = new Remarkable()
...
- pattern: $S.render(...)
- id: javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection
message: If unverified user data can reach the `compileScript` method it can result
in Server-Side Request Forgery vulnerabilities
metadata:
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
category: security
technology:
- chrome-remote-interface
references:
- https://github.com/cyrus-and/chrome-remote-interface
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection
shortlink: https://sg.run/J9kj
semgrep.dev:
rule:
r_id: 9246
rv_id: 1263126
rule_id: qNUjnb
version_id: 1QTypkQ
url: https://semgrep.dev/playground/r/1QTypkQ/javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-inside: function ... (..., $ARG,...) {...}
- focus-metavariable: $ARG
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
require('chrome-remote-interface');
...
- pattern-inside: |
import 'chrome-remote-interface';
...
- pattern-either:
- pattern: |
$RUNTIME.compileScript({expression: $SINK},...)
- pattern: |
$RUNTIME.evaluate({expression: $SINK},...)
- pattern: |
$PAGE.navigate({url: $SINK},...)
- pattern: |
$RUNTIME.printToPDF({headerTemplate: $SINK},...)
- pattern: |
$RUNTIME.printToPDF({footerTemplate: $SINK},...)
- pattern: |
$PAGE.setDocumentContent({html: $SINK},...)
- focus-metavariable: $SINK
- id: javascript.express.security.express-expat-xxe.express-expat-xxe
message: Make sure that unverified user data can not reach the XML Parser, as it
can result in XML External or Internal Entity (XXE) Processing vulnerabilities.
options:
interfile: true
metadata:
interfile: true
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://github.com/astro/node-expat
category: security
technology:
- express
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/javascript.express.security.express-expat-xxe.express-expat-xxe
shortlink: https://sg.run/BkXx
semgrep.dev:
rule:
r_id: 9251
rv_id: 1263164
rule_id: zdUkJl
version_id: o5TbD5l
url: https://semgrep.dev/playground/r/o5TbD5l/javascript.express.security.express-expat-xxe.express-expat-xxe
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
$XML = require('node-expat')
...
- pattern-inside: |
import $XML from 'node-expat'
...
- pattern-inside: |
import * as $XML from 'node-expat'
...
- pattern-either:
- pattern-inside: |
$PARSER = new $XML.Parser(...);
...
- pattern-either:
- pattern: $PARSER.parse($QUERY)
- pattern: $PARSER.write($QUERY)
- focus-metavariable: $QUERY
- id: javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
options:
interfile: true
metadata:
interfile: true
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
category: security
technology:
- express
- secrets
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret
shortlink: https://sg.run/Do1d
semgrep.dev:
rule:
r_id: 9252
rv_id: 1263166
rule_id: pKUOjy
version_id: pZT03Q0
url: https://semgrep.dev/playground/r/pZT03Q0/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-either:
- pattern-inside: |
$JWT = require('express-jwt');
...
- pattern-inside: |
import $JWT from 'express-jwt';
...
- pattern-inside: |
import * as $JWT from 'express-jwt';
...
- pattern-inside: |
import { ..., $JWT, ... } from 'express-jwt';
...
- pattern-either:
- pattern: |
$JWT({...,secret: "$Y",...},...)
- pattern: |
$OPTS = "$Y";
...
$JWT({...,secret: $OPTS},...);
- focus-metavariable: $Y
- id: javascript.express.security.express-phantom-injection.express-phantom-injection
message: If unverified user data can reach the `phantom` methods it can result in
Server-Side Request Forgery vulnerabilities
metadata:
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
category: security
technology:
- express
references:
- https://phantomjs.org/page-automation.html
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/javascript.express.security.express-phantom-injection.express-phantom-injection
shortlink: https://sg.run/W8BL
semgrep.dev:
rule:
r_id: 9253
rv_id: 1263167
rule_id: 2ZUbx3
version_id: 2KTv26p
url: https://semgrep.dev/playground/r/2KTv26p/javascript.express.security.express-phantom-injection.express-phantom-injection
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
require('phantom');
...
- pattern-inside: |
import 'phantom';
...
- pattern-either:
- pattern: $PAGE.open($SINK,...)
- pattern: $PAGE.setContent($SINK,...)
- pattern: $PAGE.openUrl($SINK,...)
- pattern: $PAGE.evaluateJavaScript($SINK,...)
- pattern: $PAGE.property("content",$SINK,...)
- focus-metavariable: $SINK
- id: javascript.express.security.express-puppeteer-injection.express-puppeteer-injection
message: If unverified user data can reach the `puppeteer` methods it can result
in Server-Side Request Forgery vulnerabilities
metadata:
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
category: security
technology:
- express
references:
- https://pptr.dev/api/puppeteer.page
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection
shortlink: https://sg.run/0QJB
semgrep.dev:
rule:
r_id: 9254
rv_id: 1263168
rule_id: X5U8Nz
version_id: X0TzyJY
url: https://semgrep.dev/playground/r/X0TzyJY/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
require('puppeteer');
...
- pattern-inside: |
import 'puppeteer';
...
- pattern-either:
- pattern: $PAGE.goto($SINK,...)
- pattern: $PAGE.setContent($SINK,...)
- pattern: $PAGE.evaluate($SINK,...)
- pattern: $PAGE.evaluate($CODE,$SINK,...)
- pattern: $PAGE.evaluateHandle($SINK,...)
- pattern: $PAGE.evaluateHandle($CODE,$SINK,...)
- pattern: $PAGE.evaluateOnNewDocument($SINK,...)
- pattern: $PAGE.evaluateOnNewDocument($CODE,$SINK,...)
- focus-metavariable: $SINK
- id: javascript.express.security.express-sandbox-injection.express-sandbox-code-injection
message: Make sure that unverified user data can not reach `sandbox`.
metadata:
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
category: security
technology:
- express
cwe2022-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection
shortlink: https://sg.run/KlwL
semgrep.dev:
rule:
r_id: 9255
rv_id: 1263169
rule_id: j2UvXB
version_id: jQTn59D
url: https://semgrep.dev/playground/r/jQTn59D/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern-inside: |
$SANDBOX = require('sandbox');
...
- pattern-either:
- patterns:
- pattern-inside: |
$S = new $SANDBOX(...);
...
- pattern: |
$S.run(...)
- pattern: |
new $SANDBOX($OPTS).run(...)
- pattern: new $SANDBOX().run(...)
- id: javascript.express.security.express-xml2json-xxe.express-xml2json-xxe
message: Make sure that unverified user data can not reach the XML Parser, as it
can result in XML External or Internal Entity (XXE) Processing vulnerabilities
metadata:
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
category: security
technology:
- express
references:
- https://www.npmjs.com/package/xml2json
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe
shortlink: https://sg.run/XBD4
semgrep.dev:
rule:
r_id: 9264
rv_id: 1263174
rule_id: x8Uneb
version_id: bZT534J
url: https://semgrep.dev/playground/r/bZT534J/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- pattern: $REQ.files.$ANYTHING.data.toString('utf8')
- pattern: $REQ.files.$ANYTHING['data'].toString('utf8')
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
- pattern: files.$ANYTHING.data.toString('utf8')
- pattern: files.$ANYTHING['data'].toString('utf8')
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
require('xml2json');
...
- pattern-inside: |
import 'xml2json';
...
- pattern: $EXPAT.toJson($SINK,...)
- focus-metavariable: $SINK
- id: javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal
message: Possible writing outside of the destination, make sure that the target
path is nested in the intended destination
metadata:
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
category: security
references:
- https://owasp.org/www-community/attacks/Path_Traversal
technology:
- express
- node.js
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal
shortlink: https://sg.run/weRn
semgrep.dev:
rule:
r_id: 9273
rv_id: 1263141
rule_id: L1Uyb8
version_id: ExTExX0
url: https://semgrep.dev/playground/r/ExTExX0/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- focus-metavariable: $SINK
- pattern-either:
- pattern-inside: |
$PATH = require('path');
...
- pattern-inside: |
import $PATH from 'path';
...
- pattern-either:
- pattern: $PATH.join(...,$SINK,...)
- pattern: $PATH.resolve(...,$SINK,...)
- patterns:
- focus-metavariable: $SINK
- pattern-inside: |
import 'path';
...
- pattern-either:
- pattern: path.join(...,$SINK,...)
- pattern: path.resolve(...,$SINK,...)
pattern-sanitizers:
- pattern: $Y.replace(...)
- pattern: $Y.indexOf(...)
- pattern: |
function ... (...) {
...
<... $Y.indexOf(...) ...>
...
}
- patterns:
- pattern: $FUNC(...)
- metavariable-regex:
metavariable: $FUNC
regex: sanitize
- id: javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event
message: Xml Parser is used inside Request Event. Make sure that unverified user
data can not reach the XML Parser, as it can result in XML External or Internal
Entity (XXE) Processing vulnerabilities
metadata:
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
category: security
technology:
- express
references:
- https://www.npmjs.com/package/xml2json
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event
shortlink: https://sg.run/x1AA
semgrep.dev:
rule:
r_id: 9274
rv_id: 1263146
rule_id: 8GUjkk
version_id: QkTGqgo
url: https://semgrep.dev/playground/r/QkTGqgo/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
require('xml2json');
...
- pattern-inside: |
import 'xml2json';
...
- pattern: $REQ.on('...', function(...) { ... $EXPAT.toJson($INPUT,...); ... })
- focus-metavariable: $INPUT
- id: javascript.express.security.audit.xss.direct-response-write.direct-response-write
message: Detected directly writing to a Response object from user-defined input.
This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting
(XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML.
options:
interfile: true
metadata:
interfile: true
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
category: security
technology:
- express
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
vulnerability_class:
- Cross-Site-Scripting (XSS)
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write
shortlink: https://sg.run/vzGl
semgrep.dev:
rule:
r_id: 9277
rv_id: 1263150
rule_id: 3qUPA1
version_id: JdTzxeg
url: https://semgrep.dev/playground/r/JdTzxeg/javascript.express.security.audit.xss.direct-response-write.direct-response-write
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)
- pattern-not-inside: |
function ... ($REQ, $RES) {
...
$RES.$SET('Content-Type', '$TYPE')
}
- pattern-not-inside: |
$APP.$METHOD(..., function $FUNC($REQ, $RES) {
...
$RES.$SET('Content-Type', '$TYPE')
})
- pattern-not-inside: |
function ... ($REQ, $RES, $NEXT) {
...
$RES.$SET('Content-Type', '$TYPE')
}
- pattern-not-inside: |
function ... ($REQ, $RES) {
...
$RES.set('$TYPE')
}
- pattern-not-inside: |
$APP.$METHOD(..., function $FUNC($REQ, $RES) {
...
$RES.set('$TYPE')
})
- pattern-not-inside: |
function ... ($REQ, $RES, $NEXT) {
...
$RES.set('$TYPE')
}
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- pattern-not-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{
...
$RES.$SET('Content-Type', '$TYPE')
}
- pattern-not-inside: |
({ $REQ }: Request,$RES: Response) => {
...
$RES.$SET('Content-Type', '$TYPE')
}
- pattern-not-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{
...
$RES.set('$TYPE')
}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: body
pattern-sinks:
- patterns:
- pattern-inside: function ... (..., $RES,...) {...}
- pattern-either:
- pattern: $RES.write($ARG)
- pattern: $RES.send($ARG)
- pattern-not: $RES. ... .set('...'). ... .send($ARG)
- pattern-not: $RES. ... .type('...'). ... .send($ARG)
- pattern-not-inside: $RES.$METHOD({ ... })
- focus-metavariable: $ARG
pattern-sanitizers:
- patterns:
- pattern-either:
- pattern-inside: |
import $S from "underscore.string"
...
- pattern-inside: |
import * as $S from "underscore.string"
...
- pattern-inside: |
import $S from "underscore.string"
...
- pattern-inside: |
$S = require("underscore.string")
...
- pattern-either:
- pattern: $S.escapeHTML(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from "dompurify"
...
- pattern-inside: |
import { ..., $S,... } from "dompurify"
...
- pattern-inside: |
import * as $S from "dompurify"
...
- pattern-inside: |
$S = require("dompurify")
...
- pattern-inside: |
import $S from "isomorphic-dompurify"
...
- pattern-inside: |
import * as $S from "isomorphic-dompurify"
...
- pattern-inside: |
$S = require("isomorphic-dompurify")
...
- pattern-either:
- patterns:
- pattern-inside: |
$VALUE = $S(...)
...
- pattern: $VALUE.sanitize(...)
- patterns:
- pattern-inside: |
$VALUE = $S.sanitize
...
- pattern: $S(...)
- pattern: $S.sanitize(...)
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'xss';
...
- pattern-inside: |
import * as $S from 'xss';
...
- pattern-inside: |
$S = require("xss")
...
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'sanitize-html';
...
- pattern-inside: |
import * as $S from "sanitize-html";
...
- pattern-inside: |
$S = require("sanitize-html")
...
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
$S = new Remarkable()
...
- pattern: $S.render(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'express-xss-sanitizer';
...
- pattern-inside: |
import * as $S from "express-xss-sanitizer";
...
- pattern-inside: |
const { ..., $S, ... } = require('express-xss-sanitizer');
...
- pattern-inside: |
var { ..., $S, ... } = require('express-xss-sanitizer');
...
- pattern-inside: |
let { ...,$S,... } = require('express-xss-sanitizer');
...
- pattern-inside: |
$S = require("express-xss-sanitizer")
...
- pattern: $S(...)
- patterns:
- pattern: $RES. ... .type('$F'). ... .send(...)
- metavariable-regex:
metavariable: $F
regex: (?!.*text/html)
- patterns:
- pattern-inside: |
$X = [...];
...
- pattern: |
if(<... !$X.includes($SOURCE)...>) {
...
return ...
}
...
- pattern: $SOURCE
- id: javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
metadata:
interfile: true
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
asvs:
section: 'V3: Session Management Verification Requirements'
control_id: 3.5.2 Static API keys or secret
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
version: '4'
category: security
technology:
- jose
- jwt
- secrets
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret
shortlink: https://sg.run/Ro1g
semgrep.dev:
rule:
r_id: 9293
rv_id: 1263182
rule_id: JDUyRl
version_id: d6TyxbX
url: https://semgrep.dev/playground/r/d6TyxbX/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-inside: |
$JOSE = require("jose");
...
- pattern-either:
- pattern-inside: |
var {JWT} = $JOSE;
...
- pattern-inside: |
var {JWK, JWT} = $JOSE;
...
- pattern-inside: |
const {JWT} = $JOSE;
...
- pattern-inside: |
const {JWK, JWT} = $JOSE;
...
- pattern-inside: |
let {JWT} = $JOSE;
...
- pattern-inside: |
let {JWK, JWT} = $JOSE;
...
- pattern-either:
- pattern: |
JWT.verify($P, "...", ...);
- pattern: |
JWT.sign($P, "...", ...);
- pattern: "JWT.verify($P, JWK.asKey(\"...\"), ...); \n"
- pattern: |
$JWT.sign($P, JWK.asKey("..."), ...);
options:
symbolic_propagation: true
interfile: true
- id: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
asvs:
section: 'V3: Session Management Verification Requirements'
control_id: 3.5.2 Static API keys or secret
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
version: '4'
category: security
technology:
- jwt
- javascript
- secrets
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret
shortlink: https://sg.run/4xN9
semgrep.dev:
rule:
r_id: 9300
rv_id: 1263189
rule_id: WAUon7
version_id: gETB75D
url: https://semgrep.dev/playground/r/gETB75D/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern: "$X = '...' \n"
- pattern: "$X = '$Y' \n"
- patterns:
- pattern-either:
- pattern-inside: |
$JWT.sign($DATA,"...",...);
- pattern-inside: |
$JWT.verify($DATA,"...",...);
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
$JWT = require("jsonwebtoken")
...
- pattern-inside: |
import $JWT from "jsonwebtoken"
...
- pattern-inside: |
import * as $JWT from "jsonwebtoken"
...
- pattern-inside: |
import {...,$JWT,...} from "jsonwebtoken"
...
- pattern-either:
- pattern-inside: |
$JWT.sign($DATA,$VALUE,...);
- pattern-inside: |
$JWT.verify($DATA,$VALUE,...);
- focus-metavariable: $VALUE
- id: javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
asvs:
section: 'V3: Session Management Verification Requirements'
control_id: 3.5.2 Static API keys or secret
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management
version: '4'
category: security
technology:
- jwt
- nodejs
- secrets
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret
shortlink: https://sg.run/vz70
semgrep.dev:
rule:
r_id: 9333
rv_id: 1263225
rule_id: QrUzq6
version_id: X0TzyoE
url: https://semgrep.dev/playground/r/X0TzyoE/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- by-side-effect: true
patterns:
- pattern-either:
- pattern: |
{..., clientSecret: "...", ...}
- pattern: |
{..., secretOrKey: "...", ...}
- pattern: |
{..., consumerSecret: "...", ...}
- patterns:
- pattern-inside: |
$OBJ = {}
...
- pattern-either:
- pattern: |
$OBJ.clientSecret = "..."
- pattern: |
$OBJ.secretOrKey = "..."
- pattern: |
$OBJ.consumerSecret = "..."
- pattern: $OBJ
- patterns:
- pattern-inside: |
$SECRET = '...'
...
- pattern-either:
- pattern: |
{..., clientSecret: $SECRET, ...}
- pattern: |
{..., secretOrKey: $SECRET, ...}
- pattern: |
{..., consumerSecret: $SECRET, ...}
- patterns:
- pattern-inside: |
$SECRET = '...'
...
- pattern-either:
- pattern-inside: |
$VALUE = {..., clientSecret: $SECRET, ...}
...
- pattern-inside: |
$VALUE = {..., secretOrKey: $SECRET, ...}
...
- pattern-inside: |
$VALUE = {..., consumerSecret: $SECRET, ...}
...
- pattern: $VALUE
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
$F = require("$I").Strategy
...
- pattern-inside: |
$F = require("$I")
...
- pattern-inside: |
import { $STRAT as $F } from '$I'
...
- pattern-inside: |
import $F from '$I'
...
- metavariable-regex:
metavariable: $I
regex: (passport-.*)
- pattern-inside: |
new $F($VALUE,...)
- focus-metavariable: $VALUE
- id: python.boto3.security.hardcoded-token.hardcoded-token
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
- https://bento.dev/checks/boto3/hardcoded-access-token/
- https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
category: security
technology:
- boto3
- secrets
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token
shortlink: https://sg.run/LwQ6
semgrep.dev:
rule:
r_id: 9439
rv_id: 1263347
rule_id: 5rUOwK
version_id: gETB78n
url: https://semgrep.dev/playground/r/gETB78n/python.boto3.security.hardcoded-token.hardcoded-token
origin: community
languages:
- python
severity: WARNING
mode: taint
pattern-sources:
- pattern: |
"..."
pattern-sinks:
- patterns:
- pattern-either:
- pattern: $W(...,$TOKEN="$VALUE",...)
- pattern: $BOTO. ... .$W(...,$TOKEN="$VALUE",...)
- metavariable-regex:
metavariable: $TOKEN
regex: (aws_session_token|aws_access_key_id|aws_secret_access_key)
- metavariable-pattern:
language: generic
metavariable: $VALUE
patterns:
- pattern-either:
- pattern-regex: ^AKI
- pattern-regex: ^[A-Za-z0-9/+=]+$
- metavariable-analysis:
metavariable: $VALUE
analyzer: entropy
- id: python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization
metadata:
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
references:
- https://docs.python.org/3/library/pickle.html
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization
shortlink: https://sg.run/9oyr
semgrep.dev:
rule:
r_id: 9467
rv_id: 1409400
rule_id: OrU3e6
version_id: GxTlb9e
url: https://semgrep.dev/playground/r/GxTlb9e/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization
origin: community
message: Avoid using insecure deserialization library, backed by `pickle`, `_pickle`,
`cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code
execution vulnerabilities.
languages:
- python
severity: ERROR
mode: taint
pattern-sources:
- pattern-either:
- patterns:
- pattern-inside: |
def $INSIDE(..., $PARAM, ...):
...
- pattern-either:
- pattern: request.$REQFUNC(...)
- pattern: request.$REQFUNC.get(...)
- pattern: request.$REQFUNC[...]
pattern-sinks:
- pattern-either:
- patterns:
- pattern-either:
- pattern: |
pickle.$PICKLEFUNC(...)
- pattern: |
_pickle.$PICKLEFUNC(...)
- pattern: |
cPickle.$PICKLEFUNC(...)
- pattern: |
shelve.$PICKLEFUNC(...)
- metavariable-regex:
metavariable: $PICKLEFUNC
regex: dumps|dump|load|loads
- patterns:
- pattern: dill.$DILLFUNC(...)
- metavariable-regex:
metavariable: $DILLFUNC
regex: dump|dump_session|dumps|load|load_session|loads
- patterns:
- pattern: yaml.$YAMLFUNC(...)
- pattern-not: yaml.$YAMLFUNC(..., Dumper=SafeDumper, ...)
- pattern-not: yaml.$YAMLFUNC(..., Dumper=yaml.SafeDumper, ...)
- pattern-not: yaml.$YAMLFUNC(..., Loader=SafeLoader, ...)
- pattern-not: yaml.$YAMLFUNC(..., Loader=yaml.SafeLoader, ...)
- metavariable-regex:
metavariable: $YAMLFUNC
regex: dump|dump_all|load|load_all
- id: python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse
message: Found user-controlled request data passed into HttpResponse. This could
be vulnerable to XSS, leading to attackers gaining access to user cookies and
protected information. Ensure that the request data is properly escaped or sanitzed.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse
shortlink: https://sg.run/BkvA
semgrep.dev:
rule:
r_id: 9495
rv_id: 1263398
rule_id: JDUydR
version_id: GxTke5K
url: https://semgrep.dev/playground/r/GxTke5K/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: django.http.HttpResponse(..., $S.format(..., request.$W.get(...), ...),
...)
- pattern: django.http.HttpResponse(..., $S % request.$W.get(...), ...)
- pattern: django.http.HttpResponse(..., f"...{request.$W.get(...)}...", ...)
- pattern: django.http.HttpResponse(..., request.$W.get(...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponse(..., $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponse(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponse(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponse(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: $A = django.http.HttpResponse(..., request.$W.get(...), ...)
- pattern: return django.http.HttpResponse(..., request.$W.get(...), ...)
- pattern: django.http.HttpResponse(..., $S.format(..., request.$W(...), ...),
...)
- pattern: django.http.HttpResponse(..., $S % request.$W(...), ...)
- pattern: django.http.HttpResponse(..., f"...{request.$W(...)}...", ...)
- pattern: django.http.HttpResponse(..., request.$W(...), ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponse(..., $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponse(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponse(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponse(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: $A = django.http.HttpResponse(..., request.$W(...), ...)
- pattern: return django.http.HttpResponse(..., request.$W(...), ...)
- pattern: django.http.HttpResponse(..., $S.format(..., request.$W[...], ...),
...)
- pattern: django.http.HttpResponse(..., $S % request.$W[...], ...)
- pattern: django.http.HttpResponse(..., f"...{request.$W[...]}...", ...)
- pattern: django.http.HttpResponse(..., request.$W[...], ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponse(..., $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponse(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponse(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponse(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: $A = django.http.HttpResponse(..., request.$W[...], ...)
- pattern: return django.http.HttpResponse(..., request.$W[...], ...)
- pattern: django.http.HttpResponse(..., $S.format(..., request.$W, ...), ...)
- pattern: django.http.HttpResponse(..., $S % request.$W, ...)
- pattern: django.http.HttpResponse(..., f"...{request.$W}...", ...)
- pattern: django.http.HttpResponse(..., request.$W, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponse(..., $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponse(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponse(..., f"...{$DATA}...", ...)
- pattern: $A = django.http.HttpResponse(..., request.$W, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
$A = django.http.HttpResponse(..., $INTERM, ...)
- pattern: return django.http.HttpResponse(..., request.$W, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
django.http.HttpResponse(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponse(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
django.http.HttpResponse(..., $INTERM, ...)
- id: python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest
message: Found user-controlled request data passed into a HttpResponseBadRequest.
This could be vulnerable to XSS, leading to attackers gaining access to user cookies
and protected information. Ensure that the request data is properly escaped or
sanitzed.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest
shortlink: https://sg.run/DoZP
semgrep.dev:
rule:
r_id: 9496
rv_id: 1263399
rule_id: 5rUOX1
version_id: RGT0LY6
url: https://semgrep.dev/playground/r/RGT0LY6/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W.get(...),
...), ...)
- pattern: django.http.HttpResponseBadRequest(..., $S % request.$W.get(...), ...)
- pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W.get(...)}...",
...)
- pattern: django.http.HttpResponseBadRequest(..., request.$W.get(...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponseBadRequest(..., $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponseBadRequest(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.HttpResponseBadRequest(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: $A = django.http.HttpResponseBadRequest(..., request.$W.get(...), ...)
- pattern: return django.http.HttpResponseBadRequest(..., request.$W.get(...),
...)
- pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W(...),
...), ...)
- pattern: django.http.HttpResponseBadRequest(..., $S % request.$W(...), ...)
- pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W(...)}...",
...)
- pattern: django.http.HttpResponseBadRequest(..., request.$W(...), ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponseBadRequest(..., $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponseBadRequest(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.HttpResponseBadRequest(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: $A = django.http.HttpResponseBadRequest(..., request.$W(...), ...)
- pattern: return django.http.HttpResponseBadRequest(..., request.$W(...), ...)
- pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W[...],
...), ...)
- pattern: django.http.HttpResponseBadRequest(..., $S % request.$W[...], ...)
- pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W[...]}...",
...)
- pattern: django.http.HttpResponseBadRequest(..., request.$W[...], ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponseBadRequest(..., $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponseBadRequest(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.HttpResponseBadRequest(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: $A = django.http.HttpResponseBadRequest(..., request.$W[...], ...)
- pattern: return django.http.HttpResponseBadRequest(..., request.$W[...], ...)
- pattern: django.http.HttpResponseBadRequest(..., $S.format(..., request.$W,
...), ...)
- pattern: django.http.HttpResponseBadRequest(..., $S % request.$W, ...)
- pattern: django.http.HttpResponseBadRequest(..., f"...{request.$W}...", ...)
- pattern: django.http.HttpResponseBadRequest(..., request.$W, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponseBadRequest(..., $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponseBadRequest(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponseBadRequest(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.http.HttpResponseBadRequest(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
django.http.HttpResponseBadRequest(..., $INTERM, ...)
- pattern: $A = django.http.HttpResponseBadRequest(..., request.$W, ...)
- pattern: return django.http.HttpResponseBadRequest(..., request.$W, ...)
- id: python.django.security.injection.request-data-fileresponse.request-data-fileresponse
message: Found user-controlled request data being passed into a file open, which
is them passed as an argument into the FileResponse. This is dangerous because
an attacker could specify an arbitrary file to read, which could result in leaking
important data. Be sure to validate or sanitize the user-inputted filename in
the request data before using it in FileResponse.
metadata:
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse
shortlink: https://sg.run/W862
semgrep.dev:
rule:
r_id: 9497
rv_id: 1263400
rule_id: GdU7QR
version_id: A8Tgd1K
url: https://semgrep.dev/playground/r/A8Tgd1K/python.django.security.injection.request-data-fileresponse.request-data-fileresponse
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: django.http.FileResponse(..., request.$W.get(...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.http.FileResponse(..., open($DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = open($DATA, ...)
...
django.http.FileResponse(..., $INTERM, ...)
- pattern: $A = django.http.FileResponse(..., request.$W.get(...), ...)
- pattern: return django.http.FileResponse(..., request.$W.get(...), ...)
- pattern: django.http.FileResponse(..., request.$W(...), ...)
- pattern: |
$DATA = request.$W(...)
...
django.http.FileResponse(..., open($DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = open($DATA, ...)
...
django.http.FileResponse(..., $INTERM, ...)
- pattern: $A = django.http.FileResponse(..., request.$W(...), ...)
- pattern: return django.http.FileResponse(..., request.$W(...), ...)
- pattern: django.http.FileResponse(..., request.$W[...], ...)
- pattern: |
$DATA = request.$W[...]
...
django.http.FileResponse(..., open($DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = open($DATA, ...)
...
django.http.FileResponse(..., $INTERM, ...)
- pattern: $A = django.http.FileResponse(..., request.$W[...], ...)
- pattern: return django.http.FileResponse(..., request.$W[...], ...)
- pattern: django.http.FileResponse(..., request.$W, ...)
- pattern: |
$DATA = request.$W
...
django.http.FileResponse(..., open($DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = open($DATA, ...)
...
django.http.FileResponse(..., $INTERM, ...)
- pattern: $A = django.http.FileResponse(..., request.$W, ...)
- pattern: return django.http.FileResponse(..., request.$W, ...)
- id: python.django.security.injection.command.command-injection-os-system.command-injection-os-system
message: Request data detected in os.system. This could be vulnerable to a command
injection and should be avoided. If this must be done, use the 'subprocess' module
instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection
for more information.
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/www-community/attacks/Command_Injection
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system
shortlink: https://sg.run/Gen2
semgrep.dev:
rule:
r_id: 9504
rv_id: 1263387
rule_id: KxUbp2
version_id: ExTExPo
url: https://semgrep.dev/playground/r/ExTExPo/python.django.security.injection.command.command-injection-os-system.command-injection-os-system
origin: community
languages:
- python
severity: ERROR
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: os.system(..., request.$W.get(...), ...)
- pattern: os.system(..., $S.format(..., request.$W.get(...), ...), ...)
- pattern: os.system(..., $S % request.$W.get(...), ...)
- pattern: os.system(..., f"...{request.$W.get(...)}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
os.system(..., $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
os.system(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
os.system(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
os.system(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
os.system(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
os.system(..., $INTERM, ...)
- pattern: $A = os.system(..., request.$W.get(...), ...)
- pattern: $A = os.system(..., $S.format(..., request.$W.get(...), ...), ...)
- pattern: $A = os.system(..., $S % request.$W.get(...), ...)
- pattern: $A = os.system(..., f"...{request.$W.get(...)}...", ...)
- pattern: return os.system(..., request.$W.get(...), ...)
- pattern: return os.system(..., $S.format(..., request.$W.get(...), ...), ...)
- pattern: return os.system(..., $S % request.$W.get(...), ...)
- pattern: return os.system(..., f"...{request.$W.get(...)}...", ...)
- pattern: os.system(..., request.$W(...), ...)
- pattern: os.system(..., $S.format(..., request.$W(...), ...), ...)
- pattern: os.system(..., $S % request.$W(...), ...)
- pattern: os.system(..., f"...{request.$W(...)}...", ...)
- pattern: |
$DATA = request.$W(...)
...
os.system(..., $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
os.system(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
os.system(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
os.system(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
os.system(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
os.system(..., $INTERM, ...)
- pattern: $A = os.system(..., request.$W(...), ...)
- pattern: $A = os.system(..., $S.format(..., request.$W(...), ...), ...)
- pattern: $A = os.system(..., $S % request.$W(...), ...)
- pattern: $A = os.system(..., f"...{request.$W(...)}...", ...)
- pattern: return os.system(..., request.$W(...), ...)
- pattern: return os.system(..., $S.format(..., request.$W(...), ...), ...)
- pattern: return os.system(..., $S % request.$W(...), ...)
- pattern: return os.system(..., f"...{request.$W(...)}...", ...)
- pattern: os.system(..., request.$W[...], ...)
- pattern: os.system(..., $S.format(..., request.$W[...], ...), ...)
- pattern: os.system(..., $S % request.$W[...], ...)
- pattern: os.system(..., f"...{request.$W[...]}...", ...)
- pattern: |
$DATA = request.$W[...]
...
os.system(..., $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
os.system(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
os.system(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
os.system(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
os.system(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
os.system(..., $INTERM, ...)
- pattern: $A = os.system(..., request.$W[...], ...)
- pattern: $A = os.system(..., $S.format(..., request.$W[...], ...), ...)
- pattern: $A = os.system(..., $S % request.$W[...], ...)
- pattern: $A = os.system(..., f"...{request.$W[...]}...", ...)
- pattern: return os.system(..., request.$W[...], ...)
- pattern: return os.system(..., $S.format(..., request.$W[...], ...), ...)
- pattern: return os.system(..., $S % request.$W[...], ...)
- pattern: return os.system(..., f"...{request.$W[...]}...", ...)
- pattern: os.system(..., request.$W, ...)
- pattern: os.system(..., $S.format(..., request.$W, ...), ...)
- pattern: os.system(..., $S % request.$W, ...)
- pattern: os.system(..., f"...{request.$W}...", ...)
- pattern: |
$DATA = request.$W
...
os.system(..., $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
os.system(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
os.system(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
os.system(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
os.system(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
os.system(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
os.system(..., $INTERM, ...)
- pattern: $A = os.system(..., request.$W, ...)
- pattern: $A = os.system(..., $S.format(..., request.$W, ...), ...)
- pattern: $A = os.system(..., $S % request.$W, ...)
- pattern: $A = os.system(..., f"...{request.$W}...", ...)
- pattern: return os.system(..., request.$W, ...)
- pattern: return os.system(..., $S.format(..., request.$W, ...), ...)
- pattern: return os.system(..., $S % request.$W, ...)
- pattern: return os.system(..., f"...{request.$W}...", ...)
- id: python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open
message: Found request data in a call to 'open'. Ensure the request data is validated
or sanitized, otherwise it could result in path traversal attacks and therefore
sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath
or the pathlib library.
metadata:
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://owasp.org/www-community/attacks/Path_Traversal
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open
shortlink: https://sg.run/W8qg
semgrep.dev:
rule:
r_id: 9509
rv_id: 1263396
rule_id: oqUe7z
version_id: JdTzxAw
url: https://semgrep.dev/playground/r/JdTzxAw/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: open(..., request.$W.get(...), ...)
- pattern: open(..., $S.format(..., request.$W.get(...), ...), ...)
- pattern: open(..., $S % request.$W.get(...), ...)
- pattern: open(..., f"...{request.$W.get(...)}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
open(..., $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W.get(...)
...
open(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W.get(...)
...
open(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W.get(...)
...
open(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W.get(...)
...
open(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: $A = open(..., request.$W.get(...), ...)
- pattern: $A = open(..., $S.format(..., request.$W.get(...), ...), ...)
- pattern: $A = open(..., $S % request.$W.get(...), ...)
- pattern: $A = open(..., f"...{request.$W.get(...)}...", ...)
- pattern: return open(..., request.$W.get(...), ...)
- pattern: return open(..., $S.format(..., request.$W.get(...), ...), ...)
- pattern: return open(..., $S % request.$W.get(...), ...)
- pattern: return open(..., f"...{request.$W.get(...)}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
with open(..., $DATA, ...) as $FD:
...
- pattern: open(..., request.$W(...), ...)
- pattern: open(..., $S.format(..., request.$W(...), ...), ...)
- pattern: open(..., $S % request.$W(...), ...)
- pattern: open(..., f"...{request.$W(...)}...", ...)
- pattern: |
$DATA = request.$W(...)
...
open(..., $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W(...)
...
open(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W(...)
...
open(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W(...)
...
open(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W(...)
...
open(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: $A = open(..., request.$W(...), ...)
- pattern: $A = open(..., $S.format(..., request.$W(...), ...), ...)
- pattern: $A = open(..., $S % request.$W(...), ...)
- pattern: $A = open(..., f"...{request.$W(...)}...", ...)
- pattern: return open(..., request.$W(...), ...)
- pattern: return open(..., $S.format(..., request.$W(...), ...), ...)
- pattern: return open(..., $S % request.$W(...), ...)
- pattern: return open(..., f"...{request.$W(...)}...", ...)
- pattern: |
$DATA = request.$W(...)
...
with open(..., $DATA, ...) as $FD:
...
- pattern: open(..., request.$W[...], ...)
- pattern: open(..., $S.format(..., request.$W[...], ...), ...)
- pattern: open(..., $S % request.$W[...], ...)
- pattern: open(..., f"...{request.$W[...]}...", ...)
- pattern: |
$DATA = request.$W[...]
...
open(..., $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W[...]
...
open(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W[...]
...
open(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W[...]
...
open(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W[...]
...
open(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: $A = open(..., request.$W[...], ...)
- pattern: $A = open(..., $S.format(..., request.$W[...], ...), ...)
- pattern: $A = open(..., $S % request.$W[...], ...)
- pattern: $A = open(..., f"...{request.$W[...]}...", ...)
- pattern: return open(..., request.$W[...], ...)
- pattern: return open(..., $S.format(..., request.$W[...], ...), ...)
- pattern: return open(..., $S % request.$W[...], ...)
- pattern: return open(..., f"...{request.$W[...]}...", ...)
- pattern: |
$DATA = request.$W[...]
...
with open(..., $DATA, ...) as $FD:
...
- pattern: open(..., request.$W, ...)
- pattern: open(..., $S.format(..., request.$W, ...), ...)
- pattern: open(..., $S % request.$W, ...)
- pattern: open(..., f"...{request.$W}...", ...)
- pattern: |
$DATA = request.$W
...
open(..., $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W
...
open(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W
...
open(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W
...
open(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: |
$DATA = request.$W
...
open(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
open(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
with open(..., $INTERM, ...) as $FD:
...
- pattern: $A = open(..., request.$W, ...)
- pattern: $A = open(..., $S.format(..., request.$W, ...), ...)
- pattern: $A = open(..., $S % request.$W, ...)
- pattern: $A = open(..., f"...{request.$W}...", ...)
- pattern: return open(..., request.$W, ...)
- pattern: return open(..., $S.format(..., request.$W, ...), ...)
- pattern: return open(..., $S % request.$W, ...)
- pattern: return open(..., f"...{request.$W}...", ...)
- pattern: |
$DATA = request.$W
...
with open(..., $DATA, ...) as $FD:
...
- id: python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where
message: User-controlled data from a request is passed to 'extra()'. This could
lead to a SQL injection and therefore protected information could be leaked. Instead,
use parameterized queries or escape the user-controlled data by using `params`
and not using quote placeholders in the SQL string.
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.0/ref/models/expressions/#.objects.extra
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where
shortlink: https://sg.run/0Ql5
semgrep.dev:
rule:
r_id: 9510
rv_id: 1263402
rule_id: zdUkx1
version_id: DkTRb4l
url: https://semgrep.dev/playground/r/DkTRb4l/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W.get(...),
...), ...], ...)
- pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W.get(...), ...],
...)
- pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W.get(...)}...",
...], ...)
- pattern: $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...],
...)
- pattern: return $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...],
...)
- pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W(...),
...), ...], ...)
- pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W(...), ...], ...)
- pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W(...)}...", ...],
...)
- pattern: $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...)
- pattern: return $MODEL.objects.extra(..., where=[..., request.$W(...), ...],
...)
- pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W[...],
...), ...], ...)
- pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W[...], ...], ...)
- pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W[...]}...", ...],
...)
- pattern: $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...)
- pattern: return $MODEL.objects.extra(..., where=[..., request.$W[...], ...],
...)
- pattern: $MODEL.objects.extra(..., where=[..., $S.format(..., request.$W, ...),
...], ...)
- pattern: $MODEL.objects.extra(..., where=[..., $S % request.$W, ...], ...)
- pattern: $MODEL.objects.extra(..., where=[..., f"...{request.$W}...", ...],
...)
- pattern: $MODEL.objects.extra(..., where=[..., request.$W, ...], ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.extra(..., where=[..., f"...{$DATA}...", ...], ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: $A = $MODEL.objects.extra(..., where=[..., request.$W, ...], ...)
- pattern: return $MODEL.objects.extra(..., where=[..., request.$W, ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % (..., $DATA, ...)
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % (..., $DATA, ...)
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % (..., $DATA, ...)
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % (..., $DATA, ...)
...
$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)
- id: python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql
message: User-controlled data from request is passed to 'RawSQL()'. This could lead
to a SQL injection and therefore protected information could be leaked. Instead,
use parameterized queries or escape the user-controlled data by using `params`
and not using quote placeholders in the SQL string.
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.expressions.RawSQL
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql
shortlink: https://sg.run/Kl4X
semgrep.dev:
rule:
r_id: 9511
rv_id: 1263403
rule_id: pKUOBp
version_id: WrTqK2L
url: https://semgrep.dev/playground/r/WrTqK2L/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W.get(...),
...), ...)
- pattern: django.db.models.expressions.RawSQL(..., $S % request.$W.get(...),
...)
- pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W.get(...)}...",
...)
- pattern: django.db.models.expressions.RawSQL(..., request.$W.get(...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.db.models.expressions.RawSQL(..., $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.db.models.expressions.RawSQL(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.db.models.expressions.RawSQL(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: $A = django.db.models.expressions.RawSQL(..., request.$W.get(...),
...)
- pattern: return django.db.models.expressions.RawSQL(..., request.$W.get(...),
...)
- pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W(...),
...), ...)
- pattern: django.db.models.expressions.RawSQL(..., $S % request.$W(...), ...)
- pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W(...)}...",
...)
- pattern: django.db.models.expressions.RawSQL(..., request.$W(...), ...)
- pattern: |
$DATA = request.$W(...)
...
django.db.models.expressions.RawSQL(..., $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.db.models.expressions.RawSQL(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
django.db.models.expressions.RawSQL(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: $A = django.db.models.expressions.RawSQL(..., request.$W(...), ...)
- pattern: return django.db.models.expressions.RawSQL(..., request.$W(...), ...)
- pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W[...],
...), ...)
- pattern: django.db.models.expressions.RawSQL(..., $S % request.$W[...], ...)
- pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W[...]}...",
...)
- pattern: django.db.models.expressions.RawSQL(..., request.$W[...], ...)
- pattern: |
$DATA = request.$W[...]
...
django.db.models.expressions.RawSQL(..., $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.db.models.expressions.RawSQL(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
django.db.models.expressions.RawSQL(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: $A = django.db.models.expressions.RawSQL(..., request.$W[...], ...)
- pattern: return django.db.models.expressions.RawSQL(..., request.$W[...], ...)
- pattern: django.db.models.expressions.RawSQL(..., $S.format(..., request.$W,
...), ...)
- pattern: django.db.models.expressions.RawSQL(..., $S % request.$W, ...)
- pattern: django.db.models.expressions.RawSQL(..., f"...{request.$W}...", ...)
- pattern: django.db.models.expressions.RawSQL(..., request.$W, ...)
- pattern: |
$DATA = request.$W
...
django.db.models.expressions.RawSQL(..., $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.db.models.expressions.RawSQL(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.db.models.expressions.RawSQL(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
django.db.models.expressions.RawSQL(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
django.db.models.expressions.RawSQL(..., $INTERM, ...)
- pattern: $A = django.db.models.expressions.RawSQL(..., request.$W, ...)
- pattern: return django.db.models.expressions.RawSQL(..., request.$W, ...)
- pattern: |
$DATA = request.$W.get(...)
...
django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
django.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % (..., $DATA, ...)
...
django.db.models.expressions.RawSQL($INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % (..., $DATA, ...)
...
django.db.models.expressions.RawSQL($INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % (..., $DATA, ...)
...
django.db.models.expressions.RawSQL($INTERM, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % (..., $DATA, ...)
...
django.db.models.expressions.RawSQL($INTERM, ...)
- id: python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute
message: User-controlled data from a request is passed to 'execute()'. This could
lead to a SQL injection and therefore protected information could be leaked. Instead,
use django's QuerySets, which are built with query parameterization and therefore
not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute
shortlink: https://sg.run/qx7y
semgrep.dev:
rule:
r_id: 9512
rv_id: 1263404
rule_id: 2ZUbDL
version_id: 0bTKzRj
url: https://semgrep.dev/playground/r/0bTKzRj/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: $CURSOR.execute(..., $S.format(..., request.$W.get(...), ...), ...)
- pattern: $CURSOR.execute(..., $S % request.$W.get(...), ...)
- pattern: $CURSOR.execute(..., f"...{request.$W.get(...)}...", ...)
- pattern: $CURSOR.execute(..., request.$W.get(...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$CURSOR.execute(..., $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$CURSOR.execute(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$CURSOR.execute(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$CURSOR.execute(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: $A = $CURSOR.execute(..., request.$W.get(...), ...)
- pattern: return $CURSOR.execute(..., request.$W.get(...), ...)
- pattern: $CURSOR.execute(..., $S.format(..., request.$W(...), ...), ...)
- pattern: $CURSOR.execute(..., $S % request.$W(...), ...)
- pattern: $CURSOR.execute(..., f"...{request.$W(...)}...", ...)
- pattern: $CURSOR.execute(..., request.$W(...), ...)
- pattern: |
$DATA = request.$W(...)
...
$CURSOR.execute(..., $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$CURSOR.execute(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$CURSOR.execute(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$CURSOR.execute(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: $A = $CURSOR.execute(..., request.$W(...), ...)
- pattern: return $CURSOR.execute(..., request.$W(...), ...)
- pattern: $CURSOR.execute(..., $S.format(..., request.$W[...], ...), ...)
- pattern: $CURSOR.execute(..., $S % request.$W[...], ...)
- pattern: $CURSOR.execute(..., f"...{request.$W[...]}...", ...)
- pattern: $CURSOR.execute(..., request.$W[...], ...)
- pattern: |
$DATA = request.$W[...]
...
$CURSOR.execute(..., $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$CURSOR.execute(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$CURSOR.execute(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$CURSOR.execute(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: $A = $CURSOR.execute(..., request.$W[...], ...)
- pattern: return $CURSOR.execute(..., request.$W[...], ...)
- pattern: $CURSOR.execute(..., $S.format(..., request.$W, ...), ...)
- pattern: $CURSOR.execute(..., $S % request.$W, ...)
- pattern: $CURSOR.execute(..., f"...{request.$W}...", ...)
- pattern: $CURSOR.execute(..., request.$W, ...)
- pattern: |
$DATA = request.$W
...
$CURSOR.execute(..., $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$CURSOR.execute(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$CURSOR.execute(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$CURSOR.execute(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
$CURSOR.execute(..., $INTERM, ...)
- pattern: $A = $CURSOR.execute(..., request.$W, ...)
- pattern: return $CURSOR.execute(..., request.$W, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$CURSOR.execute($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$CURSOR.execute($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$CURSOR.execute($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$CURSOR.execute($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % (..., $DATA, ...)
...
$CURSOR.execute($INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % (..., $DATA, ...)
...
$CURSOR.execute($INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % (..., $DATA, ...)
...
$CURSOR.execute($INTERM, ...)
- pattern: |-
$DATA = request.$W
...
$INTERM = $STR % (..., $DATA, ...)
...
$CURSOR.execute($INTERM, ...)
- id: python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw
message: Data that is possible user-controlled from a python request is passed to
`raw()`. This could lead to SQL injection and attackers gaining access to protected
information. Instead, use django's QuerySets, which are built with query parameterization
and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw
shortlink: https://sg.run/l2v9
semgrep.dev:
rule:
r_id: 9513
rv_id: 1263405
rule_id: X5U8v5
version_id: K3TKkBW
url: https://semgrep.dev/playground/r/K3TKkBW/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw
origin: community
languages:
- python
severity: WARNING
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: $MODEL.objects.raw(..., $S.format(..., request.$W.get(...), ...), ...)
- pattern: $MODEL.objects.raw(..., $S % request.$W.get(...), ...)
- pattern: $MODEL.objects.raw(..., f"...{request.$W.get(...)}...", ...)
- pattern: $MODEL.objects.raw(..., request.$W.get(...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.raw(..., $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.raw(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.raw(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.raw(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: $A = $MODEL.objects.raw(..., request.$W.get(...), ...)
- pattern: return $MODEL.objects.raw(..., request.$W.get(...), ...)
- pattern: $MODEL.objects.raw(..., $S.format(..., request.$W(...), ...), ...)
- pattern: $MODEL.objects.raw(..., $S % request.$W(...), ...)
- pattern: $MODEL.objects.raw(..., f"...{request.$W(...)}...", ...)
- pattern: $MODEL.objects.raw(..., request.$W(...), ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.raw(..., $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.raw(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.raw(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.raw(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: $A = $MODEL.objects.raw(..., request.$W(...), ...)
- pattern: return $MODEL.objects.raw(..., request.$W(...), ...)
- pattern: $MODEL.objects.raw(..., $S.format(..., request.$W[...], ...), ...)
- pattern: $MODEL.objects.raw(..., $S % request.$W[...], ...)
- pattern: $MODEL.objects.raw(..., f"...{request.$W[...]}...", ...)
- pattern: $MODEL.objects.raw(..., request.$W[...], ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.raw(..., $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.raw(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.raw(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.raw(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: $A = $MODEL.objects.raw(..., request.$W[...], ...)
- pattern: return $MODEL.objects.raw(..., request.$W[...], ...)
- pattern: $MODEL.objects.raw(..., $S.format(..., request.$W, ...), ...)
- pattern: $MODEL.objects.raw(..., $S % request.$W, ...)
- pattern: $MODEL.objects.raw(..., f"...{request.$W}...", ...)
- pattern: $MODEL.objects.raw(..., request.$W, ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.raw(..., $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.raw(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.raw(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.raw(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
$MODEL.objects.raw(..., $INTERM, ...)
- pattern: $A = $MODEL.objects.raw(..., request.$W, ...)
- pattern: return $MODEL.objects.raw(..., request.$W, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$MODEL.objects.raw($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$MODEL.objects.raw($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$MODEL.objects.raw($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$MODEL.objects.raw($STR % (..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % (..., $DATA, ...)
...
$MODEL.objects.raw($INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % (..., $DATA, ...)
...
$MODEL.objects.raw($INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % (..., $DATA, ...)
...
$MODEL.objects.raw($INTERM, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % (..., $DATA, ...)
...
$MODEL.objects.raw($INTERM, ...)
- id: python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests
message: Data from request object is passed to a new server-side request. This could
lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes
and hosts are validated against an allowlist, do not forward the response to the
user, and ensure proper authentication and transport-layer security in the proxied
request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
to learn more about SSRF vulnerabilities.
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests
shortlink: https://sg.run/YvY4
semgrep.dev:
rule:
r_id: 9514
rv_id: 1263406
rule_id: j2UvEw
version_id: qkTR7zn
url: https://semgrep.dev/playground/r/qkTR7zn/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests
origin: community
languages:
- python
severity: ERROR
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: requests.$METHOD(..., $S.format(..., request.$W.get(...), ...), ...)
- pattern: requests.$METHOD(..., $S % request.$W.get(...), ...)
- pattern: requests.$METHOD(..., f"...{request.$W.get(...)}...", ...)
- pattern: requests.$METHOD(..., request.$W.get(...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
requests.$METHOD(..., $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
requests.$METHOD(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
requests.$METHOD(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
requests.$METHOD(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
requests.$METHOD(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: $A = requests.$METHOD(..., request.$W.get(...), ...)
- pattern: return requests.$METHOD(..., request.$W.get(...), ...)
- pattern: requests.$METHOD(..., $S.format(..., request.$W(...), ...), ...)
- pattern: requests.$METHOD(..., $S % request.$W(...), ...)
- pattern: requests.$METHOD(..., f"...{request.$W(...)}...", ...)
- pattern: requests.$METHOD(..., request.$W(...), ...)
- pattern: |
$DATA = request.$W(...)
...
requests.$METHOD(..., $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
requests.$METHOD(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
requests.$METHOD(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
requests.$METHOD(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
requests.$METHOD(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: $A = requests.$METHOD(..., request.$W(...), ...)
- pattern: return requests.$METHOD(..., request.$W(...), ...)
- pattern: requests.$METHOD(..., $S.format(..., request.$W[...], ...), ...)
- pattern: requests.$METHOD(..., $S % request.$W[...], ...)
- pattern: requests.$METHOD(..., f"...{request.$W[...]}...", ...)
- pattern: requests.$METHOD(..., request.$W[...], ...)
- pattern: |
$DATA = request.$W[...]
...
requests.$METHOD(..., $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
requests.$METHOD(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
requests.$METHOD(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
requests.$METHOD(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
requests.$METHOD(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: $A = requests.$METHOD(..., request.$W[...], ...)
- pattern: return requests.$METHOD(..., request.$W[...], ...)
- pattern: requests.$METHOD(..., $S.format(..., request.$W, ...), ...)
- pattern: requests.$METHOD(..., $S % request.$W, ...)
- pattern: requests.$METHOD(..., f"...{request.$W}...", ...)
- pattern: requests.$METHOD(..., request.$W, ...)
- pattern: |
$DATA = request.$W
...
requests.$METHOD(..., $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
requests.$METHOD(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
requests.$METHOD(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
requests.$METHOD(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
requests.$METHOD(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
requests.$METHOD(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
requests.$METHOD(..., $INTERM, ...)
- pattern: $A = requests.$METHOD(..., request.$W, ...)
- pattern: return requests.$METHOD(..., request.$W, ...)
- id: python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib
message: Data from request object is passed to a new server-side request. This could
lead to a server-side request forgery (SSRF), which could result in attackers
gaining access to private organization data. To mitigate, ensure that schemes
and hosts are validated against an allowlist, do not forward the response to the
user, and ensure proper authentication and transport-layer security in the proxied
request.
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
category: security
technology:
- django
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib
shortlink: https://sg.run/6n2B
semgrep.dev:
rule:
r_id: 9515
rv_id: 1263407
rule_id: 10UKDo
version_id: l4TJRwD
url: https://semgrep.dev/playground/r/l4TJRwD/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib
origin: community
languages:
- python
severity: ERROR
patterns:
- pattern-inside: |
def $FUNC(...):
...
- pattern-either:
- pattern: urllib.request.urlopen(..., $S.format(..., request.$W.get(...), ...),
...)
- pattern: urllib.request.urlopen(..., $S % request.$W.get(...), ...)
- pattern: urllib.request.urlopen(..., f"...{request.$W.get(...)}...", ...)
- pattern: urllib.request.urlopen(..., request.$W.get(...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
urllib.request.urlopen(..., $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
urllib.request.urlopen(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR % $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
urllib.request.urlopen(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = f"...{$DATA}..."
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W.get(...)
...
urllib.request.urlopen(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W.get(...)
...
$INTERM = $STR + $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: $A = urllib.request.urlopen(..., request.$W.get(...), ...)
- pattern: return urllib.request.urlopen(..., request.$W.get(...), ...)
- pattern: urllib.request.urlopen(..., $S.format(..., request.$W(...), ...), ...)
- pattern: urllib.request.urlopen(..., $S % request.$W(...), ...)
- pattern: urllib.request.urlopen(..., f"...{request.$W(...)}...", ...)
- pattern: urllib.request.urlopen(..., request.$W(...), ...)
- pattern: |
$DATA = request.$W(...)
...
urllib.request.urlopen(..., $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR.format(..., $DATA, ...)
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
urllib.request.urlopen(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR % $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
urllib.request.urlopen(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = f"...{$DATA}..."
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W(...)
...
urllib.request.urlopen(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W(...)
...
$INTERM = $STR + $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: $A = urllib.request.urlopen(..., request.$W(...), ...)
- pattern: return urllib.request.urlopen(..., request.$W(...), ...)
- pattern: urllib.request.urlopen(..., $S.format(..., request.$W[...], ...), ...)
- pattern: urllib.request.urlopen(..., $S % request.$W[...], ...)
- pattern: urllib.request.urlopen(..., f"...{request.$W[...]}...", ...)
- pattern: urllib.request.urlopen(..., request.$W[...], ...)
- pattern: |
$DATA = request.$W[...]
...
urllib.request.urlopen(..., $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR.format(..., $DATA, ...)
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
urllib.request.urlopen(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR % $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
urllib.request.urlopen(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = f"...{$DATA}..."
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W[...]
...
urllib.request.urlopen(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W[...]
...
$INTERM = $STR + $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: $A = urllib.request.urlopen(..., request.$W[...], ...)
- pattern: return urllib.request.urlopen(..., request.$W[...], ...)
- pattern: urllib.request.urlopen(..., $S.format(..., request.$W, ...), ...)
- pattern: urllib.request.urlopen(..., $S % request.$W, ...)
- pattern: urllib.request.urlopen(..., f"...{request.$W}...", ...)
- pattern: urllib.request.urlopen(..., request.$W, ...)
- pattern: |
$DATA = request.$W
...
urllib.request.urlopen(..., $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
urllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR.format(..., $DATA, ...)
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
urllib.request.urlopen(..., $STR % $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR % $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
urllib.request.urlopen(..., f"...{$DATA}...", ...)
- pattern: |
$DATA = request.$W
...
$INTERM = f"...{$DATA}..."
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: |
$DATA = request.$W
...
urllib.request.urlopen(..., $STR + $DATA, ...)
- pattern: |
$DATA = request.$W
...
$INTERM = $STR + $DATA
...
urllib.request.urlopen(..., $INTERM, ...)
- pattern: $A = urllib.request.urlopen(..., request.$W, ...)
- pattern: return urllib.request.urlopen(..., request.$W, ...)
- id: python.flask.security.audit.directly-returned-format-string.directly-returned-format-string
message: Detected Flask route directly returning a formatted string. This is subject
to cross-site scripting if user input can reach the string. Consider using the
template engine instead and rendering pages with 'render_template()'.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- flask
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string
shortlink: https://sg.run/Zv6o
semgrep.dev:
rule:
r_id: 9535
rv_id: 1263416
rule_id: QrUz49
version_id: WrTqKAz
url: https://semgrep.dev/playground/r/WrTqKAz/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string
origin: community
languages:
- python
severity: WARNING
mode: taint
pattern-sources:
- pattern-either:
- patterns:
- pattern-inside: |
@$APP.route(...)
def $FUNC(..., $PARAM, ...):
...
- pattern: $PARAM
- pattern: |
request.$FUNC.get(...)
- pattern: |
request.$FUNC(...)
- pattern: request.$FUNC[...]
pattern-sinks:
- patterns:
- pattern-not-inside: return "..."
- pattern-either:
- pattern: return "...".format(...)
- pattern: return "..." % ...
- pattern: return "..." + ...
- pattern: return ... + "..."
- pattern: return f"...{...}..."
- patterns:
- pattern: return $X
- pattern-either:
- pattern-inside: |
$X = "...".format(...)
...
- pattern-inside: |
$X = "..." % ...
...
- pattern-inside: |
$X = "..." + ...
...
- pattern-inside: |
$X = ... + "..."
...
- pattern-inside: |
$X = f"...{...}..."
...
- pattern-not-inside: |
$X = "..."
...
- id: python.flask.security.injection.os-system-injection.os-system-injection
languages:
- python
severity: ERROR
message: User data detected in os.system. This could be vulnerable to a command
injection and should be avoided. If this must be done, use the 'subprocess' module
instead and pass the arguments as a list.
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/www-community/attacks/Command_Injection
category: security
technology:
- flask
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.flask.security.injection.os-system-injection.os-system-injection
shortlink: https://sg.run/4xzz
semgrep.dev:
rule:
r_id: 9544
rv_id: 1263429
rule_id: BYUN99
version_id: 1QTypw7
url: https://semgrep.dev/playground/r/1QTypw7/python.flask.security.injection.os-system-injection.os-system-injection
origin: community
pattern-either:
- patterns:
- pattern: os.system(...)
- pattern-either:
- pattern-inside: |
@$APP.route($ROUTE, ...)
def $FUNC(..., $ROUTEVAR, ...):
...
os.system(..., <... $ROUTEVAR ...>, ...)
- pattern-inside: |
@$APP.route($ROUTE, ...)
def $FUNC(..., $ROUTEVAR, ...):
...
$INTERM = <... $ROUTEVAR ...>
...
os.system(..., <... $INTERM ...>, ...)
- pattern: os.system(..., <... flask.request.$W.get(...) ...>, ...)
- pattern: os.system(..., <... flask.request.$W[...] ...>, ...)
- pattern: os.system(..., <... flask.request.$W(...) ...>, ...)
- pattern: os.system(..., <... flask.request.$W ...>, ...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W.get(...) ...>
...
os.system(<... $INTERM ...>)
- pattern: os.system(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W[...] ...>
...
os.system(<... $INTERM ...>)
- pattern: os.system(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W(...) ...>
...
os.system(<... $INTERM ...>)
- pattern: os.system(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W ...>
...
os.system(<... $INTERM ...>)
- pattern: os.system(...)
- id: python.flask.security.injection.path-traversal-open.path-traversal-open
languages:
- python
severity: ERROR
message: Found request data in a call to 'open'. Ensure the request data is validated
or sanitized, otherwise it could result in path traversal attacks.
metadata:
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://owasp.org/www-community/attacks/Path_Traversal
category: security
technology:
- flask
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/python.flask.security.injection.path-traversal-open.path-traversal-open
shortlink: https://sg.run/PJRW
semgrep.dev:
rule:
r_id: 9545
rv_id: 1263430
rule_id: DbUpOQ
version_id: 9lT4b94
url: https://semgrep.dev/playground/r/9lT4b94/python.flask.security.injection.path-traversal-open.path-traversal-open
origin: community
pattern-either:
- patterns:
- pattern: open(...)
- pattern-either:
- pattern-inside: |
@$APP.route($ROUTE, ...)
def $FUNC(..., $ROUTEVAR, ...):
...
open(..., <... $ROUTEVAR ...>, ...)
- pattern-inside: |
@$APP.route($ROUTE, ...)
def $FUNC(..., $ROUTEVAR, ...):
...
with open(..., <... $ROUTEVAR ...>, ...) as $FD:
...
- pattern-inside: |
@$APP.route($ROUTE, ...)
def $FUNC(..., $ROUTEVAR, ...):
...
$INTERM = <... $ROUTEVAR ...>
...
open(..., <... $INTERM ...>, ...)
- pattern: open(..., <... flask.request.$W.get(...) ...>, ...)
- pattern: open(..., <... flask.request.$W[...] ...>, ...)
- pattern: open(..., <... flask.request.$W(...) ...>, ...)
- pattern: open(..., <... flask.request.$W ...>, ...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W.get(...) ...>
...
open(<... $INTERM ...>, ...)
- pattern: open(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W[...] ...>
...
open(<... $INTERM ...>, ...)
- pattern: open(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W(...) ...>
...
open(<... $INTERM ...>, ...)
- pattern: open(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W ...>
...
open(<... $INTERM ...>, ...)
- pattern: open(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W.get(...) ...>
...
with open(<... $INTERM ...>, ...) as $F:
...
- pattern: open(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W[...] ...>
...
with open(<... $INTERM ...>, ...) as $F:
...
- pattern: open(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W(...) ...>
...
with open(<... $INTERM ...>, ...) as $F:
...
- pattern: open(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W ...>
...
with open(<... $INTERM ...>, ...) as $F:
...
- pattern: open(...)
- id: python.flask.security.injection.ssrf-requests.ssrf-requests
languages:
- python
severity: ERROR
message: Data from request object is passed to a new server-side request. This could
lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes
and hosts are validated against an allowlist, do not forward the response to the
user, and ensure proper authentication and transport-layer security in the proxied
request.
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
category: security
technology:
- flask
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests
shortlink: https://sg.run/J9LW
semgrep.dev:
rule:
r_id: 9546
rv_id: 1263432
rule_id: WAUoRx
version_id: rxTAKJn
url: https://semgrep.dev/playground/r/rxTAKJn/python.flask.security.injection.ssrf-requests.ssrf-requests
origin: community
pattern-either:
- patterns:
- pattern: requests.$FUNC(...)
- pattern-either:
- pattern-inside: |
@$APP.$ROUTE_METHOD($ROUTE, ...)
def $ROUTE_FUNC(..., $ROUTEVAR, ...):
...
requests.$FUNC(..., <... $ROUTEVAR ...>, ...)
- pattern-inside: |
@$APP.$ROUTE_METHOD($ROUTE, ...)
def $ROUTE_FUNC(..., $ROUTEVAR, ...):
...
$INTERM = <... $ROUTEVAR ...>
...
requests.$FUNC(..., <... $INTERM ...>, ...)
- metavariable-regex:
metavariable: $ROUTE_METHOD
regex: ^(route|get|post|put|delete|patch)$
- pattern: requests.$FUNC(..., <... flask.request.$W.get(...) ...>, ...)
- pattern: requests.$FUNC(..., <... flask.request.$W[...] ...>, ...)
- pattern: requests.$FUNC(..., <... flask.request.$W(...) ...>, ...)
- pattern: requests.$FUNC(..., <... flask.request.$W ...>, ...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W.get(...) ...>
...
requests.$FUNC(<... $INTERM ...>, ...)
- pattern: requests.$FUNC(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W[...] ...>
...
requests.$FUNC(<... $INTERM ...>, ...)
- pattern: requests.$FUNC(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W(...) ...>
...
requests.$FUNC(<... $INTERM ...>, ...)
- pattern: requests.$FUNC(...)
- patterns:
- pattern-inside: |
$INTERM = <... flask.request.$W ...>
...
requests.$FUNC(<... $INTERM ...>, ...)
- pattern: requests.$FUNC(...)
- id: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode
patterns:
- pattern-either:
- patterns:
- pattern: |
jwt.decode(..., options={..., "verify_signature": $BOOL, ...}, ...)
- metavariable-pattern:
metavariable: $BOOL
pattern: |
False
- focus-metavariable: $BOOL
- patterns:
- pattern: |
$OPTS = {..., "verify_signature": $BOOL, ...}
...
jwt.decode(..., options=$OPTS, ...)
- metavariable-pattern:
metavariable: $BOOL
pattern: |
False
- focus-metavariable: $BOOL
message: Detected JWT token decoded with 'verify=False'. This bypasses any integrity
checks for the token which means the token could be tampered with by malicious
actors. Ensure that the JWT token is verified.
metadata:
owasp:
- A02:2017 - Broken Authentication
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe:
- 'CWE-287: Improper Authentication'
references:
- https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96
category: security
technology:
- jwt
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode
shortlink: https://sg.run/6nyB
semgrep.dev:
rule:
r_id: 9559
rv_id: 1263454
rule_id: 10UKjo
version_id: 5PTo12w
url: https://semgrep.dev/playground/r/5PTo12w/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode
origin: community
fix: |
True
severity: ERROR
languages:
- python
- id: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true
patterns:
- pattern: subprocess.$FUNC(..., shell=$TRUE, ...)
- metavariable-pattern:
metavariable: $TRUE
pattern: "True \n"
- pattern-not: subprocess.$FUNC("...", shell=True, ...)
- focus-metavariable: $TRUE
message: Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous
because this call will spawn the command using a shell process. Doing so propagates
current shell settings and variables, which makes it much easier for a malicious
actor to execute commands. Use 'shell=False' instead.
fix: |
False
metadata:
source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
references:
- https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess
- https://docs.python.org/3/library/subprocess.html
category: security
technology:
- python
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- secure default
likelihood: HIGH
impact: LOW
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true
shortlink: https://sg.run/J92w
semgrep.dev:
rule:
r_id: 9646
rv_id: 1263518
rule_id: DbUpz2
version_id: 0bTKzDK
url: https://semgrep.dev/playground/r/0bTKzDK/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true
origin: community
languages:
- python
severity: ERROR
- id: python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load
metadata:
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
references:
- https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation
- https://nvd.nist.gov/vuln/detail/CVE-2017-18342
category: security
technology:
- pyyaml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load
shortlink: https://sg.run/we9Y
semgrep.dev:
rule:
r_id: 9673
rv_id: 1263530
rule_id: ZqU5jZ
version_id: 1QTyprw
url: https://semgrep.dev/playground/r/1QTyprw/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load
origin: community
languages:
- python
message: Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`,
`yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe
methods of deserializing YAML. An attacker with control over the YAML input could
create special YAML input that allows the attacker to run arbitrary Python code.
This would allow the attacker to steal files, download and install malware, or
otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead.
fix-regex:
regex: unsafe_load
replacement: safe_load
count: 1
severity: ERROR
patterns:
- pattern-inside: |
import yaml
...
- pattern-not-inside: |
$YAML = ruamel.yaml.YAML(...)
...
- pattern-either:
- pattern: yaml.unsafe_load(...)
- pattern: yaml.load(..., Loader=yaml.Loader, ...)
- pattern: yaml.load(..., Loader=yaml.UnsafeLoader, ...)
- pattern: yaml.load(..., Loader=yaml.CLoader, ...)
- pattern: yaml.load_all(..., Loader=yaml.Loader, ...)
- pattern: yaml.load_all(..., Loader=yaml.UnsafeLoader, ...)
- pattern: yaml.load_all(..., Loader=yaml.CLoader, ...)
- id: python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel
metadata:
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
references:
- https://yaml.readthedocs.io/en/latest/basicuse.html?highlight=typ
category: security
technology:
- ruamel.yaml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel
shortlink: https://sg.run/x1rz
semgrep.dev:
rule:
r_id: 9674
rv_id: 1263531
rule_id: nJUzqK
version_id: 9lT4bvG
url: https://semgrep.dev/playground/r/9lT4bvG/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel
origin: community
languages:
- python
message: Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create
arbitrary Python objects. A malicious actor could exploit this to run arbitrary
code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead.
severity: ERROR
pattern-either:
- pattern: ruamel.yaml.YAML(..., typ='unsafe', ...)
- pattern: ruamel.yaml.YAML(..., typ='base', ...)
- id: python.lang.security.deserialization.pickle.avoid-shelve
metadata:
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
references:
- https://docs.python.org/3/library/pickle.html
category: security
technology:
- python
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve
shortlink: https://sg.run/dKkZ
semgrep.dev:
rule:
r_id: 9678
rv_id: 1263535
rule_id: 8GUje2
version_id: NdTzyb4
url: https://semgrep.dev/playground/r/NdTzyb4/python.lang.security.deserialization.pickle.avoid-shelve
origin: community
languages:
- python
message: Avoid using `shelve`, which uses `pickle`, which is known to lead to code
execution vulnerabilities. When unpickling, the serialized data could be manipulated
to run arbitrary code. Instead, consider serializing the relevant data as JSON
or a similar text-based serialization format.
severity: WARNING
pattern: shelve.$FUNC(...)
- id: python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection
patterns:
- pattern-either:
- pattern: |
def $FUNC(...,$VAR,...):
...
$SESSION.query(...).$SQLFUNC("...".$FORMATFUNC(...,$VAR,...))
- pattern: |
def $FUNC(...,$VAR,...):
...
$SESSION.query.join(...).$SQLFUNC("...".$FORMATFUNC(...,$VAR,...))
- pattern: |
def $FUNC(...,$VAR,...):
...
$SESSION.query.$SQLFUNC("...".$FORMATFUNC(...,$VAR,...))
- pattern: |
def $FUNC(...,$VAR,...):
...
query.$SQLFUNC("...".$FORMATFUNC(...,$VAR,...))
- metavariable-regex:
metavariable: $SQLFUNC
regex: (group_by|order_by|distinct|having|filter)
- metavariable-regex:
metavariable: $FORMATFUNC
regex: (?!bindparams)
message: Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause
sql injections if the developer inputs raw SQL into the before-mentioned clauses.
This pattern captures relevant cases in which the developer inputs raw SQL into
the distinct, having, group_by, order_by or filter clauses and injects user-input
into the raw SQL with any function besides "bindparams". Use bindParams to securely
bind user-input to SQL statements.
fix-regex:
regex: format
replacement: bindparams
languages:
- python
severity: WARNING
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
category: security
technology:
- sqlalchemy
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection
shortlink: https://sg.run/J3Xo
semgrep.dev:
rule:
r_id: 9702
rv_id: 1263579
rule_id: BYUBWo
version_id: NdTzyL4
url: https://semgrep.dev/playground/r/NdTzyL4/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection
origin: community
- id: ruby.lang.security.bad-deserialization.bad-deserialization
mode: taint
pattern-sources:
- pattern-either:
- pattern: params
- pattern: cookies
pattern-sinks:
- pattern-either:
- pattern: |
CSV.load(...)
- pattern: |
Marshal.load(...)
- pattern: |
Marshal.restore(...)
- pattern: |
Oj.object_load(...)
- pattern: |
Oj.load($X)
message: Checks for unsafe deserialization. Objects in Ruby can be serialized into
strings, then later loaded from strings. However, uses of load and object_load
can cause remote code execution. Loading user input with MARSHAL or CSV can potentially
be dangerous. Use JSON in a secure fashion instead.
metadata:
references:
- https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ
- https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb
category: security
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
technology:
- ruby
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/ruby.lang.security.bad-deserialization.bad-deserialization
shortlink: https://sg.run/DJj2
semgrep.dev:
rule:
r_id: 9708
rv_id: 1263595
rule_id: lBUdQg
version_id: 3ZT4Xqp
url: https://semgrep.dev/playground/r/3ZT4Xqp/ruby.lang.security.bad-deserialization.bad-deserialization
origin: community
languages:
- ruby
severity: ERROR
- id: ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller
patterns:
- pattern-inside: |
class $CONTROLLER < ApplicationController
...
http_basic_authenticate_with ..., :password => "$SECRET", ...
end
- focus-metavariable: $SECRET
message: Detected hardcoded password used in basic authentication in a controller
class. Including this password in version control could expose this credential.
Consider refactoring to use environment variables or configuration files.
severity: WARNING
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/basic_auth/index.markdown
category: security
technology:
- ruby
- secrets
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller
shortlink: https://sg.run/6r0w
semgrep.dev:
rule:
r_id: 9715
rv_id: 1263606
rule_id: X5UZWK
version_id: 0bTKzNK
url: https://semgrep.dev/playground/r/0bTKzNK/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller
origin: community
languages:
- ruby
- id: ruby.lang.security.no-eval.ruby-eval
message: Use of eval with user-controllable input detected. This can lead to attackers
running arbitrary code. Ensure external data does not reach here, otherwise this
is a security vulnerability. Consider other ways to do this without eval.
severity: WARNING
metadata:
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
category: security
cwe2022-top25: true
cwe2021-top25: true
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_evaluation.rb
subcategory:
- vuln
technology:
- ruby
- rails
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/ruby.lang.security.no-eval.ruby-eval
shortlink: https://sg.run/bDwZ
semgrep.dev:
rule:
r_id: 9726
rv_id: 1263615
rule_id: OrUGNk
version_id: A8TgdDv
url: https://semgrep.dev/playground/r/A8TgdDv/ruby.lang.security.no-eval.ruby-eval
origin: community
languages:
- ruby
mode: taint
pattern-sources:
- pattern-either:
- pattern: params
- pattern: cookies
- patterns:
- pattern: |
RubyVM::InstructionSequence.compile(...)
- pattern-not: |
RubyVM::InstructionSequence.compile("...")
pattern-sinks:
- patterns:
- pattern-either:
- pattern: $X.eval
- pattern: $X.class_eval
- pattern: $X.instance_eval
- pattern: $X.module_eval
- pattern: $X.eval(...)
- pattern: $X.class_eval(...)
- pattern: $X.instance_eval(...)
- pattern: $X.module_eval(...)
- pattern: eval(...)
- pattern: class_eval(...)
- pattern: module_eval(...)
- pattern: instance_eval(...)
- pattern-not: $M("...",...)
- id: typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust
message: Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting
(XSS) vulnerability if this comes from user-provided input. If you have to use
`$TRUST`, ensure it does not come from user-input or use the appropriate prevention
mechanism e.g. input validation or sanitization depending on the context.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://angular.io/api/platform-browser/DomSanitizer
- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
confidence: MEDIUM
category: security
technology:
- angular
- browser
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust
shortlink: https://sg.run/KWxP
semgrep.dev:
rule:
r_id: 9755
rv_id: 1263902
rule_id: oqUzgA
version_id: 5PTo1zk
url: https://semgrep.dev/playground/r/5PTo1zk/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust
origin: community
languages:
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
function ...({..., $X: string, ...}) { ... }
- pattern-inside: |
function ...(..., $X: string, ...) { ... }
- focus-metavariable: $X
pattern-sinks:
- patterns:
- pattern-either:
- pattern: $X.$TRUST($Y)
- focus-metavariable: $Y
- pattern-not: |
$X.$TRUST(`...`)
- pattern-not: |
$X.$TRUST("...")
- metavariable-regex:
metavariable: $TRUST
regex: (bypassSecurityTrustHtml|bypassSecurityTrustStyle|bypassSecurityTrustScript|bypassSecurityTrustUrl|bypassSecurityTrustResourceUrl)
pattern-sanitizers:
- patterns:
- pattern-either:
- pattern-inside: |
import $S from "underscore.string"
...
- pattern-inside: |
import * as $S from "underscore.string"
...
- pattern-inside: |
import $S from "underscore.string"
...
- pattern-inside: |
$S = require("underscore.string")
...
- pattern-either:
- pattern: $S.escapeHTML(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from "dompurify"
...
- pattern-inside: |
import { ..., $S,... } from "dompurify"
...
- pattern-inside: |
import * as $S from "dompurify"
...
- pattern-inside: |
$S = require("dompurify")
...
- pattern-inside: |
import $S from "isomorphic-dompurify"
...
- pattern-inside: |
import * as $S from "isomorphic-dompurify"
...
- pattern-inside: |
$S = require("isomorphic-dompurify")
...
- pattern-either:
- patterns:
- pattern-inside: |
$VALUE = $S(...)
...
- pattern: $VALUE.sanitize(...)
- patterns:
- pattern-inside: |
$VALUE = $S.sanitize
...
- pattern: $S(...)
- pattern: $S.sanitize(...)
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'xss';
...
- pattern-inside: |
import * as $S from 'xss';
...
- pattern-inside: |
$S = require("xss")
...
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'sanitize-html';
...
- pattern-inside: |
import * as $S from "sanitize-html";
...
- pattern-inside: |
$S = require("sanitize-html")
...
- pattern: $S(...)
- patterns:
- pattern: sanitizer.sanitize(...)
- pattern-not: sanitizer.sanitize(SecurityContext.NONE, ...);
- id: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml
message: Detection of dangerouslySetInnerHTML from non-constant definition. This
can inadvertently expose users to cross-site scripting (XSS) attacks if this comes
from user-provided input. If you have to use dangerouslySetInnerHTML, consider
using a sanitization library such as DOMPurify to sanitize your HTML.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html
category: security
confidence: MEDIUM
technology:
- react
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml
shortlink: https://sg.run/rAx6
semgrep.dev:
rule:
r_id: 9769
rv_id: 1263912
rule_id: x8UWvK
version_id: l4TJR0v
url: https://semgrep.dev/playground/r/l4TJR0v/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml
origin: community
languages:
- typescript
- javascript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
function ...({..., $X, ...}) { ... }
- pattern-inside: |
function ...(..., $X, ...) { ... }
- focus-metavariable: $X
- pattern-not-inside: |
$F. ... .$SANITIZEUNC(...)
pattern-sinks:
- patterns:
- focus-metavariable: $X
- pattern-either:
- pattern: |
{...,dangerouslySetInnerHTML: {__html: $X},...}
- pattern: |
<$Y ... dangerouslySetInnerHTML={{__html: $X}} />
- pattern-not: |
<$Y ... dangerouslySetInnerHTML={{__html: "..."}} />
- pattern-not: |
{...,dangerouslySetInnerHTML:{__html: "..."},...}
- metavariable-pattern:
patterns:
- pattern-not: |
{...}
metavariable: $X
- pattern-not: |
<... {__html: "..."} ...>
- pattern-not: |
<... {__html: `...`} ...>
pattern-sanitizers:
- patterns:
- pattern-either:
- pattern-inside: |
import $S from "underscore.string"
...
- pattern-inside: |
import * as $S from "underscore.string"
...
- pattern-inside: |
import $S from "underscore.string"
...
- pattern-inside: |
$S = require("underscore.string")
...
- pattern-either:
- pattern: $S.escapeHTML(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from "dompurify"
...
- pattern-inside: |
import { ..., $S,... } from "dompurify"
...
- pattern-inside: |
import * as $S from "dompurify"
...
- pattern-inside: |
$S = require("dompurify")
...
- pattern-inside: |
import $S from "isomorphic-dompurify"
...
- pattern-inside: |
import * as $S from "isomorphic-dompurify"
...
- pattern-inside: |
$S = require("isomorphic-dompurify")
...
- pattern-either:
- patterns:
- pattern-inside: |
$VALUE = $S(...)
...
- pattern: $VALUE.sanitize(...)
- patterns:
- pattern-inside: |
$VALUE = $S.sanitize
...
- pattern: $S(...)
- pattern: $S.sanitize(...)
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'xss';
...
- pattern-inside: |
import * as $S from 'xss';
...
- pattern-inside: |
$S = require("xss")
...
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'sanitize-html';
...
- pattern-inside: |
import * as $S from "sanitize-html";
...
- pattern-inside: |
$S = require("sanitize-html")
...
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
$S = new Remarkable()
...
- pattern: $S.render(...)
- id: typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method
message: Detection of $HTML from non-constant definition. This can inadvertently
expose users to cross-site scripting (XSS) attacks if this comes from user-provided
input. If you have to use $HTML, consider using a sanitization library such as
DOMPurify to sanitize your HTML.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://developer.mozilla.org/en-US/docs/Web/API/Document/writeln
- https://developer.mozilla.org/en-US/docs/Web/API/Document/write
- https://developer.mozilla.org/en-US/docs/Web/API/Element/insertAdjacentHTML
category: security
confidence: MEDIUM
technology:
- react
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method
shortlink: https://sg.run/E5x8
semgrep.dev:
rule:
r_id: 9781
rv_id: 1263916
rule_id: QrU68w
version_id: GxTkeRl
url: https://semgrep.dev/playground/r/GxTkeRl/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method
origin: community
languages:
- typescript
- javascript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
function ...({..., $X, ...}) { ... }
- pattern-inside: |
function ...(..., $X, ...) { ... }
- focus-metavariable: $X
- pattern-either:
- pattern: $X.$Y
- pattern: $X[...]
pattern-sinks:
- patterns:
- pattern-either:
- pattern: "this.window.document. ... .$HTML('...',$SINK) \n"
- pattern: "window.document. ... .$HTML('...',$SINK) \n"
- pattern: "document.$HTML($SINK) \n"
- metavariable-regex:
metavariable: $HTML
regex: (writeln|write)
- focus-metavariable: $SINK
- patterns:
- pattern-either:
- pattern: "$PROP. ... .$HTML('...',$SINK) \n"
- metavariable-regex:
metavariable: $HTML
regex: (insertAdjacentHTML)
- focus-metavariable: $SINK
pattern-sanitizers:
- patterns:
- pattern-either:
- pattern-inside: |
import $S from "underscore.string"
...
- pattern-inside: |
import * as $S from "underscore.string"
...
- pattern-inside: |
import $S from "underscore.string"
...
- pattern-inside: |
$S = require("underscore.string")
...
- pattern-either:
- pattern: $S.escapeHTML(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from "dompurify"
...
- pattern-inside: |
import { ..., $S,... } from "dompurify"
...
- pattern-inside: |
import * as $S from "dompurify"
...
- pattern-inside: |
$S = require("dompurify")
...
- pattern-inside: |
import $S from "isomorphic-dompurify"
...
- pattern-inside: |
import * as $S from "isomorphic-dompurify"
...
- pattern-inside: |
$S = require("isomorphic-dompurify")
...
- pattern-either:
- patterns:
- pattern-inside: |
$VALUE = $S(...)
...
- pattern: $VALUE.sanitize(...)
- patterns:
- pattern-inside: |
$VALUE = $S.sanitize
...
- pattern: $S(...)
- pattern: $S.sanitize(...)
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'xss';
...
- pattern-inside: |
import * as $S from 'xss';
...
- pattern-inside: |
$S = require("xss")
...
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'sanitize-html';
...
- pattern-inside: |
import * as $S from "sanitize-html";
...
- pattern-inside: |
$S = require("sanitize-html")
...
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
$S = new Remarkable()
...
- pattern: $S.render(...)
- id: typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property
message: Detection of $HTML from non-constant definition. This can inadvertently
expose users to cross-site scripting (XSS) attacks if this comes from user-provided
input. If you have to use $HTML, consider using a sanitization library such as
DOMPurify to sanitize your HTML.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html
category: security
confidence: MEDIUM
technology:
- react
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property
shortlink: https://sg.run/70Zv
semgrep.dev:
rule:
r_id: 9782
rv_id: 1263917
rule_id: 3qUBl4
version_id: RGT0Lln
url: https://semgrep.dev/playground/r/RGT0Lln/typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property
origin: community
languages:
- typescript
- javascript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
function ...({..., $X, ...}) { ... }
- pattern-inside: |
function ...(..., $X, ...) { ... }
- focus-metavariable: $X
- pattern-either:
- pattern: $X.$Y
- pattern: $X[...]
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
$BODY = $REACT.useRef(...)
...
- pattern-inside: |
$BODY = useRef(...)
...
- pattern-inside: |
$BODY = findDOMNode(...)
...
- pattern-inside: |
$BODY = createRef(...)
...
- pattern-inside: |
$BODY = $REACT.findDOMNode(...)
...
- pattern-inside: |
$BODY = $REACT.createRef(...)
...
- pattern-either:
- pattern: "$BODY. ... .$HTML = $SINK \n"
- pattern: "$BODY.$HTML = $SINK \n"
- metavariable-regex:
metavariable: $HTML
regex: (innerHTML|outerHTML)
- focus-metavariable: $SINK
- patterns:
- pattern-either:
- pattern: ReactDOM.findDOMNode(...).$HTML = $SINK
- metavariable-regex:
metavariable: $HTML
regex: (innerHTML|outerHTML)
- focus-metavariable: $SINK
pattern-sanitizers:
- patterns:
- pattern-either:
- pattern-inside: |
import $S from "underscore.string"
...
- pattern-inside: |
import * as $S from "underscore.string"
...
- pattern-inside: |
import $S from "underscore.string"
...
- pattern-inside: |
$S = require("underscore.string")
...
- pattern-either:
- pattern: $S.escapeHTML(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from "dompurify"
...
- pattern-inside: |
import { ..., $S,... } from "dompurify"
...
- pattern-inside: |
import * as $S from "dompurify"
...
- pattern-inside: |
$S = require("dompurify")
...
- pattern-inside: |
import $S from "isomorphic-dompurify"
...
- pattern-inside: |
import * as $S from "isomorphic-dompurify"
...
- pattern-inside: |
$S = require("isomorphic-dompurify")
...
- pattern-either:
- patterns:
- pattern-inside: |
$VALUE = $S(...)
...
- pattern: $VALUE.sanitize(...)
- patterns:
- pattern-inside: |
$VALUE = $S.sanitize
...
- pattern: $S(...)
- pattern: $S.sanitize(...)
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'xss';
...
- pattern-inside: |
import * as $S from 'xss';
...
- pattern-inside: |
$S = require("xss")
...
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
import $S from 'sanitize-html';
...
- pattern-inside: |
import * as $S from "sanitize-html";
...
- pattern-inside: |
$S = require("sanitize-html")
...
- pattern: $S(...)
- patterns:
- pattern-either:
- pattern-inside: |
$S = new Remarkable()
...
- pattern: $S.render(...)
- id: ruby.lang.security.dangerous-exec.dangerous-exec
mode: taint
pattern-sources:
- patterns:
- pattern: |
def $F(...,$ARG,...)
...
end
- focus-metavariable: $ARG
- pattern: params
- pattern: cookies
pattern-sinks:
- patterns:
- pattern: |
$EXEC(...)
- pattern-not: |
$EXEC("...","...","...",...)
- pattern-not: |
$EXEC(["...","...","...",...],...)
- pattern-not: |
$EXEC({...},"...","...","...",...)
- pattern-not: |
$EXEC({...},["...","...","...",...],...)
- metavariable-regex:
metavariable: $EXEC
regex: ^(system|exec|spawn|Process.exec|Process.spawn|Open3.capture2|Open3.capture2e|Open3.capture3|Open3.popen2|Open3.popen2e|Open3.popen3|IO.popen|Gem::Util.popen|PTY.spawn)$
message: Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If
unverified user data can reach this call site, this is a code injection vulnerability.
A malicious actor can inject a malicious script to execute arbitrary code.
metadata:
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_execute.rb
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- ruby
- rails
references:
- https://guides.rubyonrails.org/security.html#command-line-injection
cwe2022-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/ruby.lang.security.dangerous-exec.dangerous-exec
shortlink: https://sg.run/R8GY
semgrep.dev:
rule:
r_id: 9805
rv_id: 1409405
rule_id: WAUZOw
version_id: WrT7erb
url: https://semgrep.dev/playground/r/WrT7erb/ruby.lang.security.dangerous-exec.dangerous-exec
origin: community
severity: WARNING
languages:
- ruby
- id: javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run
message: Detected non-literal calls to Deno.run(). This could lead to a command
injection vulnerability.
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- deno
references:
- https://deno.land/manual/examples/subprocess#simple-example
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run
shortlink: https://sg.run/Nrrn
semgrep.dev:
rule:
r_id: 9927
rv_id: 1409397
rule_id: x8UWWg
version_id: PkTe7AP
url: https://semgrep.dev/playground/r/PkTe7AP/javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-inside: function ... (..., $ARG,...) {...}
- focus-metavariable: $ARG
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
Deno.run({cmd: [$INPUT,...]},...)
- pattern: |
Deno.run({cmd: ["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$INPUT,...]},...)
- patterns:
- pattern: |
Deno.run({cmd: [$CMD,"-c",$INPUT,...]},...)
- pattern-inside: |
$CMD = "=~/(sh|bash|ksh|csh|tcsh|zsh)/"
...
- focus-metavariable: $INPUT
- id: ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli
mode: taint
pattern-propagators:
- pattern: $X << $Y
from: $Y
to: $X
pattern-sources:
- pattern-either:
- pattern: |
params
- pattern: |
cookies
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
$CON = PG.connect(...)
...
- pattern-inside: |
$CON = PG::Connection.open(...)
...
- pattern-inside: |
$CON = PG::Connection.new(...)
...
- pattern-either:
- pattern: |
$CON.$METHOD($X,...)
- pattern: |
$CON.$METHOD $X, ...
- focus-metavariable: $X
- metavariable-regex:
metavariable: $METHOD
regex: ^(exec|exec_params)$
languages:
- ruby
message: 'Detected string concatenation with a non-literal variable in a pg Ruby
SQL statement. This could lead to SQL injection if the variable is user-controlled
and not properly sanitized. In order to prevent SQL injection, use parameterized
queries or prepared statements instead. You can use parameterized queries like
so: `conn.exec_params(''SELECT $1 AS a, $2 AS b, $3 AS c'', [1, 2, nil])` And
you can use prepared statements with `exec_prepared`.'
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://www.rubydoc.info/gems/pg/PG/Connection
category: security
technology:
- rails
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli
shortlink: https://sg.run/kL0o
semgrep.dev:
rule:
r_id: 10328
rv_id: 1263628
rule_id: NbUAz7
version_id: 2KTv2y2
url: https://semgrep.dev/playground/r/2KTv2y2/ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli
origin: community
severity: WARNING
- id: csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization
severity: WARNING
languages:
- C#
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
references:
- https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide
category: security
technology:
- .net
confidence: HIGH
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization
shortlink: https://sg.run/ZeXW
semgrep.dev:
rule:
r_id: 11135
rv_id: 1262635
rule_id: bwUOjK
version_id: nWT2LGp
url: https://semgrep.dev/playground/r/nWT2LGp/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization
origin: community
message: The BinaryFormatter type is dangerous and is not recommended for data processing.
Applications should stop using BinaryFormatter as soon as possible, even if they
believe the data they're processing to be trustworthy. BinaryFormatter is insecure
and can't be made secure
patterns:
- pattern-inside: |
using System.Runtime.Serialization.Formatters.Binary;
...
- pattern: |
new BinaryFormatter();
- id: csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization
severity: WARNING
languages:
- C#
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
references:
- https://mbraceproject.github.io/FsPickler/tutorial.html#Disabling-Subtype-Resolution
category: security
technology:
- .net
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization
shortlink: https://sg.run/E5e5
semgrep.dev:
rule:
r_id: 11137
rv_id: 1262638
rule_id: kxURnR
version_id: LjTkgPk
url: https://semgrep.dev/playground/r/LjTkgPk/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization
origin: community
message: The FsPickler is dangerous and is not recommended for data processing.
Default configuration tend to insecure deserialization vulnerability.
patterns:
- pattern-inside: |
using MBrace.FsPickler.Json;
...
- pattern: |
FsPickler.CreateJsonSerializer();
- id: csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization
severity: WARNING
languages:
- C#
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
references:
- https://docs.microsoft.com/en-us/dotnet/api/system.web.ui.losformatter?view=netframework-4.8
category: security
technology:
- .net
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization
shortlink: https://sg.run/70pG
semgrep.dev:
rule:
r_id: 11138
rv_id: 1262641
rule_id: wdU87G
version_id: QkTGqnA
url: https://semgrep.dev/playground/r/QkTGqnA/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization
origin: community
message: The LosFormatter type is dangerous and is not recommended for data processing.
Applications should stop using LosFormatter as soon as possible, even if they
believe the data they're processing to be trustworthy. LosFormatter is insecure
and can't be made secure
patterns:
- pattern-inside: |
using System.Web.UI;
...
- pattern: |
new LosFormatter();
- id: csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization
severity: WARNING
languages:
- C#
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
references:
- https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.netdatacontractserializer?view=netframework-4.8#security
category: security
technology:
- .net
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization
shortlink: https://sg.run/L0AX
semgrep.dev:
rule:
r_id: 11139
rv_id: 1262642
rule_id: x8UW7x
version_id: 3ZT4X6b
url: https://semgrep.dev/playground/r/3ZT4X6b/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization
origin: community
message: The NetDataContractSerializer type is dangerous and is not recommended
for data processing. Applications should stop using NetDataContractSerializer
as soon as possible, even if they believe the data they're processing to be trustworthy.
NetDataContractSerializer is insecure and can't be made secure
patterns:
- pattern-inside: |
using System.Runtime.Serialization;
...
- pattern: |
new NetDataContractSerializer();
- id: csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization
severity: WARNING
languages:
- C#
metadata:
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
references:
- https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.soap.soapformatter?view=netframework-4.8#remarks
category: security
technology:
- .net
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization
shortlink: https://sg.run/gJnR
semgrep.dev:
rule:
r_id: 11141
rv_id: 1262644
rule_id: eqUvND
version_id: PkTR30n
url: https://semgrep.dev/playground/r/PkTR30n/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization
origin: community
message: The SoapFormatter type is dangerous and is not recommended for data processing.
Applications should stop using SoapFormatter as soon as possible, even if they
believe the data they're processing to be trustworthy. SoapFormatter is insecure
and can't be made secure
patterns:
- pattern-inside: |
using System.Runtime.Serialization.Formatters.Soap;
...
- pattern: |
new SoapFormatter();
- id: terraform.lang.security.ec2-imdsv1-optional.ec2-imdsv1-optional
languages:
- hcl
message: AWS EC2 Instance allowing use of the IMDSv1
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
references:
- https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance#metadata-options
category: security
technology:
- terraform
- aws
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/terraform.lang.security.ec2-imdsv1-optional.ec2-imdsv1-optional
shortlink: https://sg.run/J3BQ
semgrep.dev:
rule:
r_id: 11302
rv_id: 1263884
rule_id: GdU0eA
version_id: w8TRooE
url: https://semgrep.dev/playground/r/w8TRooE/terraform.lang.security.ec2-imdsv1-optional.ec2-imdsv1-optional
origin: community
pattern-either:
- patterns:
- pattern: http_tokens = "optional"
- pattern-inside: |
metadata_options { ... }
- patterns:
- pattern: |
resource "aws_instance" "$NAME" {
...
}
- pattern-not: |
resource "aws_instance" "$NAME" {
...
metadata_options {
...
http_tokens = "required"
...
}
...
}
- pattern-not: |
resource "aws_instance" "$NAME" {
...
metadata_options {
...
http_tokens = "optional"
...
}
...
}
- pattern-not: |
resource "aws_instance" "$NAME" {
...
metadata_options {
...
http_endpoint = "disabled"
...
}
...
}
severity: ERROR
- id: javascript.express.security.express-vm-injection.express-vm-injection
message: Make sure that unverified user data can not reach `$VM`.
metadata:
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
category: security
technology:
- express
cwe2022-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/javascript.express.security.express-vm-injection.express-vm-injection
shortlink: https://sg.run/jkqJ
semgrep.dev:
rule:
r_id: 12821
rv_id: 1263170
rule_id: DbUKPX
version_id: 1QTypXQ
url: https://semgrep.dev/playground/r/1QTypXQ/javascript.express.security.express-vm-injection.express-vm-injection
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern-inside: |
$VM = require('vm');
...
- pattern-either:
- pattern: |
$VM.runInContext(...)
- pattern: |
$VM.runInNewContext(...)
- pattern: |
$VM.compileFunction(...)
- pattern: |
$VM.runInThisContext(...)
- pattern: new $VM.Script(...)
- id: javascript.express.security.express-vm2-injection.express-vm2-injection
message: Make sure that unverified user data can not reach `vm2`.
metadata:
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
category: security
technology:
- express
cwe2022-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/javascript.express.security.express-vm2-injection.express-vm2-injection
shortlink: https://sg.run/1GWv
semgrep.dev:
rule:
r_id: 12822
rv_id: 1263171
rule_id: WAUPXJ
version_id: 9lT4bnX
url: https://semgrep.dev/playground/r/9lT4bnX/javascript.express.security.express-vm2-injection.express-vm2-injection
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern-inside: |
require('vm2')
...
- pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
$VM = new VM(...)
...
- pattern-inside: |
$VM = new NodeVM(...)
...
- pattern: |
$VM.run(...)
- pattern: |
new VM(...).run(...)
- pattern: |
new NodeVM(...).run(...)
- pattern: |
new VMScript(...)
- pattern: |
new VM(...)
- pattern: new NodeVM(...)
- id: yaml.github-actions.security.run-shell-injection.run-shell-injection
languages:
- yaml
message: 'Using variable interpolation `${{...}}` with `github` context data in
a `run:` step could allow an attacker to inject their own code into the runner.
This would allow them to steal secrets and code. `github` context data can have
arbitrary user input and should be treated as untrusted. Instead, use an intermediate
environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like
this: "$ENVVAR".'
metadata:
category: security
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
- https://securitylab.github.com/research/github-actions-untrusted-input/
technology:
- github-actions
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection
shortlink: https://sg.run/pkzk
semgrep.dev:
rule:
r_id: 13162
rv_id: 1423395
rule_id: v8UjQj
version_id: GxTl1DQ
url: https://semgrep.dev/playground/r/GxTl1DQ/yaml.github-actions.security.run-shell-injection.run-shell-injection
origin: community
patterns:
- pattern-inside: 'steps: [...]'
- pattern-inside: |
- run: ...
...
- pattern: 'run: $SHELL'
- metavariable-pattern:
language: generic
metavariable: $SHELL
patterns:
- pattern-either:
- pattern: ${{ ... github.event.issue.title ... }}
- pattern: ${{ ... github.event.issue.body ... }}
- pattern: ${{ ... github.event.pull_request.title ... }}
- pattern: ${{ ... github.event.pull_request.body ... }}
- pattern: ${{ ... github.event.comment.body ... }}
- pattern: ${{ ... github.event.review.body ... }}
- pattern: ${{ ... github.event.review_comment.body ... }}
- pattern: ${{ ... github.event.pages ... .page_name ... }}
- pattern: ${{ ... github.event.head_commit.message ... }}
- pattern: ${{ ... github.event.head_commit.author.email ... }}
- pattern: ${{ ... github.event.head_commit.author.name ... }}
- pattern: ${{ ... github.event.commits ... .author.email ... }}
- pattern: ${{ ... github.event.commits ... .author.name ... }}
- pattern: ${{ ... github.event.commits ... .message ... }}
- pattern: ${{ ... github.event.pull_request.head.ref ... }}
- pattern: ${{ ... github.event.pull_request.head.label ... }}
- pattern: ${{ ... github.event.pull_request.head.repo.default_branch ...
}}
- pattern: ${{ ... github.ref ... }}
- pattern: ${{ ... github.base_ref ... }}
- pattern: ${{ ... github.head_ref ... }}
- pattern: ${{ ... github.ref_name ... }}
- pattern: ${{ ... github.workflow ... }}
- pattern: ${{ ... github.event.inputs ... }}
- pattern: ${{ ... github.event.discussion.title ... }}
- pattern: ${{ ... github.event.discussion.body ... }}
- pattern: ${{ ... github.event.workflow_run.head_branch ... }}
- pattern: ${{ ... github.event.workflow_run.head_commit.message ... }}
- pattern: ${{ ... github.event.milestone.title ... }}
- pattern: ${{ ... github.event.milestone.description ... }}
- pattern: ${{ ... github.event.project_card.note ... }}
- pattern: ${{ ... github.event.project.name ... }}
- pattern: ${{ ... github.event.project_column.name ... }}
- pattern: ${{ ... github.event.release.name ... }}
- pattern: ${{ ... github.event.release.body ... }}
- pattern: ${{ ... github.event.deployment.ref ... }}
- pattern: ${{ ... inputs ... }}
- pattern-not: ${{ ... github.event.issue.title && ... }}
- pattern-not: ${{ ... github.event.issue.body && ... }}
- pattern-not: ${{ ... github.event.pull_request.title && ... }}
- pattern-not: ${{ ... github.event.pull_request.body && ... }}
- pattern-not: ${{ ... github.event.comment.body && ... }}
- pattern-not: ${{ ... github.event.review.body && ... }}
- pattern-not: ${{ ... github.event.review_comment.body && ... }}
- pattern-not: ${{ ... github.event.pages ... .page_name && ... }}
- pattern-not: ${{ ... github.event.head_commit.message && ... }}
- pattern-not: ${{ ... github.event.head_commit.author.email && ... }}
- pattern-not: ${{ ... github.event.head_commit.author.name && ... }}
- pattern-not: ${{ ... github.event.commits ... .author.email && ... }}
- pattern-not: ${{ ... github.event.commits ... .author.name && ... }}
- pattern-not: ${{ ... github.event.commits ... .message && ... }}
- pattern-not: ${{ ... github.event.pull_request.head.ref && ... }}
- pattern-not: ${{ ... github.event.pull_request.head.label && ... }}
- pattern-not: ${{ ... github.event.pull_request.head.repo.default_branch &&
... }}
- pattern-not: ${{ ... github.event.workflow_run.head_commit.message && ...
}}
- pattern-not: ${{ ... github.ref && ... }}
- pattern-not: ${{ ... github.base_ref && ... }}
- pattern-not: ${{ ... github.head_ref && ... }}
- pattern-not: ${{ ... github.ref_name && ... }}
- pattern-not: ${{ ... github.workflow && ... }}
- pattern-not: ${{ ... github.event.inputs && ... }}
- pattern-not: ${{ ... github.event.discussion.title && ... }}
- pattern-not: ${{ ... github.event.discussion.body && ... }}
- pattern-not: ${{ ... github.event.workflow_run.head_branch && ... }}
- pattern-not: ${{ ... github.event.milestone.title && ... }}
- pattern-not: ${{ ... github.event.milestone.description && ... }}
- pattern-not: ${{ ... github.event.project_card.note && ... }}
- pattern-not: ${{ ... github.event.project.name && ... }}
- pattern-not: ${{ ... github.event.project_column.name && ... }}
- pattern-not: ${{ ... github.event.release.name && ... }}
- pattern-not: ${{ ... github.event.release.body && ... }}
- pattern-not: ${{ ... github.event.deployment.ref && ... }}
severity: ERROR
- id: ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation
metadata:
shortDescription: Allowing an attacker to manipulate the session may lead to unintended
behavior.
tags:
- security
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-276: Incorrect Default Permissions'
references:
- https://brakemanscanner.org/docs/warning_types/session_manipulation/
category: security
technology:
- rails
help: |
## Remediation
Session manipulation can occur when an application allows user-input in session keys. Since sessions are typically considered a source of truth (e.g. to check the logged-in user or to match CSRF tokens), allowing an attacker to manipulate the session may lead to unintended behavior.
## References
[Session Manipulation](https://brakemanscanner.org/docs/warning_types/session_manipulation/)
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation
shortlink: https://sg.run/86q7
semgrep.dev:
rule:
r_id: 13584
rv_id: 1263621
rule_id: BYUdW6
version_id: qkTR76G
url: https://semgrep.dev/playground/r/qkTR76G/ruby.rails.security.audit.avoid-session-manipulation.avoid-session-manipulation
origin: community
message: This gets data from session using user inputs. A malicious user may be
able to retrieve information from your session that you didn't intend them to.
Do not use user input as a session key.
languages:
- ruby
severity: WARNING
mode: taint
pattern-sources:
- pattern: params
- pattern: cookies
- pattern: request.env
pattern-sinks:
- pattern: session[...]
- id: ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access
metadata:
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
references:
- https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown
category: security
technology:
- rails
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access
shortlink: https://sg.run/gYln
semgrep.dev:
rule:
r_id: 13585
rv_id: 1263622
rule_id: DbU1dr
version_id: l4TJRkk
url: https://semgrep.dev/playground/r/l4TJRkk/ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access
origin: community
message: Using user input when accessing files is potentially dangerous. A malicious
actor could use this to modify or access files they have no right to.
languages:
- ruby
severity: WARNING
mode: taint
pattern-sources:
- pattern: params
- pattern: cookies
- pattern: request.env
pattern-sinks:
- patterns:
- pattern-either:
- pattern: Dir.$X(...)
- pattern: File.$X(...)
- pattern: IO.$X(...)
- pattern: Kernel.$X(...)
- pattern: PStore.$X(...)
- pattern: Pathname.$X(...)
- metavariable-pattern:
metavariable: $X
patterns:
- pattern-either:
- pattern: chdir
- pattern: chroot
- pattern: delete
- pattern: entries
- pattern: foreach
- pattern: glob
- pattern: install
- pattern: lchmod
- pattern: lchown
- pattern: link
- pattern: load
- pattern: load_file
- pattern: makedirs
- pattern: move
- pattern: new
- pattern: open
- pattern: read
- pattern: readlines
- pattern: rename
- pattern: rmdir
- pattern: safe_unlink
- pattern: symlink
- pattern: syscopy
- pattern: sysopen
- pattern: truncate
- pattern: unlink
- id: ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call
metadata:
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
references:
- https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown
category: security
technology:
- rails
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call
shortlink: https://sg.run/Q9gP
semgrep.dev:
rule:
r_id: 13586
rv_id: 1263623
rule_id: WAUyzp
version_id: YDTZeWL
url: https://semgrep.dev/playground/r/YDTZeWL/ruby.rails.security.audit.avoid-tainted-ftp-call.avoid-tainted-ftp-call
origin: community
message: Using user input when accessing files is potentially dangerous. A malicious
actor could use this to modify or access files they have no right to.
languages:
- ruby
severity: WARNING
mode: taint
pattern-sources:
- pattern: params
- pattern: cookies
- pattern: request.env
pattern-sinks:
- pattern-either:
- pattern: Net::FTP.$X(...)
- patterns:
- pattern-inside: |
$FTP = Net::FTP.$OPEN(...)
...
$FTP.$METHOD(...)
- pattern: $FTP.$METHOD(...)
- id: ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request
metadata:
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
references:
- https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown
category: security
technology:
- rails
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request
shortlink: https://sg.run/3rLb
semgrep.dev:
rule:
r_id: 13587
rv_id: 1263624
rule_id: 0oU2x3
version_id: 6xT29nN
url: https://semgrep.dev/playground/r/6xT29nN/ruby.rails.security.audit.avoid-tainted-http-request.avoid-tainted-http-request
origin: community
message: Using user input when accessing files is potentially dangerous. A malicious
actor could use this to modify or access files they have no right to.
languages:
- ruby
severity: WARNING
mode: taint
pattern-sources:
- pattern: params
- pattern: cookies
- pattern: request.env
pattern-sinks:
- pattern-either:
- patterns:
- pattern: Net::HTTP::$METHOD.new(...)
- metavariable-pattern:
metavariable: $METHOD
patterns:
- pattern-either:
- pattern: Copy
- pattern: Delete
- pattern: Get
- pattern: Head
- pattern: Lock
- pattern: Mkcol
- pattern: Move
- pattern: Options
- pattern: Patch
- pattern: Post
- pattern: Propfind
- pattern: Proppatch
- pattern: Put
- pattern: Trace
- pattern: Unlock
- patterns:
- pattern: Net::HTTP.$X(...)
- metavariable-pattern:
metavariable: $X
patterns:
- pattern-either:
- pattern: get
- pattern: get2
- pattern: head
- pattern: head2
- pattern: options
- pattern: patch
- pattern: post
- pattern: post2
- pattern: post_form
- pattern: put
- pattern: request
- pattern: request_get
- pattern: request_head
- pattern: request_post
- pattern: send_request
- pattern: trace
- pattern: get_print
- pattern: get_response
- pattern: start
- id: ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
references:
- https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown
category: security
technology:
- rails
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call
shortlink: https://sg.run/4e8E
semgrep.dev:
rule:
r_id: 13588
rv_id: 1263625
rule_id: KxU72k
version_id: o5TbDq8
url: https://semgrep.dev/playground/r/o5TbDq8/ruby.rails.security.audit.avoid-tainted-shell-call.avoid-tainted-shell-call
origin: community
message: Using user input when accessing files is potentially dangerous. A malicious
actor could use this to modify or access files they have no right to.
languages:
- ruby
severity: ERROR
mode: taint
pattern-sources:
- pattern-either:
- pattern: params[...]
- pattern: cookies
- pattern: request.env
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: Kernel.$X(...)
- patterns:
- pattern-either:
- pattern: Shell.$X(...)
- patterns:
- pattern-inside: |
$SHELL = Shell.$ANY(...)
...
$SHELL.$X(...)
- pattern: $SHELL.$X(...)
- metavariable-pattern:
metavariable: $X
patterns:
- pattern-either:
- pattern: cat
- pattern: chdir
- pattern: chroot
- pattern: delete
- pattern: entries
- pattern: exec
- pattern: foreach
- pattern: glob
- pattern: install
- pattern: lchmod
- pattern: lchown
- pattern: link
- pattern: load
- pattern: load_file
- pattern: makedirs
- pattern: move
- pattern: new
- pattern: open
- pattern: read
- pattern: readlines
- pattern: rename
- pattern: rmdir
- pattern: safe_unlink
- pattern: symlink
- pattern: syscopy
- pattern: sysopen
- pattern: system
- pattern: truncate
- pattern: unlink
- id: ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to
metadata:
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_link_to.rb
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://brakemanscanner.org/docs/warning_types/link_to/
- https://brakemanscanner.org/docs/warning_types/link_to_href/
category: security
technology:
- rails
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to
shortlink: https://sg.run/JxXQ
semgrep.dev:
rule:
r_id: 13590
rv_id: 1263632
rule_id: lBU8Qj
version_id: 9lT4brj
url: https://semgrep.dev/playground/r/9lT4brj/ruby.rails.security.audit.xss.avoid-link-to.avoid-link-to
origin: community
message: This code includes user input in `link_to`. In Rails 2.x, the body of `link_to`
is not escaped. This means that user input which reaches the body will be executed
when the HTML is rendered. Even in other versions, values starting with `javascript:`
or `data:` are not escaped. It is better to create and use a safer function which
checks the body argument.
languages:
- ruby
severity: WARNING
mode: taint
pattern-sources:
- pattern: params
- pattern: cookies
- pattern: request.env
- pattern-either:
- pattern: $MODEL.url(...)
- pattern: $MODEL.uri(...)
- pattern: $MODEL.link(...)
- pattern: $MODEL.page(...)
- pattern: $MODEL.site(...)
pattern-sinks:
- pattern: link_to(...)
pattern-sanitizers:
- patterns:
- pattern: |
"...#{...}..."
- pattern-not: |
"#{...}..."
- id: ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path
metadata:
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
references:
- https://brakemanscanner.org/docs/warning_types/dynamic_render_paths/
category: security
technology:
- rails
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path
shortlink: https://sg.run/GO2n
semgrep.dev:
rule:
r_id: 13592
rv_id: 1263635
rule_id: 6JU1bL
version_id: bZT53p0
url: https://semgrep.dev/playground/r/bZT53p0/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path
origin: community
message: Avoid rendering user input. It may be possible for a malicious user to
input a path that lets them access a template they shouldn't. To prevent this,
check dynamic template paths against a predefined allowlist to make sure it's
an allowed template.
languages:
- ruby
severity: WARNING
mode: taint
pattern-sources:
- pattern: params
- pattern: cookies
- pattern: request.env
pattern-sinks:
- patterns:
- pattern-inside: render($X => $INPUT, ...)
- pattern: $INPUT
- metavariable-pattern:
metavariable: $X
pattern-either:
- pattern: action
- pattern: template
- pattern: partial
- pattern: file
- id: python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
languages:
- python
severity: WARNING
metadata:
category: security
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe:
- 'CWE-276: Incorrect Default Permissions'
technology:
- python
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
shortlink: https://sg.run/AXY4
semgrep.dev:
rule:
r_id: 13594
rv_id: 1263482
rule_id: zdUYqR
version_id: O9Tpxqr
url: https://semgrep.dev/playground/r/O9Tpxqr/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
origin: community
message: These permissions `$BITS` are widely permissive and grant access to more
people than may be necessary. A good default is `0o644` which gives read and write
access to yourself and read access to everyone else.
patterns:
- pattern-inside: os.$METHOD(...)
- metavariable-pattern:
metavariable: $METHOD
patterns:
- pattern-either:
- pattern: chmod
- pattern: lchmod
- pattern: fchmod
- pattern-either:
- patterns:
- pattern: os.$METHOD($FILE, $BITS, ...)
- metavariable-comparison:
metavariable: $BITS
comparison: $BITS >= 0o650 and $BITS < 0o100000
- patterns:
- pattern: os.$METHOD($FILE, $BITS)
- metavariable-comparison:
metavariable: $BITS
comparison: $BITS >= 0o100650
- patterns:
- pattern: os.$METHOD($FILE, $BITS, ...)
- metavariable-pattern:
metavariable: $BITS
patterns:
- pattern-either:
- pattern: <... stat.S_IWGRP ...>
- pattern: <... stat.S_IXGRP ...>
- pattern: <... stat.S_IWOTH ...>
- pattern: <... stat.S_IXOTH ...>
- pattern: <... stat.S_IRWXO ...>
- pattern: <... stat.S_IRWXG ...>
- patterns:
- pattern: os.$METHOD($FILE, $EXPR | $MOD, ...)
- metavariable-comparison:
metavariable: $MOD
comparison: $MOD == 0o111
- id: php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query
languages:
- php
message: '`$QUERY` Detected string concatenation with a non-literal variable in
a Doctrine QueryBuilder method. This could lead to SQL injection if the variable
is user-controlled and not properly sanitized. In order to prevent SQL injection,
use parameterized queries or prepared statements instead.'
metadata:
category: security
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/query-builder.html#security-safely-preventing-sql-injection
- https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
technology:
- doctrine
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query
shortlink: https://sg.run/jwDJ
semgrep.dev:
rule:
r_id: 13965
rv_id: 1263271
rule_id: kxUw23
version_id: 1QTypnG
url: https://semgrep.dev/playground/r/1QTypnG/php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query
origin: community
mode: taint
pattern-sinks:
- patterns:
- focus-metavariable: $SINK
- pattern-either:
- pattern: $QUERY->add(...,$SINK,...)
- pattern: $QUERY->select(...,$SINK,...)
- pattern: $QUERY->addSelect(...,$SINK,...)
- pattern: $QUERY->delete(...,$SINK,...)
- pattern: $QUERY->update(...,$SINK,...)
- pattern: $QUERY->insert(...,$SINK,...)
- pattern: $QUERY->from(...,$SINK,...)
- pattern: $QUERY->join(...,$SINK,...)
- pattern: $QUERY->innerJoin(...,$SINK,...)
- pattern: $QUERY->leftJoin(...,$SINK,...)
- pattern: $QUERY->rightJoin(...,$SINK,...)
- pattern: $QUERY->where(...,$SINK,...)
- pattern: $QUERY->andWhere(...,$SINK,...)
- pattern: $QUERY->orWhere(...,$SINK,...)
- pattern: $QUERY->groupBy(...,$SINK,...)
- pattern: $QUERY->addGroupBy(...,$SINK,...)
- pattern: $QUERY->having(...,$SINK,...)
- pattern: $QUERY->andHaving(...,$SINK,...)
- pattern: $QUERY->orHaving(...,$SINK,...)
- pattern: $QUERY->orderBy(...,$SINK,...)
- pattern: $QUERY->addOrderBy(...,$SINK,...)
- pattern: $QUERY->set($SINK,...)
- pattern: $QUERY->setValue($SINK,...)
- pattern-either:
- pattern-inside: |
$Q = $X->createQueryBuilder();
...
- pattern-inside: |
$Q = new QueryBuilder(...);
...
pattern-sources:
- patterns:
- pattern-either:
- pattern: sprintf(...)
- pattern: |
"...".$SMTH
severity: WARNING
- id: python.django.security.injection.raw-html-format.raw-html-format
languages:
- python
severity: WARNING
message: Detected user input flowing into a manually constructed HTML string. You
may be accidentally bypassing secure methods of rendering HTML by manually constructing
HTML and this could create a cross-site scripting vulnerability, which could let
attackers steal sensitive user data. To be sure this is safe, check that the HTML
is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which
will safely render HTML instead.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- django
references:
- https://docs.djangoproject.com/en/3.2/topics/http/shortcuts/#render
- https://docs.djangoproject.com/en/3.2/topics/security/#cross-site-scripting-xss-protection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format
shortlink: https://sg.run/oYj1
semgrep.dev:
rule:
r_id: 14360
rv_id: 1263397
rule_id: 2ZUPER
version_id: 5PTo100
url: https://semgrep.dev/playground/r/5PTo100/python.django.security.injection.raw-html-format.raw-html-format
origin: community
mode: taint
pattern-sanitizers:
- pattern: django.utils.html.escape(...)
pattern-sources:
- patterns:
- pattern: request.$ANYTHING
- pattern-not: request.build_absolute_uri
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: '"$HTMLSTR" % ...'
- pattern: '"$HTMLSTR".format(...)'
- pattern: '"$HTMLSTR" + ...'
- pattern: f"$HTMLSTR{...}..."
- patterns:
- pattern-inside: |
$HTML = "$HTMLSTR"
...
- pattern-either:
- pattern: $HTML % ...
- pattern: $HTML.format(...)
- pattern: $HTML + ...
- metavariable-pattern:
metavariable: $HTMLSTR
language: generic
pattern: <$TAG ...
- id: python.flask.security.injection.raw-html-concat.raw-html-format
languages:
- python
severity: WARNING
message: Detected user input flowing into a manually constructed HTML string. You
may be accidentally bypassing secure methods of rendering HTML by manually constructing
HTML and this could create a cross-site scripting vulnerability, which could let
attackers steal sensitive user data. To be sure this is safe, check that the HTML
is rendered safely. Otherwise, use templates (`flask.render_template`) which will
safely render HTML instead.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- flask
references:
- https://flask.palletsprojects.com/en/2.0.x/security/#cross-site-scripting-xss
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.flask.security.injection.raw-html-concat.raw-html-format
shortlink: https://sg.run/Pb7e
semgrep.dev:
rule:
r_id: 14389
rv_id: 1409401
rule_id: GdUrJv
version_id: RGTEN1l
url: https://semgrep.dev/playground/r/RGTEN1l/python.flask.security.injection.raw-html-concat.raw-html-format
origin: community
mode: taint
pattern-sanitizers:
- pattern: jinja2.escape(...)
- pattern: flask.escape(...)
- patterns:
- pattern: flask.render_template($TPL, ...)
- metavariable-regex:
metavariable: $TPL
regex: .*\.html
pattern-sources:
- patterns:
- pattern-either:
- pattern: flask.request.$ANYTHING
- patterns:
- pattern-inside: |
@$APP.route(...)
def $FUNC(..., $ROUTEVAR, ...):
...
- pattern: $ROUTEVAR
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: '"$HTMLSTR" % ...'
- pattern: '"$HTMLSTR".format(...)'
- pattern: '"$HTMLSTR" + ...'
- pattern: f"$HTMLSTR{...}..."
- patterns:
- pattern-inside: |
$HTML = "$HTMLSTR"
...
- pattern-either:
- pattern: $HTML % ...
- pattern: $HTML.format(...)
- pattern: $HTML + ...
- metavariable-pattern:
metavariable: $HTMLSTR
language: generic
pattern: <$TAG ...
- id: go.lang.security.injection.tainted-url-host.tainted-url-host
languages:
- go
message: A request was found to be crafted from user-input `$REQUEST`. This can
lead to Server-Side Request Forgery (SSRF) vulnerabilities, potentially exposing
sensitive data. It is recommend where possible to not allow user-input to craft
the base request, but to be treated as part of the path or query parameter. When
user-input is necessary to craft the request, it is recommended to follow OWASP
best practices to prevent abuse, including using an allowlist.
options:
interfile: true
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://goteleport.com/blog/ssrf-attacks/
category: security
technology:
- go
confidence: HIGH
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/go.lang.security.injection.tainted-url-host.tainted-url-host
shortlink: https://sg.run/5DjW
semgrep.dev:
rule:
r_id: 14391
rv_id: 1262970
rule_id: AbUQLr
version_id: yeTxpOj
url: https://semgrep.dev/playground/r/yeTxpOj/go.lang.security.injection.tainted-url-host.tainted-url-host
origin: community
mode: taint
pattern-sources:
- label: INPUT
patterns:
- pattern-either:
- pattern: |
($REQUEST : *http.Request).$ANYTHING
- pattern: |
($REQUEST : http.Request).$ANYTHING
- metavariable-regex:
metavariable: $ANYTHING
regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
- label: CLEAN
requires: INPUT
patterns:
- pattern-either:
- pattern: |
"$URLSTR" + $INPUT
- patterns:
- pattern-either:
- pattern: fmt.Fprintf($F, "$URLSTR", $INPUT, ...)
- pattern: fmt.Sprintf("$URLSTR", $INPUT, ...)
- pattern: fmt.Printf("$URLSTR", $INPUT, ...)
- metavariable-regex:
metavariable: $URLSTR
regex: .*//[a-zA-Z0-10]+\..*
pattern-sinks:
- requires: INPUT and not CLEAN
patterns:
- pattern-either:
- patterns:
- pattern-either:
- patterns:
- pattern-inside: |
$CLIENT := &http.Client{...}
...
- pattern: $CLIENT.$METHOD($URL, ...)
- pattern: http.$METHOD($URL, ...)
- metavariable-regex:
metavariable: $METHOD
regex: ^(Get|Head|Post|PostForm)$
- patterns:
- pattern: |
http.NewRequest("$METHOD", $URL, ...)
- metavariable-regex:
metavariable: $METHOD
regex: ^(GET|HEAD|POST|POSTFORM)$
- focus-metavariable: $URL
severity: WARNING
- id: go.lang.security.injection.raw-html-format.raw-html-format
languages:
- go
severity: WARNING
message: Detected user input flowing into a manually constructed HTML string. You
may be accidentally bypassing secure methods of rendering HTML by manually constructing
HTML and this could create a cross-site scripting vulnerability, which could let
attackers steal sensitive user data. Use the `html/template` package which will
safely render HTML instead, or inspect that the HTML is rendered safely.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- go
references:
- https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format
shortlink: https://sg.run/3r1G
semgrep.dev:
rule:
r_id: 14443
rv_id: 1262968
rule_id: PeUonQ
version_id: 1QTyp2p
url: https://semgrep.dev/playground/r/1QTyp2p/go.lang.security.injection.raw-html-format.raw-html-format
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
($REQUEST : *http.Request).$ANYTHING
- pattern: |
($REQUEST : http.Request).$ANYTHING
- metavariable-regex:
metavariable: $ANYTHING
regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
pattern-sanitizers:
- pattern: html.EscapeString(...)
pattern-sinks:
- patterns:
- pattern-either:
- pattern: fmt.Printf("$HTMLSTR", ...)
- pattern: fmt.Sprintf("$HTMLSTR", ...)
- pattern: fmt.Fprintf($W, "$HTMLSTR", ...)
- pattern: '"$HTMLSTR" + ...'
- metavariable-pattern:
metavariable: $HTMLSTR
language: generic
pattern: <$TAG ...
- id: ruby.rails.security.injection.raw-html-format.raw-html-format
languages:
- ruby
severity: WARNING
message: Detected user input flowing into a manually constructed HTML string. You
may be accidentally bypassing secure methods of rendering HTML by manually constructing
HTML and this could create a cross-site scripting vulnerability, which could let
attackers steal sensitive user data. Use the `render template` and make template
files which will safely render HTML instead, or inspect that the HTML is absolutely
rendered safely with a function like `sanitize`.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- rails
references:
- https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/
- https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/ruby.rails.security.injection.raw-html-format.raw-html-format
shortlink: https://sg.run/b2JQ
semgrep.dev:
rule:
r_id: 14470
rv_id: 1409408
rule_id: kxUwZX
version_id: qkTvgYY
url: https://semgrep.dev/playground/r/qkTvgYY/ruby.rails.security.injection.raw-html-format.raw-html-format
origin: community
mode: taint
pattern-sanitizers:
- pattern-either:
- pattern: sanitize(...)
- pattern: strip_tags(...)
pattern-sources:
- patterns:
- pattern-either:
- pattern: params
- pattern: request
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: |
$HTMLSTR
- pattern-regex: <\w+.*
- patterns:
- pattern-either:
- pattern: Kernel::sprintf("$HTMLSTR", ...)
- pattern: |
"$HTMLSTR" + $EXPR
- pattern: |
"$HTMLSTR" % $EXPR
- metavariable-pattern:
metavariable: $HTMLSTR
language: generic
pattern: <$TAG ...
- id: python.flask.security.injection.tainted-url-host.tainted-url-host
languages:
- python
message: User data flows into the host portion of this manually-constructed URL.
This could allow an attacker to send data to their own server, potentially exposing
sensitive data such as cookies or authorization information sent with this request.
They could also probe internal servers or other resources that the server running
this code can access. (This is called server-side request forgery, or SSRF.) Do
not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or
hardcode the correct host.
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
category: security
technology:
- flask
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host
shortlink: https://sg.run/RXpK
semgrep.dev:
rule:
r_id: 14649
rv_id: 1409403
rule_id: ReU3Wb
version_id: BjTy42w
url: https://semgrep.dev/playground/r/BjTy42w/python.flask.security.injection.tainted-url-host.tainted-url-host
origin: community
mode: taint
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: '"$URLSTR" % ...'
- metavariable-pattern:
metavariable: $URLSTR
language: generic
patterns:
- pattern-either:
- pattern: $SCHEME://%s
- pattern: $SCHEME://%r
- patterns:
- pattern: '"$URLSTR".format(...)'
- metavariable-pattern:
metavariable: $URLSTR
language: generic
pattern: $SCHEME:// { ... }
- patterns:
- pattern: '"$URLSTR" + ...'
- metavariable-regex:
metavariable: $URLSTR
regex: .*://$
- patterns:
- pattern: f"$URLSTR{...}..."
- metavariable-regex:
metavariable: $URLSTR
regex: .*://$
- patterns:
- pattern-inside: |
$URL = "$URLSTR"
...
- pattern: $URL += ...
- metavariable-regex:
metavariable: $URLSTR
regex: .*://$
pattern-sources:
- patterns:
- pattern-either:
- pattern: flask.request.$ANYTHING
- patterns:
- pattern-inside: |
@$APP.route(...)
def $FUNC(..., $ROUTEVAR, ...):
...
- pattern: $ROUTEVAR
severity: WARNING
- id: go.lang.security.injection.tainted-sql-string.tainted-sql-string
languages:
- go
message: User data flows into this manually-constructed SQL string. User data can
be safely inserted into SQL strings using prepared statements or an object-relational
mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL
injection, which could let an attacker steal or manipulate data from the database.
Instead, use prepared statements (`db.Query("SELECT * FROM t WHERE id = ?", id)`)
or a safe library.
options:
interfile: true
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://golang.org/doc/database/sql-injection
- https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/
category: security
technology:
- go
confidence: HIGH
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string
shortlink: https://sg.run/PbEq
semgrep.dev:
rule:
r_id: 14689
rv_id: 1409388
rule_id: PeUoqy
version_id: nWTQ5qD
url: https://semgrep.dev/playground/r/nWTQ5qD/go.lang.security.injection.tainted-sql-string.tainted-sql-string
origin: community
mode: taint
severity: ERROR
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
($REQUEST : *http.Request).$ANYTHING
- pattern: |
($REQUEST : http.Request).$ANYTHING
- metavariable-regex:
metavariable: $ANYTHING
regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: |
"$SQLSTR" + ...
- patterns:
- pattern-inside: |
$VAR = "$SQLSTR";
...
- pattern: $VAR += ...
- patterns:
- pattern-inside: |
var $SB strings.Builder
...
- pattern-inside: |
$SB.WriteString("$SQLSTR")
...
$SB.String(...)
- pattern: |
$SB.WriteString(...)
- metavariable-regex:
metavariable: $SQLSTR
regex: (?i)(select|delete|insert|create|update|alter|drop).*
- patterns:
- pattern-either:
- pattern: fmt.Fprintf($F, "$SQLSTR", ...)
- pattern: fmt.Sprintf("$SQLSTR", ...)
- pattern: fmt.Printf("$SQLSTR", ...)
- metavariable-regex:
metavariable: $SQLSTR
regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).*
pattern-sanitizers:
- pattern-either:
- pattern: strconv.Atoi(...)
- pattern: |
($X: bool)
- id: javascript.express.security.injection.raw-html-format.raw-html-format
message: User data flows into the host portion of this manually-constructed HTML.
This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from
user-provided input. Consider using a sanitization library such as DOMPurify to
sanitize the HTML within.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
category: security
technology:
- express
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format
shortlink: https://sg.run/5DO3
semgrep.dev:
rule:
r_id: 14691
rv_id: 1263175
rule_id: 5rUL0X
version_id: NdTzyQv
url: https://semgrep.dev/playground/r/NdTzyQv/javascript.express.security.injection.raw-html-format.raw-html-format
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- label: EXPRESS
patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- label: EXPRESSTS
patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
- label: CLEAN
by-side-effect: true
patterns:
- pattern-either:
- pattern: $A($SOURCE)
- pattern: $SANITIZE. ... .$A($SOURCE)
- pattern: $A. ... .$SANITIZE($SOURCE)
- focus-metavariable: $SOURCE
- metavariable-regex:
metavariable: $A
regex: (?i)(.*valid|.*sanitiz)
pattern-sinks:
- requires: (EXPRESS and not CLEAN) or (EXPRESSTS and not CLEAN)
patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: '"$HTMLSTR" + $EXPR'
- pattern: '"$HTMLSTR".concat(...)'
- pattern: util.format($HTMLSTR, ...)
- metavariable-pattern:
metavariable: $HTMLSTR
language: generic
pattern: <$TAG ...
- patterns:
- pattern: |
`...`
- pattern-regex: |
.*<\w+.*
- id: ruby.rails.security.injection.tainted-url-host.tainted-url-host
languages:
- ruby
severity: WARNING
message: User data flows into the host portion of this manually-constructed URL.
This could allow an attacker to send data to their own server, potentially exposing
sensitive data such as cookies or authorization information sent with this request.
They could also probe internal servers or other resources that the server running
this code can access. (This is called server-side request forgery, or SSRF.) Do
not allow arbitrary hosts. Use the `ssrf_filter` gem and guard the url construction
with `SsrfFilter(...)`, or create an allowlist for approved hosts.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- rails
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
- https://github.com/arkadiyt/ssrf_filter
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/ruby.rails.security.injection.tainted-url-host.tainted-url-host
shortlink: https://sg.run/RX3g
semgrep.dev:
rule:
r_id: 14705
rv_id: 1263668
rule_id: zdUY0W
version_id: 6xT29BN
url: https://semgrep.dev/playground/r/6xT29BN/ruby.rails.security.injection.tainted-url-host.tainted-url-host
origin: community
mode: taint
pattern-sanitizers:
- pattern: SsrfFilter
pattern-sources:
- patterns:
- pattern-either:
- pattern: params
- pattern: request
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: |
$URLSTR
- pattern-regex: \w+:\/\/#{.*}
- patterns:
- pattern-either:
- pattern: Kernel::sprintf("$URLSTR", ...)
- pattern: |
"$URLSTR" + $EXPR
- pattern: |
"$URLSTR" % $EXPR
- metavariable-pattern:
metavariable: $URLSTR
language: generic
pattern: $SCHEME:// ...
- id: ruby.rails.security.injection.tainted-sql-string.tainted-sql-string
languages:
- ruby
severity: ERROR
message: Detected user input used to manually construct a SQL string. This is usually
bad practice because manual construction could accidentally result in a SQL injection.
An attacker could use a SQL injection to steal or modify contents of the database.
Instead, use a parameterized query which is available by default in most database
engines. Alternatively, consider using an object-relational mapper (ORM) such
as ActiveRecord which will protect your queries.
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- rails
references:
- https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/ruby.rails.security.injection.tainted-sql-string.tainted-sql-string
shortlink: https://sg.run/Y85o
semgrep.dev:
rule:
r_id: 14714
rv_id: 1263667
rule_id: bwU8gl
version_id: YDTZeLL
url: https://semgrep.dev/playground/r/YDTZeLL/ruby.rails.security.injection.tainted-sql-string.tainted-sql-string
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: params
- pattern: request
pattern-sanitizers:
- pattern: |
$PARAMS.slice(...)
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- patterns:
- pattern: |
$RECORD.where($X,...)
- pattern: |
$RECORD.find(..., :conditions => $X,...)
- focus-metavariable: $X
- patterns:
- pattern: |
"$SQLVERB#{$EXPR}..."
- pattern-not-inside: |
$FUNC("...", "...#{$EXPR}...",...)
- focus-metavariable: $SQLVERB
- pattern-regex: (?i)(select|delete|insert|create|update|alter|drop)\b
- patterns:
- pattern-either:
- pattern: Kernel::sprintf("$SQLSTR", $EXPR)
- pattern: |
"$SQLSTR" + $EXPR
- pattern: |
"$SQLSTR" % $EXPR
- pattern-not-inside: |
$FUNC("...", "...#{$EXPR}...",...)
- focus-metavariable: $EXPR
- metavariable-regex:
metavariable: $SQLSTR
regex: (?i)(select|delete|insert|create|update|alter|drop)\b
- id: php.lang.security.injection.tainted-sql-string.tainted-sql-string
languages:
- php
severity: ERROR
message: User data flows into this manually-constructed SQL string. User data can
be safely inserted into SQL strings using prepared statements or an object-relational
mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL
injection, which could let an attacker steal or manipulate data from the database.
Instead, use prepared statements (`$mysqli->prepare("INSERT INTO test(id, label)
VALUES (?, ?)");`) or a safe library.
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/www-community/attacks/SQL_Injection
category: security
technology:
- php
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/php.lang.security.injection.tainted-sql-string.tainted-sql-string
shortlink: https://sg.run/lZYG
semgrep.dev:
rule:
r_id: 14757
rv_id: 1263290
rule_id: qNUXdL
version_id: gETB7vY
url: https://semgrep.dev/playground/r/gETB7vY/php.lang.security.injection.tainted-sql-string.tainted-sql-string
origin: community
mode: taint
pattern-sanitizers:
- pattern-either:
- pattern: mysqli_real_escape_string(...)
- pattern: real_escape_string(...)
- pattern: $MYSQLI->real_escape_string(...)
pattern-sources:
- patterns:
- pattern-either:
- pattern: $_GET
- pattern: $_POST
- pattern: $_COOKIE
- pattern: $_REQUEST
pattern-sinks:
- pattern-either:
- patterns:
- pattern: |
sprintf($SQLSTR, ...)
- metavariable-regex:
metavariable: $SQLSTR
regex: (?is).*\b(select|delete|insert|create|update|alter|drop)\b.*
- patterns:
- pattern: |
"...$EXPR..."
- metavariable-regex:
metavariable: $EXPR
regex: (?is).*\b(select|delete|insert|create|update|alter|drop)\b.*
- patterns:
- pattern: |
"$SQLSTR".$EXPR
- metavariable-regex:
metavariable: $SQLSTR
regex: (?is).*\b(select|delete|insert|create|update|alter|drop)\b.*
- id: php.lang.security.injection.tainted-url-host.tainted-url-host
languages:
- php
severity: WARNING
message: User data flows into the host portion of this manually-constructed URL.
This could allow an attacker to send data to their own server, potentially exposing
sensitive data such as cookies or authorization information sent with this request.
They could also probe internal servers or other resources that the server running
this code can access. (This is called server-side request forgery, or SSRF.) Do
not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or
hardcode the correct host.
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
category: security
technology:
- php
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/php.lang.security.injection.tainted-url-host.tainted-url-host
shortlink: https://sg.run/Y8no
semgrep.dev:
rule:
r_id: 14758
rv_id: 1263291
rule_id: lBU8K1
version_id: QkTGqRd
url: https://semgrep.dev/playground/r/QkTGqRd/php.lang.security.injection.tainted-url-host.tainted-url-host
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: $_GET
- pattern: $_POST
- pattern: $_COOKIE
- pattern: $_REQUEST
pattern-sinks:
- pattern-either:
- patterns:
- pattern: |
sprintf($URLSTR, ...)
- metavariable-pattern:
metavariable: $URLSTR
language: generic
pattern: $SCHEME://%s
- patterns:
- pattern: |
"...{$EXPR}..."
- pattern-regex: |
.*://\{.*
- patterns:
- pattern: |
"...$EXPR..."
- pattern-regex: |
.*://\$.*
- patterns:
- pattern: |
"...".$EXPR
- pattern-regex: |
.*://["'].*
- id: java.spring.security.injection.tainted-sql-string.tainted-sql-string
languages:
- java
severity: ERROR
message: User data flows into this manually-constructed SQL string. User data can
be safely inserted into SQL strings using prepared statements or an object-relational
mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL
injection, which could let an attacker steal or manipulate data from the database.
Instead, use prepared statements (`connection.PreparedStatement`) or a safe library.
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html
category: security
technology:
- spring
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/java.spring.security.injection.tainted-sql-string.tainted-sql-string
shortlink: https://sg.run/9rzz
semgrep.dev:
rule:
r_id: 14767
rv_id: 1409396
rule_id: 10UdRR
version_id: 44TbKvr
url: https://semgrep.dev/playground/r/44TbKvr/java.spring.security.injection.tainted-sql-string.tainted-sql-string
origin: community
options:
taint_assume_safe_numbers: true
taint_assume_safe_booleans: true
interfile: true
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
$METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {
...
}
- pattern-inside: |
$METHODNAME(..., @$REQ $TYPE $SOURCE,...) {
...
}
- metavariable-regex:
metavariable: $REQ
regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue)
- metavariable-regex:
metavariable: $TYPE
regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean))
- focus-metavariable: $SOURCE
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
"$SQLSTR" + ...
- pattern: |
"$SQLSTR".concat(...)
- patterns:
- pattern-inside: |
StringBuilder $SB = new StringBuilder("$SQLSTR");
...
- pattern: $SB.append(...)
- patterns:
- pattern-inside: |
$VAR = "$SQLSTR";
...
- pattern: $VAR += ...
- pattern: String.format("$SQLSTR", ...)
- patterns:
- pattern-inside: |
String $VAR = "$SQLSTR";
...
- pattern: String.format($VAR, ...)
- pattern-not-inside: System.out.println(...)
- pattern-not-inside: $LOG.info(...)
- pattern-not-inside: $LOG.warn(...)
- pattern-not-inside: $LOG.warning(...)
- pattern-not-inside: $LOG.debug(...)
- pattern-not-inside: $LOG.debugging(...)
- pattern-not-inside: $LOG.error(...)
- pattern-not-inside: new Exception(...)
- pattern-not-inside: throw ...;
- metavariable-regex:
metavariable: $SQLSTR
regex: (?i)(select|delete|insert|create|update|alter|drop)\b
- id: csharp.lang.security.sqli.csharp-sqli.csharp-sqli
mode: taint
pattern-sources:
- patterns:
- pattern: |
(string $X)
- pattern-not: |
"..."
pattern-propagators:
- pattern: (StringBuilder $B).$ANY(...,(string $X),...)
from: $X
to: $B
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: |
new $PATTERN($CMD,...)
- focus-metavariable: $CMD
- patterns:
- pattern: |
$CMD.$PATTERN = $VALUE;
- focus-metavariable: $VALUE
- metavariable-regex:
metavariable: $PATTERN
regex: ^(SqlCommand|CommandText|OleDbCommand|OdbcCommand|OracleCommand)$
pattern-sanitizers:
- pattern-either:
- pattern: |
$CMD.Parameters.Add(...)
- pattern: |
$CMD.Parameters.AddRange(...)
- pattern: |
$CMD.Parameters.AddWithValue(...)
- pattern: |
$CMD.Parameters[$IDX].Value = ...
by-side-effect: true
message: Detected a formatted string in a SQL statement. This could lead to SQL
injection if variables in the SQL statement are not properly sanitized. Use a
prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand'
and 'SqlParameter'.
metadata:
category: security
technology:
- csharp
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
confidence: MEDIUM
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/csharp.lang.security.sqli.csharp-sqli.csharp-sqli
shortlink: https://sg.run/d2Xd
semgrep.dev:
rule:
r_id: 15078
rv_id: 1262648
rule_id: x8UxeP
version_id: RGT0LqW
url: https://semgrep.dev/playground/r/RGT0LqW/csharp.lang.security.sqli.csharp-sqli.csharp-sqli
origin: community
languages:
- csharp
severity: ERROR
- id: terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled
message: Enabling authentication ensures that all communications in the application
are authenticated. The `auth_settings` block needs to be filled out with the appropriate
auth backend settings
patterns:
- pattern: resource
- pattern-not-inside: |
resource "azurerm_app_service" "..." {
...
auth_settings {
...
enabled = true
...
}
...
}
- pattern-either:
- pattern-inside: |
resource "azurerm_app_service" "..." {
...
}
- pattern-inside: |
resource "azurerm_app_service" "..." {
...
auth_settings {
...
enabled = false
...
}
...
}
metadata:
cwe:
- 'CWE-287: Improper Authentication'
category: security
technology:
- terraform
- azure
references:
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#auth_settings
owasp:
- A02:2017 - Broken Authentication
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled
shortlink: https://sg.run/JxYw
semgrep.dev:
rule:
r_id: 15102
rv_id: 1263755
rule_id: 0oU23p
version_id: PkTR3P8
url: https://semgrep.dev/playground/r/PkTR3P8/terraform.azure.security.appservice.appservice-authentication-enabled.appservice-authentication-enabled
origin: community
languages:
- hcl
severity: ERROR
- id: kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind
metadata:
cwe:
- 'CWE-287: Improper Authentication'
owasp:
- A02:2017 - Broken Authentication
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#LDAP_ANONYMOUS
category: security
technology:
- kotlin
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind
shortlink: https://sg.run/rY2n
semgrep.dev:
rule:
r_id: 15125
rv_id: 1263258
rule_id: v8U9Q7
version_id: WrTqKgJ
url: https://semgrep.dev/playground/r/WrTqKgJ/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind
origin: community
message: Detected anonymous LDAP bind. This permits anonymous users to execute LDAP
statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html
for more information.
severity: WARNING
pattern: |
$ENV.put($CTX.SECURITY_AUTHENTICATION, "none")
...
$DCTX = InitialDirContext($ENV, ...)
languages:
- kt
- id: typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod
message: Using the GrantPublicAccess method on bucket contruct $X will make the
objects in the bucket world accessible. Verify if this is intentional.
metadata:
cwe:
- 'CWE-306: Missing Authentication for Critical Function'
category: security
technology:
- AWS-CDK
references:
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod
shortlink: https://sg.run/Z4p7
semgrep.dev:
rule:
r_id: 15279
rv_id: 1263906
rule_id: wdUjZK
version_id: BjTkZA7
url: https://semgrep.dev/playground/r/BjTkZA7/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod
origin: community
languages:
- ts
severity: WARNING
pattern-either:
- patterns:
- pattern-inside: |
import {Bucket} from '@aws-cdk/aws-s3'
...
- pattern: |
const $X = new Bucket(...)
...
$X.grantPublicAccess(...)
- patterns:
- pattern-inside: |
import * as $Y from '@aws-cdk/aws-s3'
...
- pattern: |
const $X = new $Y.Bucket(...)
...
$X.grantPublicAccess(...)
- id: typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public
message: CodeBuild Project $X is set to have a public URL. This will make the build
results, logs, artifacts publically accessible, including builds prior to the
project being public. Ensure this is acceptable for the project.
metadata:
category: security
cwe:
- 'CWE-306: Missing Authentication for Critical Function'
technology:
- AWS-CDK
references:
- https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authentication
source: https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public
shortlink: https://sg.run/nK7G
semgrep.dev:
rule:
r_id: 15280
rv_id: 1263907
rule_id: x8UxXZ
version_id: DkTRbj1
url: https://semgrep.dev/playground/r/DkTRbj1/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public
origin: community
languages:
- ts
severity: WARNING
pattern-either:
- patterns:
- pattern-inside: |
import {Project} from '@aws-cdk/aws-codebuild'
...
- pattern: |
const $X = new Project(..., {..., badge: true, ...})
- patterns:
- pattern-inside: |
import * as $Y from '@aws-cdk/aws-codebuild'
...
- pattern: |
const $X = new $Y.Project(..., {..., badge: true, ...})
- id: python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text
mode: taint
pattern-sinks:
- pattern: |
sqlalchemy.text(...)
pattern-sources:
- patterns:
- pattern: |
$X + $Y
- metavariable-type:
metavariable: $X
type: string
- patterns:
- pattern: |
$X + $Y
- metavariable-type:
metavariable: $Y
type: string
- patterns:
- pattern: |
f"..."
- patterns:
- pattern: |
$X.format(...)
- metavariable-type:
metavariable: $X
type: string
- patterns:
- pattern: |
$X % $Y
- metavariable-type:
metavariable: $X
type: string
message: sqlalchemy.text passes the constructed SQL statement to the database mostly
unchanged. This means that the usual SQL injection protections are not applied
and this function is vulnerable to SQL injection if user input can reach here.
Use normal SQLAlchemy operators (such as `or_()`, `and_()`, etc.) to construct
SQL.
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
category: security
technology:
- sqlalchemy
confidence: MEDIUM
references:
- https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text
shortlink: https://sg.run/yP1O
semgrep.dev:
rule:
r_id: 15824
rv_id: 1263577
rule_id: r6U2wE
version_id: rxTAKqq
url: https://semgrep.dev/playground/r/rxTAKqq/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text
origin: community
languages:
- python
severity: ERROR
- id: generic.ci.security.bash-reverse-shell.bash_reverse_shell
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
category: security
technology:
- ci
confidence: HIGH
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
subcategory:
- audit
likelihood: MEDIUM
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/generic.ci.security.bash-reverse-shell.bash_reverse_shell
shortlink: https://sg.run/4l9l
semgrep.dev:
rule:
r_id: 16200
rv_id: 1262664
rule_id: gxUJrJ
version_id: jQTn5QE
url: https://semgrep.dev/playground/r/jQTn5QE/generic.ci.security.bash-reverse-shell.bash_reverse_shell
origin: community
message: Semgrep found a bash reverse shell
severity: ERROR
languages:
- generic
pattern-either:
- pattern: |
sh -i >& /dev/udp/.../... 0>&1
- pattern: |
<...>/dev/tcp/.../...; sh <&... >&... 2>&
- pattern: |
<...>/dev/tcp/.../...; cat <&... | while read line; do $line 2>&... >&...;done
- pattern: |
sh -i ...<...> /dev/tcp/.../... ...<&... 1>&... 2>&
- id: php.lang.security.injection.tainted-filename.tainted-filename
severity: WARNING
message: File name based on user input risks server-side request forgery.
metadata:
technology:
- php
category: security
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/php.lang.security.injection.tainted-filename.tainted-filename
shortlink: https://sg.run/Ayqp
semgrep.dev:
rule:
r_id: 16250
rv_id: 1263287
rule_id: 5rUpro
version_id: 7ZTE3J1
url: https://semgrep.dev/playground/r/7ZTE3J1/php.lang.security.injection.tainted-filename.tainted-filename
origin: community
languages:
- php
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: $_GET
- pattern: $_POST
- pattern: $_COOKIE
- pattern: $_REQUEST
- pattern: $_SERVER
pattern-sanitizers:
- patterns:
- pattern-either:
- pattern-inside: basename($PATH, ...)
- pattern-inside: linkinfo($PATH, ...)
- pattern-inside: readlink($PATH, ...)
- pattern-inside: realpath($PATH, ...)
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: opcache_compile_file($FILENAME, ...)
- pattern-inside: opcache_invalidate($FILENAME, ...)
- pattern-inside: opcache_is_script_cached($FILENAME, ...)
- pattern-inside: runkit7_import($FILENAME, ...)
- pattern-inside: readline_read_history($FILENAME, ...)
- pattern-inside: readline_write_history($FILENAME, ...)
- pattern-inside: rar_open($FILENAME, ...)
- pattern-inside: zip_open($FILENAME, ...)
- pattern-inside: gzfile($FILENAME, ...)
- pattern-inside: gzopen($FILENAME, ...)
- pattern-inside: readgzfile($FILENAME, ...)
- pattern-inside: hash_file($ALGO, $FILENAME, ...)
- pattern-inside: hash_update_file($CONTEXT, $FILENAME, ...)
- pattern-inside: pg_trace($FILENAME, ...)
- pattern-inside: dio_open($FILENAME, ...)
- pattern-inside: finfo_file($FINFO, $FILENAME, ...)
- pattern-inside: mime_content_type($FILENAME, ...)
- pattern-inside: chgrp($FILENAME, ...)
- pattern-inside: chmod($FILENAME, ...)
- pattern-inside: chown($FILENAME, ...)
- pattern-inside: clearstatcache($CLEAR_REALPATH_CACHE, $FILENAME, ...)
- pattern-inside: file_exists($FILENAME, ...)
- pattern-inside: file_get_contents($FILENAME, ...)
- pattern-inside: file_put_contents($FILENAME, ...)
- pattern-inside: file($FILENAME, ...)
- pattern-inside: fileatime($FILENAME, ...)
- pattern-inside: filectime($FILENAME, ...)
- pattern-inside: filegroup($FILENAME, ...)
- pattern-inside: fileinode($FILENAME, ...)
- pattern-inside: filemtime($FILENAME, ...)
- pattern-inside: fileowner($FILENAME, ...)
- pattern-inside: fileperms($FILENAME, ...)
- pattern-inside: filesize($FILENAME, ...)
- pattern-inside: filetype($FILENAME, ...)
- pattern-inside: fnmatch($PATTERN, $FILENAME, ...)
- pattern-inside: fopen($FILENAME, ...)
- pattern-inside: is_dir($FILENAME, ...)
- pattern-inside: is_executable($FILENAME, ...)
- pattern-inside: is_file($FILENAME, ...)
- pattern-inside: is_link($FILENAME, ...)
- pattern-inside: is_readable($FILENAME, ...)
- pattern-inside: is_uploaded_file($FILENAME, ...)
- pattern-inside: is_writable($FILENAME, ...)
- pattern-inside: lchgrp($FILENAME, ...)
- pattern-inside: lchown($FILENAME, ...)
- pattern-inside: lstat($FILENAME, ...)
- pattern-inside: parse_ini_file($FILENAME, ...)
- pattern-inside: readfile($FILENAME, ...)
- pattern-inside: stat($FILENAME, ...)
- pattern-inside: touch($FILENAME, ...)
- pattern-inside: unlink($FILENAME, ...)
- pattern-inside: xattr_get($FILENAME, ...)
- pattern-inside: xattr_list($FILENAME, ...)
- pattern-inside: xattr_remove($FILENAME, ...)
- pattern-inside: xattr_set($FILENAME, ...)
- pattern-inside: xattr_supported($FILENAME, ...)
- pattern-inside: enchant_broker_request_pwl_dict($BROKER, $FILENAME, ...)
- pattern-inside: pspell_config_personal($CONFIG, $FILENAME, ...)
- pattern-inside: pspell_config_repl($CONFIG, $FILENAME, ...)
- pattern-inside: pspell_new_personal($FILENAME, ...)
- pattern-inside: exif_imagetype($FILENAME, ...)
- pattern-inside: getimagesize($FILENAME, ...)
- pattern-inside: image2wbmp($IMAGE, $FILENAME, ...)
- pattern-inside: imagecreatefromavif($FILENAME, ...)
- pattern-inside: imagecreatefrombmp($FILENAME, ...)
- pattern-inside: imagecreatefromgd2($FILENAME, ...)
- pattern-inside: imagecreatefromgd2part($FILENAME, ...)
- pattern-inside: imagecreatefromgd($FILENAME, ...)
- pattern-inside: imagecreatefromgif($FILENAME, ...)
- pattern-inside: imagecreatefromjpeg($FILENAME, ...)
- pattern-inside: imagecreatefrompng($FILENAME, ...)
- pattern-inside: imagecreatefromtga($FILENAME, ...)
- pattern-inside: imagecreatefromwbmp($FILENAME, ...)
- pattern-inside: imagecreatefromwebp($FILENAME, ...)
- pattern-inside: imagecreatefromxbm($FILENAME, ...)
- pattern-inside: imagecreatefromxpm($FILENAME, ...)
- pattern-inside: imageloadfont($FILENAME, ...)
- pattern-inside: imagexbm($IMAGE, $FILENAME, ...)
- pattern-inside: iptcembed($IPTC_DATA, $FILENAME, ...)
- pattern-inside: mailparse_msg_extract_part_file($MIMEMAIL, $FILENAME, ...)
- pattern-inside: mailparse_msg_extract_whole_part_file($MIMEMAIL, $FILENAME,
...)
- pattern-inside: mailparse_msg_parse_file($FILENAME, ...)
- pattern-inside: fdf_add_template($FDF_DOCUMENT, $NEWPAGE, $FILENAME, ...)
- pattern-inside: fdf_get_ap($FDF_DOCUMENT, $FIELD, $FACE, $FILENAME, ...)
- pattern-inside: fdf_open($FILENAME, ...)
- pattern-inside: fdf_save($FDF_DOCUMENT, $FILENAME, ...)
- pattern-inside: fdf_set_ap($FDF_DOCUMENT, $FIELD_NAME, $FACE, $FILENAME, ...)
- pattern-inside: ps_add_launchlink($PSDOC, $LLX, $LLY, $URX, $URY, $FILENAME,
...)
- pattern-inside: ps_add_pdflink($PSDOC, $LLX, $LLY, $URX, $URY, $FILENAME,
...)
- pattern-inside: ps_open_file($PSDOC, $FILENAME, ...)
- pattern-inside: ps_open_image_file($PSDOC, $TYPE, $FILENAME, ...)
- pattern-inside: posix_access($FILENAME, ...)
- pattern-inside: posix_mkfifo($FILENAME, ...)
- pattern-inside: posix_mknod($FILENAME, ...)
- pattern-inside: ftok($FILENAME, ...)
- pattern-inside: fann_cascadetrain_on_file($ANN, $FILENAME, ...)
- pattern-inside: fann_read_train_from_file($FILENAME, ...)
- pattern-inside: fann_train_on_file($ANN, $FILENAME, ...)
- pattern-inside: highlight_file($FILENAME, ...)
- pattern-inside: php_strip_whitespace($FILENAME, ...)
- pattern-inside: stream_resolve_include_path($FILENAME, ...)
- pattern-inside: swoole_async_read($FILENAME, ...)
- pattern-inside: swoole_async_readfile($FILENAME, ...)
- pattern-inside: swoole_async_write($FILENAME, ...)
- pattern-inside: swoole_async_writefile($FILENAME, ...)
- pattern-inside: swoole_load_module($FILENAME, ...)
- pattern-inside: tidy_parse_file($FILENAME, ...)
- pattern-inside: tidy_repair_file($FILENAME, ...)
- pattern-inside: get_meta_tags($FILENAME, ...)
- pattern-inside: yaml_emit_file($FILENAME, ...)
- pattern-inside: yaml_parse_file($FILENAME, ...)
- pattern-inside: curl_file_create($FILENAME, ...)
- pattern-inside: ftp_chmod($FTP, $PERMISSIONS, $FILENAME, ...)
- pattern-inside: ftp_delete($FTP, $FILENAME, ...)
- pattern-inside: ftp_mdtm($FTP, $FILENAME, ...)
- pattern-inside: ftp_size($FTP, $FILENAME, ...)
- pattern-inside: rrd_create($FILENAME, ...)
- pattern-inside: rrd_fetch($FILENAME, ...)
- pattern-inside: rrd_graph($FILENAME, ...)
- pattern-inside: rrd_info($FILENAME, ...)
- pattern-inside: rrd_last($FILENAME, ...)
- pattern-inside: rrd_lastupdate($FILENAME, ...)
- pattern-inside: rrd_tune($FILENAME, ...)
- pattern-inside: rrd_update($FILENAME, ...)
- pattern-inside: snmp_read_mib($FILENAME, ...)
- pattern-inside: ssh2_sftp_chmod($SFTP, $FILENAME, ...)
- pattern-inside: ssh2_sftp_realpath($SFTP, $FILENAME, ...)
- pattern-inside: ssh2_sftp_unlink($SFTP, $FILENAME, ...)
- pattern-inside: apache_lookup_uri($FILENAME, ...)
- pattern-inside: md5_file($FILENAME, ...)
- pattern-inside: sha1_file($FILENAME, ...)
- pattern-inside: simplexml_load_file($FILENAME, ...)
- pattern: $FILENAME
- id: terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials
patterns:
- pattern-inside: |
provider "aws" {
...
secret_key = "$SECRET"
}
- focus-metavariable: $SECRET
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
languages:
- hcl
severity: WARNING
metadata:
technology:
- secrets
- aws
- terraform
category: security
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials
shortlink: https://sg.run/L3kn
semgrep.dev:
rule:
r_id: 16439
rv_id: 1263735
rule_id: d8U4n0
version_id: rxTAK76
url: https://semgrep.dev/playground/r/rxTAK76/terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials
origin: community
- id: php.laravel.security.laravel-sql-injection.laravel-sql-injection
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
category: security
technology:
- laravel
references:
- https://laravel.com/docs/8.x/queries
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/php.laravel.security.laravel-sql-injection.laravel-sql-injection
shortlink: https://sg.run/x40p
semgrep.dev:
rule:
r_id: 16830
rv_id: 1263313
rule_id: j2UQdp
version_id: BjTkZ45
url: https://semgrep.dev/playground/r/BjTkZ45/php.laravel.security.laravel-sql-injection.laravel-sql-injection
origin: community
severity: WARNING
message: Detected a SQL query based on user input. This could lead to SQL injection,
which could potentially result in sensitive data being exfiltrated by attackers.
Instead, use parameterized queries and prepared statements.
languages:
- php
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: $_GET
- pattern: $_POST
- pattern: $_COOKIE
- pattern: $_REQUEST
- pattern: $_SERVER
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: $SQL
- pattern-either:
- pattern-inside: DB::table(...)->whereRaw($SQL, ...)
- pattern-inside: DB::table(...)->orWhereRaw($SQL, ...)
- pattern-inside: DB::table(...)->groupByRaw($SQL, ...)
- pattern-inside: DB::table(...)->havingRaw($SQL, ...)
- pattern-inside: DB::table(...)->orHavingRaw($SQL, ...)
- pattern-inside: DB::table(...)->orderByRaw($SQL, ...)
- patterns:
- pattern: $EXPRESSION
- pattern-either:
- pattern-inside: DB::table(...)->selectRaw($EXPRESSION, ...)
- pattern-inside: DB::table(...)->fromRaw($EXPRESSION, ...)
- patterns:
- pattern: $COLUMNS
- pattern-either:
- pattern-inside: DB::table(...)->whereNull($COLUMNS, ...)
- pattern-inside: DB::table(...)->orWhereNull($COLUMN)
- pattern-inside: DB::table(...)->whereNotNull($COLUMNS, ...)
- pattern-inside: DB::table(...)->whereRowValues($COLUMNS, ...)
- pattern-inside: DB::table(...)->orWhereRowValues($COLUMNS, ...)
- pattern-inside: DB::table(...)->find($ID, $COLUMNS)
- pattern-inside: DB::table(...)->paginate($PERPAGE, $COLUMNS, ...)
- pattern-inside: DB::table(...)->simplePaginate($PERPAGE, $COLUMNS, ...)
- pattern-inside: DB::table(...)->cursorPaginate($PERPAGE, $COLUMNS, ...)
- pattern-inside: DB::table(...)->getCountForPagination($COLUMNS)
- pattern-inside: DB::table(...)->aggregate($FUNCTION, $COLUMNS)
- pattern-inside: DB::table(...)->numericAggregate($FUNCTION, $COLUMNS)
- pattern-inside: DB::table(...)->insertUsing($COLUMNS, ...)
- pattern-inside: DB::table(...)->select($COLUMNS)
- pattern-inside: DB::table(...)->get($COLUMNS)
- pattern-inside: DB::table(...)->count($COLUMNS)
- patterns:
- pattern: $COLUMN
- pattern-either:
- pattern-inside: DB::table(...)->whereIn($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereIn($COLUMN, ...)
- pattern-inside: DB::table(...)->whereNotIn($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereNotIn($COLUMN, ...)
- pattern-inside: DB::table(...)->whereIntegerInRaw($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereIntegerInRaw($COLUMN, ...)
- pattern-inside: DB::table(...)->whereIntegerNotInRaw($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereIntegerNotInRaw($COLUMN, ...)
- pattern-inside: DB::table(...)->whereBetweenColumns($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereBetween($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereBetweenColumns($COLUMN, ...)
- pattern-inside: DB::table(...)->whereNotBetween($COLUMN, ...)
- pattern-inside: DB::table(...)->whereNotBetweenColumns($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereNotBetween($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereNotBetweenColumns($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereNotNull($COLUMN)
- pattern-inside: DB::table(...)->whereDate($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereDate($COLUMN, ...)
- pattern-inside: DB::table(...)->whereTime($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereTime($COLUMN, ...)
- pattern-inside: DB::table(...)->whereDay($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereDay($COLUMN, ...)
- pattern-inside: DB::table(...)->whereMonth($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereMonth($COLUMN, ...)
- pattern-inside: DB::table(...)->whereYear($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereYear($COLUMN, ...)
- pattern-inside: DB::table(...)->whereJsonContains($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereJsonContains($COLUMN, ...)
- pattern-inside: DB::table(...)->whereJsonDoesntContain($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereJsonDoesntContain($COLUMN, ...)
- pattern-inside: DB::table(...)->whereJsonLength($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhereJsonLength($COLUMN, ...)
- pattern-inside: DB::table(...)->having($COLUMN, ...)
- pattern-inside: DB::table(...)->orHaving($COLUMN, ...)
- pattern-inside: DB::table(...)->havingBetween($COLUMN, ...)
- pattern-inside: DB::table(...)->orderBy($COLUMN, ...)
- pattern-inside: DB::table(...)->orderByDesc($COLUMN)
- pattern-inside: DB::table(...)->latest($COLUMN)
- pattern-inside: DB::table(...)->oldest($COLUMN)
- pattern-inside: DB::table(...)->forPageBeforeId($PERPAGE, $LASTID, $COLUMN)
- pattern-inside: DB::table(...)->forPageAfterId($PERPAGE, $LASTID, $COLUMN)
- pattern-inside: DB::table(...)->value($COLUMN)
- pattern-inside: DB::table(...)->pluck($COLUMN, ...)
- pattern-inside: DB::table(...)->implode($COLUMN, ...)
- pattern-inside: DB::table(...)->min($COLUMN)
- pattern-inside: DB::table(...)->max($COLUMN)
- pattern-inside: DB::table(...)->sum($COLUMN)
- pattern-inside: DB::table(...)->avg($COLUMN)
- pattern-inside: DB::table(...)->average($COLUMN)
- pattern-inside: DB::table(...)->increment($COLUMN, ...)
- pattern-inside: DB::table(...)->decrement($COLUMN, ...)
- pattern-inside: DB::table(...)->where($COLUMN, ...)
- pattern-inside: DB::table(...)->orWhere($COLUMN, ...)
- pattern-inside: DB::table(...)->addSelect($COLUMN)
- patterns:
- pattern: $QUERY
- pattern-inside: DB::unprepared($QUERY)
- id: csharp.dotnet.security.razor-template-injection.razor-template-injection
message: User-controllable string passed to Razor.Parse. This leads directly to
code execution in the context of the process.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
cwe2022-top25: true
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-(SSTI)-in-ASP.NET-Razor/
subcategory:
- vuln
technology:
- .net
- razor
- asp
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/csharp.dotnet.security.razor-template-injection.razor-template-injection
shortlink: https://sg.run/oyj0
semgrep.dev:
rule:
r_id: 18216
rv_id: 1262621
rule_id: EwUr68
version_id: 1QTypdj
url: https://semgrep.dev/playground/r/1QTypdj/csharp.dotnet.security.razor-template-injection.razor-template-injection
origin: community
languages:
- csharp
mode: taint
pattern-sources:
- patterns:
- focus-metavariable: $ARG
- pattern-inside: |
public ActionResult $METHOD(..., string $ARG,...){...}
pattern-sinks:
- pattern: |
Razor.Parse(...)
pattern-sanitizers:
- not_conflicting: true
pattern: $F(...)
- id: csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine
mode: taint
pattern-sources:
- patterns:
- pattern: $A
- pattern-inside: |
Path.Combine(...,$A,...)
- pattern-inside: |
public $TYPE $M(...,$A,...){...}
- pattern-not-inside: |
<... Path.GetFileName($A) != $A ...>
pattern-sinks:
- patterns:
- focus-metavariable: $X
- pattern: |
File.$METHOD($X,...)
- metavariable-regex:
metavariable: $METHOD
regex: (?i)^(read|write)
pattern-sanitizers:
- pattern: |
Path.GetFileName(...)
- patterns:
- pattern-inside: |
$X = Path.GetFileName(...);
...
- pattern: $X
- patterns:
- pattern: $X
- pattern-inside: |
if(<... Path.GetFileName($X) != $X ...>){
...
throw new $EXCEPTION(...);
}
...
message: String argument $A is used to read or write data from a file via Path.Combine
without direct sanitization via Path.GetFileName. If the path is user-supplied
data this can lead to path traversal.
languages:
- csharp
severity: WARNING
metadata:
category: security
confidence: MEDIUM
references:
- https://www.praetorian.com/blog/pathcombine-security-issues-in-aspnet-applications/
- https://docs.microsoft.com/en-us/dotnet/api/system.io.path.combine?view=net-6.0#remarks
technology:
- .net
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine
shortlink: https://sg.run/1RvG
semgrep.dev:
rule:
r_id: 18222
rv_id: 1262632
rule_id: 3qU3bE
version_id: vdT0644
url: https://semgrep.dev/playground/r/vdT0644/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine
origin: community
- id: csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override
mode: taint
pattern-sources:
- patterns:
- focus-metavariable: $ARG
- pattern-inside: |
public $T $M(...,string $ARG,...){...}
pattern-sinks:
- patterns:
- pattern: |
$XMLDOCUMENT.$METHOD(...)
- pattern-inside: "XmlDocument $XMLDOCUMENT = new XmlDocument(...);\n...\n$XMLDOCUMENT.XmlResolver
= new XmlUrlResolver(...);\n... \n"
message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling
a string argument from a public method. Enabling Document Type Definition (DTD)
parsing may cause XML External Entity (XXE) injection if supplied with user-controllable
data.
languages:
- csharp
severity: WARNING
metadata:
category: security
references:
- https://www.jardinesoftware.net/2016/05/26/xxe-and-net/
- https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks
technology:
- .net
- xml
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
impact: MEDIUM
likelihood: LOW
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override
shortlink: https://sg.run/k98P
semgrep.dev:
rule:
r_id: 18228
rv_id: 1262654
rule_id: ReUK9k
version_id: K3TKk5E
url: https://semgrep.dev/playground/r/K3TKk5E/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override
origin: community
- id: csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override
mode: taint
pattern-sources:
- patterns:
- focus-metavariable: $ARG
- pattern-inside: |
public $T $M(...,string $ARG,...){...}
pattern-sinks:
- patterns:
- pattern: |
XmlReader $READER = XmlReader.Create(...,$RS,...);
- pattern-inside: "XmlReaderSettings $RS = new XmlReaderSettings();\n...\n$RS.DtdProcessing
= DtdProcessing.Parse;\n... \n"
message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling
a string argument from a public method. Enabling Document Type Definition (DTD)
parsing may cause XML External Entity (XXE) injection if supplied with user-controllable
data.
languages:
- csharp
severity: WARNING
metadata:
category: security
references:
- https://www.jardinesoftware.net/2016/05/26/xxe-and-net/
- https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks
technology:
- .net
- xml
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
impact: MEDIUM
likelihood: LOW
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override
shortlink: https://sg.run/wXjA
semgrep.dev:
rule:
r_id: 18229
rv_id: 1262655
rule_id: AbU3pX
version_id: qkTR7WD
url: https://semgrep.dev/playground/r/qkTR7WD/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override
origin: community
- id: csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults
mode: taint
pattern-sources:
- patterns:
- focus-metavariable: $ARG
- pattern-inside: |
public $T $M(...,string $ARG,...){...}
pattern-sinks:
- patterns:
- pattern: |
$READER.$METHOD(...)
- pattern-not-inside: |
$READER.DtdProcessing = DtdProcessing.Prohibit;
...
- pattern-inside: |
XmlTextReader $READER = new XmlTextReader(...);
...
message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling
a string argument from a public method. Enabling Document Type Definition (DTD)
parsing may cause XML External Entity (XXE) injection if supplied with user-controllable
data.
languages:
- csharp
severity: WARNING
metadata:
category: security
references:
- https://www.jardinesoftware.net/2016/05/26/xxe-and-net/
- https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks
technology:
- .net
- xml
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
impact: MEDIUM
likelihood: LOW
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults
shortlink: https://sg.run/xXjL
semgrep.dev:
rule:
r_id: 18230
rv_id: 1262656
rule_id: BYUevk
version_id: l4TJRWG
url: https://semgrep.dev/playground/r/l4TJRWG/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults
origin: community
- id: go.aws-lambda.security.database-sqli.database-sqli
languages:
- go
message: Detected SQL statement that is tainted by `$EVENT` object. This could lead
to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use prepared statements with the 'Prepare' and 'PrepareContext'
calls.
mode: taint
metadata:
references:
- https://pkg.go.dev/database/sql#DB.Query
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- database
- sql
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/go.aws-lambda.security.database-sqli.database-sqli
shortlink: https://sg.run/e5e8
semgrep.dev:
rule:
r_id: 18232
rv_id: 1262909
rule_id: WAUdJ7
version_id: BjTkZkQ
url: https://semgrep.dev/playground/r/BjTkZkQ/go.aws-lambda.security.database-sqli.database-sqli
origin: community
pattern-sinks:
- patterns:
- focus-metavariable: $QUERY
- pattern-either:
- pattern: $DB.Exec($QUERY,...)
- pattern: $DB.ExecContent($QUERY,...)
- pattern: $DB.Query($QUERY,...)
- pattern: $DB.QueryContext($QUERY,...)
- pattern: $DB.QueryRow($QUERY,...)
- pattern: $DB.QueryRowContext($QUERY,...)
- pattern-inside: |
import "database/sql"
...
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
func $HANDLER($CTX $CTXTYPE, $EVENT $TYPE, ...) {...}
...
lambda.Start($HANDLER, ...)
- patterns:
- pattern-inside: |
func $HANDLER($EVENT $TYPE) {...}
...
lambda.Start($HANDLER, ...)
- pattern-not-inside: |
func $HANDLER($EVENT context.Context) {...}
...
lambda.Start($HANDLER, ...)
- focus-metavariable: $EVENT
severity: WARNING
- id: go.aws-lambda.security.tainted-sql-string.tainted-sql-string
languages:
- go
severity: ERROR
message: Detected user input used to manually construct a SQL string. This is usually
bad practice because manual construction could accidentally result in a SQL injection.
An attacker could use a SQL injection to steal or modify contents of the database.
Instead, use a parameterized query which is available by default in most database
engines. Alternatively, consider using an object-relational mapper (ORM) such
as Sequelize which will protect your queries.
metadata:
references:
- https://owasp.org/www-community/attacks/SQL_Injection
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/go.aws-lambda.security.tainted-sql-string.tainted-sql-string
shortlink: https://sg.run/vX3Y
semgrep.dev:
rule:
r_id: 18233
rv_id: 1262910
rule_id: 0oUwqg
version_id: DkTRbRL
url: https://semgrep.dev/playground/r/DkTRbRL/go.aws-lambda.security.tainted-sql-string.tainted-sql-string
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
func $HANDLER($CTX $CTXTYPE, $EVENT $TYPE, ...) {...}
...
lambda.Start($HANDLER, ...)
- patterns:
- pattern-inside: |
func $HANDLER($EVENT $TYPE) {...}
...
lambda.Start($HANDLER, ...)
- pattern-not-inside: |
func $HANDLER($EVENT context.Context) {...}
...
lambda.Start($HANDLER, ...)
- focus-metavariable: $EVENT
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: |
"$SQLSTR" + ...
- metavariable-regex:
metavariable: $SQLSTR
regex: (?i)(\s*select|\s*delete|\s*insert|\s*create|\s*update|\s*alter|\s*drop).*
- patterns:
- pattern-either:
- pattern: fmt.Fprintf($F, "$SQLSTR", ...)
- pattern: fmt.Sprintf("$SQLSTR", ...)
- pattern: fmt.Printf("$SQLSTR", ...)
- metavariable-regex:
metavariable: $SQLSTR
regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).*
- pattern-not-inside: |
log.$PRINT(...)
pattern-sanitizers:
- pattern: strconv.Atoi(...)
- id: go.lang.security.filepath-clean-misuse.filepath-clean-misuse
message: '`Clean` is not intended to sanitize against path traversal attacks. This
function is for finding the shortest path name equivalent to the given input.
Using `Clean` to sanitize file reads may expose this application to path traversal
attacks, where an attacker could access arbitrary files on the server. To fix
this easily, write this: `filepath.FromSlash(path.Clean("/"+strings.Trim(req.URL.Path,
"/")))` However, a better solution is using the `SecureJoin` function in the package
`filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme.'
severity: ERROR
languages:
- go
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
($REQUEST : *http.Request).$ANYTHING
- pattern: |
($REQUEST : http.Request).$ANYTHING
- metavariable-regex:
metavariable: $ANYTHING
regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
pattern-sinks:
- patterns:
- pattern-either:
- pattern: filepath.Clean($...INNER)
- pattern: path.Clean($...INNER)
pattern-sanitizers:
- pattern-either:
- pattern: |
"/" + ...
fix: filepath.FromSlash(filepath.Clean("/"+strings.Trim($...INNER, "/")))
options:
interfile: true
metadata:
references:
- https://pkg.go.dev/path#Clean
- http://technosophos.com/2016/03/31/go-quickly-cleaning-filepaths.html
- https://labs.detectify.com/2021/12/15/zero-day-path-traversal-grafana/
- https://dzx.cz/2021/04/02/go_path_traversal/
- https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
category: security
technology:
- go
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/go.lang.security.filepath-clean-misuse.filepath-clean-misuse
shortlink: https://sg.run/ZKzw
semgrep.dev:
rule:
r_id: 18235
rv_id: 1262967
rule_id: qNUQJe
version_id: jQTn5Bj
url: https://semgrep.dev/playground/r/jQTn5Bj/go.lang.security.filepath-clean-misuse.filepath-clean-misuse
origin: community
- id: java.aws-lambda.security.tainted-sql-string.tainted-sql-string
languages:
- java
severity: ERROR
message: Detected user input used to manually construct a SQL string. This is usually
bad practice because manual construction could accidentally result in a SQL injection.
An attacker could use a SQL injection to steal or modify contents of the database.
Instead, use a parameterized query which is available by default in most database
engines. Alternatively, consider using an object-relational mapper (ORM) such
as Sequelize which will protect your queries.
options:
interfile: true
metadata:
references:
- https://owasp.org/www-community/attacks/SQL_Injection
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/java.aws-lambda.security.tainted-sql-string.tainted-sql-string
shortlink: https://sg.run/EBYN
semgrep.dev:
rule:
r_id: 18237
rv_id: 1262977
rule_id: YGUl4z
version_id: O9TpxQN
url: https://semgrep.dev/playground/r/O9TpxQN/java.aws-lambda.security.tainted-sql-string.tainted-sql-string
origin: community
mode: taint
pattern-sources:
- patterns:
- focus-metavariable: $EVENT
- pattern-either:
- pattern: |
$HANDLERTYPE $HANDLER($TYPE $EVENT, com.amazonaws.services.lambda.runtime.Context $CONTEXT) {
...
}
- pattern: |
$HANDLERTYPE $HANDLER(InputStream $EVENT, OutputStream $OUT, com.amazonaws.services.lambda.runtime.Context $CONTEXT) {
...
}
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
"$SQLSTR" + ...
- pattern: |
"$SQLSTR".concat(...)
- patterns:
- pattern-inside: |
StringBuilder $SB = new StringBuilder("$SQLSTR");
...
- pattern: $SB.append(...)
- patterns:
- pattern-inside: |
$VAR = "$SQLSTR";
...
- pattern: $VAR += ...
- pattern: String.format("$SQLSTR", ...)
- metavariable-regex:
metavariable: $SQLSTR
regex: (?i)(select|delete|insert|create|update|alter|drop)\b
- pattern-not-inside: |
System.out.$PRINTLN(...)
- id: java.aws-lambda.security.tainted-sqli.tainted-sqli
message: Detected SQL statement that is tainted by `$EVENT` object. This could lead
to SQL injection if variables in the SQL statement are not properly sanitized.
Use parameterized SQL queries or properly sanitize user input instead.
languages:
- java
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- focus-metavariable: $EVENT
- pattern-either:
- pattern: |
$HANDLERTYPE $HANDLER($TYPE $EVENT, com.amazonaws.services.lambda.runtime.Context $CONTEXT) {
...
}
- pattern: |
$HANDLERTYPE $HANDLER(InputStream $EVENT, OutputStream $OUT, com.amazonaws.services.lambda.runtime.Context $CONTEXT) {
...
}
pattern-sinks:
- patterns:
- pattern-either:
- pattern: "(java.sql.CallableStatement $STMT) = ...; \n"
- pattern: |
(java.sql.Statement $STMT) = ...;
- pattern: |
(java.sql.PreparedStatement $STMT) = ...;
- pattern: |
$VAR = $CONN.prepareStatement(...)
- pattern: |
$PATH.queryForObject(...);
- pattern: |
(java.util.Map<String, Object> $STMT) = $PATH.queryForMap(...);
- pattern: |
(org.springframework.jdbc.support.rowset.SqlRowSet $STMT) = ...;
- patterns:
- pattern-inside: |
(String $SQL) = "$SQLSTR" + ...;
...
- pattern: $PATH.$SQLCMD(..., $SQL, ...);
- metavariable-regex:
metavariable: $SQLSTR
regex: (?i)(^SELECT.* | ^INSERT.* | ^UPDATE.*)
- metavariable-regex:
metavariable: $SQLCMD
regex: (execute|query|executeUpdate|batchUpdate)
options:
interfile: true
metadata:
category: security
technology:
- sql
- java
- aws-lambda
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/java.aws-lambda.security.tainted-sqli.tainted-sqli
shortlink: https://sg.run/7942
semgrep.dev:
rule:
r_id: 18238
rv_id: 1262978
rule_id: 6JUDWk
version_id: e1Tyj4g
url: https://semgrep.dev/playground/r/e1Tyj4g/java.aws-lambda.security.tainted-sqli.tainted-sqli
origin: community
- id: java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request
message: Detected input from a HTTPServletRequest going into a SQL sink or statement.
This could lead to SQL injection if variables in the SQL statement are not properly
sanitized. Use parameterized SQL queries or properly sanitize user input instead.
severity: WARNING
metadata:
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
category: security
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
cwe2021-top25: true
cwe2022-top25: true
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
- https://owasp.org/www-community/attacks/SQL_Injection
subcategory:
- vuln
technology:
- sql
- java
- servlets
- spring
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request
shortlink: https://sg.run/Lg56
semgrep.dev:
rule:
r_id: 18239
rv_id: 1409390
rule_id: oqUBJG
version_id: 7ZTKJNj
url: https://semgrep.dev/playground/r/7ZTKJNj/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request
origin: community
languages:
- java
mode: taint
options:
taint_assume_safe_numbers: true
taint_assume_safe_booleans: true
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
(HttpServletRequest $REQ).$REQFUNC(...)
- pattern: "(ServletRequest $REQ).$REQFUNC(...) \n"
- metavariable-regex:
metavariable: $REQFUNC
regex: (getInputStream|getParameter|getParameterMap|getParameterValues|getReader|getCookies|getHeader|getHeaderNames|getHeaders|getPart|getParts|getQueryString)
pattern-sinks:
- patterns:
- pattern-either:
- pattern: "(java.sql.CallableStatement $STMT) = ...; \n"
- pattern: |
(java.sql.Statement $STMT) = ...;
...
$OUTPUT = $STMT.$FUNC(...);
- pattern: |
(java.sql.PreparedStatement $STMT) = ...;
- pattern: |
$VAR = $CONN.prepareStatement(...)
- pattern: |
$PATH.queryForObject(...);
- pattern: |
(java.util.Map<String, Object> $STMT) = $PATH.queryForMap(...);
- pattern: |
(org.springframework.jdbc.support.rowset.SqlRowSet $STMT) = ...;
- pattern: |
(org.springframework.jdbc.core.JdbcTemplate $TEMPL).batchUpdate(...)
- patterns:
- pattern-inside: |
(String $SQL) = "$SQLSTR" + ...;
...
- pattern: $PATH.$SQLCMD(..., $SQL, ...);
- metavariable-regex:
metavariable: $SQLSTR
regex: (?i)(^SELECT.* | ^INSERT.* | ^UPDATE.*)
- metavariable-regex:
metavariable: $SQLCMD
regex: (execute|query|executeUpdate|batchUpdate)
- id: java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request
message: Detected input from a HTTPServletRequest going into a 'ProcessBuilder'
or 'exec' command. This could lead to command injection if variables passed into
the exec commands are not properly sanitized. Instead, avoid using these OS commands
with user-supplied input, or, if you must use these commands, use a whitelist
of specific values.
languages:
- java
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
(HttpServletRequest $REQ)
- patterns:
- pattern-inside: |
(javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);
...
for (javax.servlet.http.Cookie $COOKIE: $COOKIES) {
...
}
- pattern: |
$COOKIE.getValue(...)
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
(ProcessBuilder $PB) = ...;
- patterns:
- pattern: |
(Process $P) = ...;
- pattern-not: |
(Process $P) = (java.lang.Runtime $R).exec(...);
- patterns:
- pattern: (java.lang.Runtime $R).exec($CMD, ...);
- focus-metavariable: $CMD
- patterns:
- pattern-either:
- pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...; \n...\n(ProcessBuilder
$PB) = ...;\n...\n$PB.command($ARGLIST);\n"
- pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...; \n...\n(ProcessBuilder
$PB) = ...;\n"
- pattern-inside: "(java.util.List<$TYPE> $ARGLIST) = ...; \n...\n(Process
$P) = ...;\n"
- pattern: |
$ARGLIST.add(...);
metadata:
category: security
technology:
- java
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request
shortlink: https://sg.run/8zPN
semgrep.dev:
rule:
r_id: 18240
rv_id: 1263042
rule_id: zdUWrg
version_id: LjTkg9J
url: https://semgrep.dev/playground/r/LjTkg9J/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request
origin: community
- id: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false
severity: ERROR
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://blog.sonarsource.com/secure-xml-processor
- https://xerces.apache.org/xerces2-j/features.html
category: security
technology:
- java
- xml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false
shortlink: https://sg.run/4Dv5
semgrep.dev:
rule:
r_id: 18244
rv_id: 1263057
rule_id: j2UrJ8
version_id: 0bTKzgX
url: https://semgrep.dev/playground/r/0bTKzgX/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false
origin: community
message: DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external
entity declarations, this is vulnerable to XML external entity attacks. Disable
this by setting the feature "http://apache.org/xml/features/disallow-doctype-decl"
to true. Alternatively, allow DOCTYPE declarations and only prohibit external
entities declarations. This can be done by setting the features "http://xml.org/sax/features/external-general-entities"
and "http://xml.org/sax/features/external-parameter-entities" to false.
patterns:
- pattern: $DBFACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl",
false);
- pattern-not-inside: |
$RETURNTYPE $METHOD(...){
...
$DBF.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
$DBF.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
}
- pattern-not-inside: |
$RETURNTYPE $METHOD(...){
...
$DBF.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
$DBF.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
}
- pattern-not-inside: |
$RETURNTYPE $METHOD(...){
...
$DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
...
$DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
...
}
- pattern-not-inside: |
$RETURNTYPE $METHOD(...){
...
$DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
...
$DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
...
}
languages:
- java
- id: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing
severity: ERROR
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://blog.sonarsource.com/secure-xml-processor
- https://xerces.apache.org/xerces2-j/features.html
category: security
technology:
- java
- xml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing
shortlink: https://sg.run/PYBz
semgrep.dev:
rule:
r_id: 18245
rv_id: 1263058
rule_id: 10UPQB
version_id: K3TKk80
url: https://semgrep.dev/playground/r/K3TKk80/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing
origin: community
message: DOCTYPE declarations are enabled for this DocumentBuilderFactory. This
is vulnerable to XML external entity attacks. Disable this by setting the feature
"http://apache.org/xml/features/disallow-doctype-decl" to true. Alternatively,
allow DOCTYPE declarations and only prohibit external entities declarations. This
can be done by setting the features "http://xml.org/sax/features/external-general-entities"
and "http://xml.org/sax/features/external-parameter-entities" to false.
mode: taint
pattern-sources:
- by-side-effect: true
patterns:
- pattern-either:
- pattern: |
$FACTORY = DocumentBuilderFactory.newInstance();
- patterns:
- pattern: $FACTORY
- pattern-inside: |
class $C {
...
$V $FACTORY = DocumentBuilderFactory.newInstance();
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = DocumentBuilderFactory.newInstance();
static {
...
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
...
}
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = DocumentBuilderFactory.newInstance();
static {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
}
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = DocumentBuilderFactory.newInstance();
static {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
}
...
}
pattern-sinks:
- patterns:
- pattern: $FACTORY.newDocumentBuilder();
pattern-sanitizers:
- by-side-effect: true
pattern-either:
- patterns:
- pattern-either:
- pattern: |
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
- pattern: |
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
- pattern: |
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
- focus-metavariable: $FACTORY
- patterns:
- pattern-either:
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl",
true);
...
}
...
}
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
}
...
}
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities",false);
...
}
...
}
- pattern: $M($X)
- focus-metavariable: $X
fix: |
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
$FACTORY.newDocumentBuilder();
languages:
- java
- id: java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true
severity: ERROR
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://blog.sonarsource.com/secure-xml-processor
category: security
technology:
- java
- xml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true
shortlink: https://sg.run/JgPy
semgrep.dev:
rule:
r_id: 18246
rv_id: 1263059
rule_id: 9AUJ6r
version_id: qkTR7Lk
url: https://semgrep.dev/playground/r/qkTR7Lk/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true
origin: community
message: External entities are allowed for $DBFACTORY. This is vulnerable to XML
external entity attacks. Disable this by setting the feature "http://xml.org/sax/features/external-general-entities"
to false.
pattern: $DBFACTORY.setFeature("http://xml.org/sax/features/external-general-entities",
true);
fix: $DBFACTORY.setFeature("http://xml.org/sax/features/external-general-entities",
false);
languages:
- java
- id: java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true
severity: ERROR
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://blog.sonarsource.com/secure-xml-processor
category: security
technology:
- java
- xml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true
shortlink: https://sg.run/5Lv0
semgrep.dev:
rule:
r_id: 18247
rv_id: 1263060
rule_id: yyUNeo
version_id: l4TJRoL
url: https://semgrep.dev/playground/r/l4TJRoL/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true
origin: community
message: External entities are allowed for $DBFACTORY. This is vulnerable to XML
external entity attacks. Disable this by setting the feature "http://xml.org/sax/features/external-parameter-entities"
to false.
pattern: $DBFACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities",
true);
fix: $DBFACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities",
false);
languages:
- java
- id: javascript.aws-lambda.security.detect-child-process.detect-child-process
message: Allowing spawning arbitrary programs or running shell processes with arbitrary
arguments may end up in a command injection vulnerability. Try to avoid non-literal
values for the command string. If it is not possible, then do not let running
arbitrary commands, use a white list for inputs.
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- javascript
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/javascript.aws-lambda.security.detect-child-process.detect-child-process
shortlink: https://sg.run/Ggoq
semgrep.dev:
rule:
r_id: 18248
rv_id: 1263105
rule_id: r6UDNQ
version_id: YDTZe4o
url: https://semgrep.dev/playground/r/YDTZe4o/javascript.aws-lambda.security.detect-child-process.detect-child-process
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern: $EVENT
- pattern-either:
- pattern-inside: |
exports.handler = function ($EVENT, ...) {
...
}
- pattern-inside: |
function $FUNC ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern-inside: |
$FUNC = function ($EVENT, ...) {...}
...
exports.handler = $FUNC
pattern-sinks:
- patterns:
- focus-metavariable: $CMD
- pattern-either:
- pattern: exec($CMD,...)
- pattern: execSync($CMD,...)
- pattern: spawn($CMD,...)
- pattern: spawnSync($CMD,...)
- pattern: $CP.exec($CMD,...)
- pattern: $CP.execSync($CMD,...)
- pattern: $CP.spawn($CMD,...)
- pattern: $CP.spawnSync($CMD,...)
- pattern-either:
- pattern-inside: |
require('child_process')
...
- pattern-inside: |
import 'child_process'
...
- id: javascript.aws-lambda.security.knex-sqli.knex-sqli
message: 'Detected SQL statement that is tainted by `$EVENT` object. This could
lead to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `knex.raw(''SELECT $1 from
table'', [userinput])`'
metadata:
references:
- https://knexjs.org/#Builder-fromRaw
- https://knexjs.org/#Builder-whereRaw
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- knex
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/javascript.aws-lambda.security.knex-sqli.knex-sqli
shortlink: https://sg.run/RgWq
semgrep.dev:
rule:
r_id: 18249
rv_id: 1263106
rule_id: bwUBlj
version_id: JdTzxKg
url: https://semgrep.dev/playground/r/JdTzxKg/javascript.aws-lambda.security.knex-sqli.knex-sqli
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
exports.handler = function ($EVENT, ...) {
...
}
- pattern-inside: |
function $FUNC ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern-inside: |
$FUNC = function ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern: $EVENT
pattern-sinks:
- patterns:
- focus-metavariable: $QUERY
- pattern-either:
- pattern: $KNEX.fromRaw($QUERY, ...)
- pattern: $KNEX.whereRaw($QUERY, ...)
- pattern: $KNEX.raw($QUERY, ...)
- pattern-either:
- pattern-inside: |
require('knex')
...
- pattern-inside: |
import 'knex'
...
- id: javascript.aws-lambda.security.mysql-sqli.mysql-sqli
message: 'Detected SQL statement that is tainted by `$EVENT` object. This could
lead to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `connection.query(''SELECT
$1 from table'', [userinput])`'
metadata:
references:
- https://www.npmjs.com/package/mysql2
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- mysql
- mysql2
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/javascript.aws-lambda.security.mysql-sqli.mysql-sqli
shortlink: https://sg.run/A502
semgrep.dev:
rule:
r_id: 18250
rv_id: 1263107
rule_id: NbUBJ2
version_id: 5PTo1En
url: https://semgrep.dev/playground/r/5PTo1En/javascript.aws-lambda.security.mysql-sqli.mysql-sqli
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
exports.handler = function ($EVENT, ...) {
...
}
- pattern-inside: |
function $FUNC ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern-inside: |
$FUNC = function ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern: $EVENT
pattern-sinks:
- patterns:
- focus-metavariable: $QUERY
- pattern-either:
- pattern: $POOL.query($QUERY, ...)
- pattern: $POOL.execute($QUERY, ...)
- pattern-either:
- pattern-inside: |
require('mysql')
...
- pattern-inside: |
require('mysql2')
...
- pattern-inside: |
require('mysql2/promise')
...
- pattern-inside: |
import 'mysql'
...
- pattern-inside: |
import 'mysql2'
...
- pattern-inside: |
import 'mysql2/promise'
...
- id: javascript.aws-lambda.security.pg-sqli.pg-sqli
message: 'Detected SQL statement that is tainted by `$EVENT` object. This could
lead to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `connection.query(''SELECT
$1 from table'', [userinput])`'
metadata:
references:
- https://node-postgres.com/features/queries
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- postgres
- pg
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/javascript.aws-lambda.security.pg-sqli.pg-sqli
shortlink: https://sg.run/BGKA
semgrep.dev:
rule:
r_id: 18251
rv_id: 1263108
rule_id: kxU25P
version_id: GxTkeJL
url: https://semgrep.dev/playground/r/GxTkeJL/javascript.aws-lambda.security.pg-sqli.pg-sqli
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
exports.handler = function ($EVENT, ...) {
...
}
- pattern-inside: |
function $FUNC ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern-inside: |
$FUNC = function ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern: $EVENT
pattern-sinks:
- patterns:
- focus-metavariable: $QUERY
- pattern-either:
- pattern: $DB.query($QUERY, ...)
- pattern-either:
- pattern-inside: |
require('pg')
...
- pattern-inside: |
import 'pg'
...
- id: javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli
message: 'Detected SQL statement that is tainted by `$EVENT` object. This could
lead to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `sequelize.query(''SELECT
* FROM projects WHERE status = ?'', { replacements: [''active''], type: QueryTypes.SELECT
});`'
metadata:
references:
- https://sequelize.org/master/manual/raw-queries.html
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- sequelize
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli
shortlink: https://sg.run/DAlP
semgrep.dev:
rule:
r_id: 18252
rv_id: 1263109
rule_id: wdUA5o
version_id: RGT0LrD
url: https://semgrep.dev/playground/r/RGT0LrD/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
exports.handler = function ($EVENT, ...) {
...
}
- pattern-inside: |
function $FUNC ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern-inside: |
$FUNC = function ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern: $EVENT
pattern-sinks:
- patterns:
- focus-metavariable: $QUERY
- pattern-either:
- pattern: $DB.query($QUERY, ...)
- pattern-either:
- pattern-inside: |
require('sequelize')
...
- pattern-inside: |
import 'sequelize'
...
- id: javascript.aws-lambda.security.tainted-html-response.tainted-html-response
message: Detected user input flowing into an HTML response. You may be accidentally
bypassing secure methods of rendering HTML by manually constructing HTML and this
could create a cross-site scripting vulnerability, which could let attackers steal
sensitive user data.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-response.tainted-html-response
shortlink: https://sg.run/0Gvj
semgrep.dev:
rule:
r_id: 18254
rv_id: 1263111
rule_id: OrUJBY
version_id: BjTkZ8D
url: https://semgrep.dev/playground/r/BjTkZ8D/javascript.aws-lambda.security.tainted-html-response.tainted-html-response
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
exports.handler = function ($EVENT, ...) {
...
}
- pattern-inside: |
function $FUNC ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern-inside: |
$FUNC = function ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern: $EVENT
pattern-sinks:
- patterns:
- focus-metavariable: $BODY
- pattern-inside: |
{..., headers: {..., 'Content-Type': 'text/html', ...}, body: $BODY, ... }
- id: javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection
message: The `vm` module enables compiling and running code within V8 Virtual Machine
contexts. The `vm` module is not a security mechanism. Do not use it to run untrusted
code. If code passed to `vm` functions is controlled by user input it could result
in command injection. Do not let user input in `vm` functions.
metadata:
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
category: security
technology:
- javascript
- aws-lambda
cwe2022-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection
shortlink: https://sg.run/q9w7
semgrep.dev:
rule:
r_id: 18256
rv_id: 1263114
rule_id: v8UOdZ
version_id: 0bTKz9J
url: https://semgrep.dev/playground/r/0bTKz9J/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern: $EVENT
- pattern-either:
- pattern-inside: |
exports.handler = function ($EVENT, ...) {
...
}
- pattern-inside: |
function $FUNC ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern-inside: |
$FUNC = function ($EVENT, ...) {...}
...
exports.handler = $FUNC
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
require('vm');
...
- pattern-inside: |
import 'vm'
...
- pattern-either:
- pattern: $VM.runInContext($X,...)
- pattern: $VM.runInNewContext($X,...)
- pattern: $VM.runInThisContext($X,...)
- pattern: $VM.compileFunction($X,...)
- pattern: new $VM.Script($X,...)
- pattern: new $VM.SourceTextModule($X,...)
- pattern: runInContext($X,...)
- pattern: runInNewContext($X,...)
- pattern: runInThisContext($X,...)
- pattern: compileFunction($X,...)
- pattern: new Script($X,...)
- pattern: new SourceTextModule($X,...)
- id: javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli
message: 'Detected SQL statement that is tainted by `$REQ` object. This could lead
to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, it is recommended to use parameterized queries
or prepared statements. An example of parameterized queries like so: `knex.raw(''SELECT
$1 from table'', [userinput])` can help prevent SQLi.'
metadata:
confidence: MEDIUM
references:
- https://knexjs.org/#Builder-fromRaw
- https://knexjs.org/#Builder-whereRaw
- https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- express
- nodejs
- knex
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli
shortlink: https://sg.run/l9eE
semgrep.dev:
rule:
r_id: 18257
rv_id: 1263205
rule_id: d8UKLD
version_id: l4TJRey
url: https://semgrep.dev/playground/r/l4TJRey/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- pattern: $REQ.files.$ANYTHING.data.toString('utf8')
- pattern: $REQ.files.$ANYTHING['data'].toString('utf8')
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
- pattern: files.$ANYTHING.data.toString('utf8')
- pattern: files.$ANYTHING['data'].toString('utf8')
pattern-sinks:
- patterns:
- focus-metavariable: $QUERY
- pattern-either:
- pattern-inside: $KNEX.fromRaw($QUERY, ...)
- pattern-inside: $KNEX.whereRaw($QUERY, ...)
- pattern-inside: $KNEX.raw($QUERY, ...)
- pattern-either:
- pattern-inside: |
require('knex')
...
- pattern-inside: |
import 'knex'
...
pattern-sanitizers:
- patterns:
- pattern: parseInt(...)
- id: php.lang.security.deserialization.extract-user-data
mode: taint
pattern-sources:
- pattern-either:
- pattern: $_GET[...]
- pattern: $_FILES[...]
- pattern: $_POST[...]
pattern-sinks:
- pattern: extract(...)
pattern-sanitizers:
- pattern: extract($VAR, EXTR_SKIP,...)
message: Do not call 'extract()' on user-controllable data. If you must, then you
must also provide the EXTR_SKIP flag to prevent overwriting existing variables.
languages:
- php
metadata:
category: security
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
technology:
- php
references:
- https://www.php.net/manual/en/function.extract.php#refsect1-function.extract-notes
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/php.lang.security.deserialization.extract-user-data
shortlink: https://sg.run/6bv1
semgrep.dev:
rule:
r_id: 18259
rv_id: 1263278
rule_id: nJUykq
version_id: w8TRovw
url: https://semgrep.dev/playground/r/w8TRovw/php.lang.security.deserialization.extract-user-data
origin: community
severity: ERROR
- id: python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec
mode: taint
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
pattern-sinks:
- patterns:
- focus-metavariable: $CMD
- pattern-either:
- pattern: asyncio.create_subprocess_exec($PROG, $CMD, ...)
- pattern: asyncio.create_subprocess_exec($PROG, [$CMD, ...], ...)
- pattern: asyncio.subprocess.create_subprocess_exec($PROG, $CMD, ...)
- pattern: asyncio.subprocess.create_subprocess_exec($PROG, [$CMD, ...], ...)
- pattern: asyncio.create_subprocess_exec($PROG, "=~/(sh|bash|ksh|csh|tcsh|zsh)/",
"-c", $CMD, ...)
- pattern: asyncio.create_subprocess_exec($PROG, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/",
"-c", $CMD, ...], ...)
- pattern: asyncio.subprocess.create_subprocess_exec($PROG, "=~/(sh|bash|ksh|csh|tcsh|zsh)/",
"-c", $CMD, ...)
- pattern: asyncio.subprocess.create_subprocess_exec($PROG, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/",
"-c", $CMD, ...], ...)
message: Detected 'create_subprocess_exec' function with argument tainted by `event`
object. If this data can be controlled by a malicious actor, it may be an instance
of command injection. Audit the use of this call to ensure it is not controllable
by an external resource. You may consider using 'shlex.escape()'.
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.8 OS Command Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
references:
- https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec
- https://docs.python.org/3/library/shlex.html
category: security
technology:
- python
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec
shortlink: https://sg.run/oyv0
semgrep.dev:
rule:
r_id: 18260
rv_id: 1263331
rule_id: EwUrX8
version_id: rxTAKgo
url: https://semgrep.dev/playground/r/rxTAKgo/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec
origin: community
languages:
- python
severity: ERROR
- id: python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec
mode: taint
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
pattern-sinks:
- patterns:
- focus-metavariable: $CMD
- pattern-either:
- pattern: $LOOP.subprocess_exec($PROTOCOL, $CMD, ...)
- pattern: $LOOP.subprocess_exec($PROTOCOL, [$CMD, ...], ...)
- pattern: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/",
"-c", $CMD, ...)
- pattern: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/",
"-c", $CMD, ...], ...)
message: Detected subprocess function '$LOOP.subprocess_exec' with argument tainted
by `event` object. If this data can be controlled by a malicious actor, it may
be an instance of command injection. Audit the use of this call to ensure it is
not controllable by an external resource. You may consider using 'shlex.escape()'.
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.8 OS Command Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
references:
- https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec
- https://docs.python.org/3/library/shlex.html
category: security
technology:
- python
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec
shortlink: https://sg.run/z14d
semgrep.dev:
rule:
r_id: 18261
rv_id: 1263332
rule_id: 7KUxXg
version_id: bZT53Ww
url: https://semgrep.dev/playground/r/bZT53Ww/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec
origin: community
languages:
- python
severity: ERROR
- id: python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell
mode: taint
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
pattern-sinks:
- patterns:
- focus-metavariable: $CMD
- pattern-either:
- pattern: $LOOP.subprocess_shell($PROTOCOL, $CMD)
- pattern: asyncio.subprocess.create_subprocess_shell($CMD, ...)
- pattern: asyncio.create_subprocess_shell($CMD, ...)
message: Detected asyncio subprocess function with argument tainted by `event` object.
If this data can be controlled by a malicious actor, it may be an instance of
command injection. Audit the use of this call to ensure it is not controllable
by an external resource. You may consider using 'shlex.escape()'.
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.8 OS Command Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
references:
- https://docs.python.org/3/library/asyncio-subprocess.html
- https://docs.python.org/3/library/shlex.html
category: security
technology:
- python
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell
shortlink: https://sg.run/p9vZ
semgrep.dev:
rule:
r_id: 18262
rv_id: 1263333
rule_id: L1UEl7
version_id: NdTzyWA
url: https://semgrep.dev/playground/r/NdTzyWA/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell
origin: community
languages:
- python
severity: ERROR
- id: python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process
mode: taint
message: Detected `os` function with argument tainted by `event` object. This is
dangerous if external data can reach this function call because it allows a malicious
actor to execute commands. Ensure no external data reaches here.
metadata:
source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.8 OS Command Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
category: security
technology:
- python
- aws-lambda
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process
shortlink: https://sg.run/2AjL
semgrep.dev:
rule:
r_id: 18263
rv_id: 1263334
rule_id: 8GUGBq
version_id: kbTzGv8
url: https://semgrep.dev/playground/r/kbTzGv8/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process
origin: community
languages:
- python
severity: ERROR
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
pattern-sinks:
- patterns:
- focus-metavariable: $CMD
- pattern-either:
- patterns:
- pattern: os.$METHOD($MODE, $CMD, ...)
- metavariable-regex:
metavariable: $METHOD
regex: (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile)
- patterns:
- pattern-inside: os.$METHOD($MODE, $BASH, ["-c", $CMD,...],...)
- metavariable-regex:
metavariable: $METHOD
regex: (spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp)
- metavariable-regex:
metavariable: $BASH
regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
- patterns:
- pattern-inside: os.$METHOD($MODE, $BASH, "-c", $CMD,...)
- metavariable-regex:
metavariable: $METHOD
regex: (spawnl|spawnle|spawnlp|spawnlpe)
- metavariable-regex:
metavariable: $BASH
regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
- id: python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use
mode: taint
message: Detected subprocess function with argument tainted by an `event` object. If
this data can be controlled by a malicious actor, it may be an instance of command
injection. The default option for `shell` is False, and this is secure by default.
Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False`
means you have to split the command string into an array of strings for the command
and its arguments. You may consider using 'shlex.split()' for this purpose.
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.8 OS Command Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
references:
- https://docs.python.org/3/library/subprocess.html
- https://docs.python.org/3/library/shlex.html
category: security
technology:
- python
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use
shortlink: https://sg.run/XZ7B
semgrep.dev:
rule:
r_id: 18264
rv_id: 1263335
rule_id: gxUyn1
version_id: w8TRogj
url: https://semgrep.dev/playground/r/w8TRogj/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use
origin: community
languages:
- python
severity: ERROR
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
pattern-sinks:
- patterns:
- pattern: subprocess.$FUNC(..., shell=True, ...)
pattern-sanitizers:
- pattern: shlex.split(...)
- pattern: pipes.quote(...)
- pattern: shlex.quote(...)
- id: python.aws-lambda.security.dangerous-system-call.dangerous-system-call
mode: taint
message: Detected `os` function with argument tainted by `event` object. This is
dangerous if external data can reach this function call because it allows a malicious
actor to execute commands. Use the 'subprocess' module instead, which is easier
to use without accidentally exposing a command injection vulnerability.
metadata:
source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.2.4 Dyanmic Code Execution Features
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements
version: '4'
category: security
technology:
- python
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.aws-lambda.security.dangerous-system-call.dangerous-system-call
shortlink: https://sg.run/jDvN
semgrep.dev:
rule:
r_id: 18265
rv_id: 1263336
rule_id: QrUkg6
version_id: xyTjzbG
url: https://semgrep.dev/playground/r/xyTjzbG/python.aws-lambda.security.dangerous-system-call.dangerous-system-call
origin: community
languages:
- python
severity: ERROR
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
pattern-sinks:
- patterns:
- focus-metavariable: $CMD
- pattern-either:
- pattern: os.system($CMD,...)
- pattern: os.popen($CMD,...)
- pattern: os.popen2($CMD,...)
- pattern: os.popen3($CMD,...)
- pattern: os.popen4($CMD,...)
- id: python.aws-lambda.security.mysql-sqli.mysql-sqli
languages:
- python
message: 'Detected SQL statement that is tainted by `event` object. This could lead
to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `cursor.execute(''SELECT
* FROM projects WHERE status = %s'', (''active''))`'
mode: taint
metadata:
references:
- https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html
- https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-executemany.html
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- mysql
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.aws-lambda.security.mysql-sqli.mysql-sqli
shortlink: https://sg.run/1RjG
semgrep.dev:
rule:
r_id: 18266
rv_id: 1263337
rule_id: 3qU3eE
version_id: O9TpxLJ
url: https://semgrep.dev/playground/r/O9TpxLJ/python.aws-lambda.security.mysql-sqli.mysql-sqli
origin: community
pattern-sinks:
- patterns:
- focus-metavariable: $QUERY
- pattern-either:
- pattern: $CURSOR.execute($QUERY,...)
- pattern: $CURSOR.executemany($QUERY,...)
- pattern-either:
- pattern-inside: |
import mysql
...
- pattern-inside: |
import mysql.cursors
...
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
severity: WARNING
- id: python.aws-lambda.security.psycopg-sqli.psycopg-sqli
languages:
- python
message: 'Detected SQL statement that is tainted by `event` object. This could lead
to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `cursor.execute(''SELECT
* FROM projects WHERE status = %s'', ''active'')`'
mode: taint
metadata:
references:
- https://www.psycopg.org/docs/cursor.html#cursor.execute
- https://www.psycopg.org/docs/cursor.html#cursor.executemany
- https://www.psycopg.org/docs/cursor.html#cursor.mogrify
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- psycopg
- psycopg2
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.aws-lambda.security.psycopg-sqli.psycopg-sqli
shortlink: https://sg.run/9L8r
semgrep.dev:
rule:
r_id: 18267
rv_id: 1263338
rule_id: 4bUQG1
version_id: e1TyjPZ
url: https://semgrep.dev/playground/r/e1TyjPZ/python.aws-lambda.security.psycopg-sqli.psycopg-sqli
origin: community
pattern-sinks:
- patterns:
- focus-metavariable: $QUERY
- pattern-either:
- pattern: $CURSOR.execute($QUERY,...)
- pattern: $CURSOR.executemany($QUERY,...)
- pattern: $CURSOR.mogrify($QUERY,...)
- pattern-inside: |
import psycopg2
...
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
severity: WARNING
- id: python.aws-lambda.security.pymssql-sqli.pymssql-sqli
languages:
- python
message: 'Detected SQL statement that is tainted by `event` object. This could lead
to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `cursor.execute(''SELECT
* FROM projects WHERE status = %s'', ''active'')`'
mode: taint
metadata:
references:
- https://pypi.org/project/pymssql/
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- pymssql
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.aws-lambda.security.pymssql-sqli.pymssql-sqli
shortlink: https://sg.run/yXvP
semgrep.dev:
rule:
r_id: 18268
rv_id: 1263339
rule_id: PeUxO0
version_id: vdT06bG
url: https://semgrep.dev/playground/r/vdT06bG/python.aws-lambda.security.pymssql-sqli.pymssql-sqli
origin: community
pattern-sinks:
- patterns:
- focus-metavariable: $QUERY
- pattern: $CURSOR.execute($QUERY,...)
- pattern-inside: |
import pymssql
...
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
severity: WARNING
- id: python.aws-lambda.security.pymysql-sqli.pymysql-sqli
languages:
- python
message: 'Detected SQL statement that is tainted by `event` object. This could lead
to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `cursor.execute(''SELECT
* FROM projects WHERE status = %s'', (''active''))`'
mode: taint
metadata:
references:
- https://pypi.org/project/PyMySQL/#id4
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- pymysql
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.aws-lambda.security.pymysql-sqli.pymysql-sqli
shortlink: https://sg.run/reve
semgrep.dev:
rule:
r_id: 18269
rv_id: 1263340
rule_id: JDUlel
version_id: d6TyxNA
url: https://semgrep.dev/playground/r/d6TyxNA/python.aws-lambda.security.pymysql-sqli.pymysql-sqli
origin: community
pattern-sinks:
- patterns:
- focus-metavariable: $QUERY
- pattern: $CURSOR.execute($QUERY,...)
- pattern-either:
- pattern-inside: |
import pymysql
...
- pattern-inside: |
import pymysql.cursors
...
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
severity: WARNING
- id: python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli
languages:
- python
message: 'Detected SQL statement that is tainted by `event` object. This could lead
to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `cursor.execute(''SELECT
* FROM projects WHERE status = ?'', ''active'')`'
mode: taint
metadata:
references:
- https://docs.sqlalchemy.org/en/14/core/connections.html#sqlalchemy.engine.Connection.execute
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- sqlalchemy
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli
shortlink: https://sg.run/b48W
semgrep.dev:
rule:
r_id: 18270
rv_id: 1263341
rule_id: 5rUy3N
version_id: ZRTKARp
url: https://semgrep.dev/playground/r/ZRTKARp/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli
origin: community
pattern-sinks:
- patterns:
- focus-metavariable: $QUERY
- pattern: $CURSOR.execute($QUERY,...)
- pattern-inside: |
import sqlalchemy
...
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
severity: WARNING
- id: python.aws-lambda.security.tainted-html-response.tainted-html-response
mode: taint
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
pattern-sinks:
- patterns:
- pattern: $BODY
- pattern-inside: |
{..., "headers": {..., "Content-Type": "text/html", ...}, "body": $BODY, ... }
message: Detected user input flowing into an HTML response. You may be accidentally
bypassing secure methods of rendering HTML by manually constructing HTML and this
could create a cross-site scripting vulnerability, which could let attackers steal
sensitive user data.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- aws-lambda
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.aws-lambda.security.tainted-html-response.tainted-html-response
shortlink: https://sg.run/k9vP
semgrep.dev:
rule:
r_id: 18272
rv_id: 1263343
rule_id: ReUKrk
version_id: ExTEx5o
url: https://semgrep.dev/playground/r/ExTEx5o/python.aws-lambda.security.tainted-html-response.tainted-html-response
origin: community
languages:
- python
severity: WARNING
- id: python.aws-lambda.security.tainted-sql-string.tainted-sql-string
languages:
- python
message: Detected user input used to manually construct a SQL string. This is usually
bad practice because manual construction could accidentally result in a SQL injection.
An attacker could use a SQL injection to steal or modify contents of the database.
Instead, use a parameterized query which is available by default in most database
engines. Alternatively, consider using an object-relational mapper (ORM) such
as Sequelize which will protect your queries.
metadata:
references:
- https://owasp.org/www-community/attacks/SQL_Injection
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string
shortlink: https://sg.run/wXvA
semgrep.dev:
rule:
r_id: 18273
rv_id: 1263346
rule_id: AbU3LX
version_id: 8KT5ron
url: https://semgrep.dev/playground/r/8KT5ron/python.aws-lambda.security.tainted-sql-string.tainted-sql-string
origin: community
mode: taint
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
"$SQLSTR" + ...
- pattern: |
"$SQLSTR" % ...
- pattern: |
"$SQLSTR".format(...)
- pattern: |
f"$SQLSTR{...}..."
- metavariable-regex:
metavariable: $SQLSTR
regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*=
- pattern-not-inside: |
print(...)
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
severity: ERROR
- id: ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli
languages:
- ruby
message: 'Detected SQL statement that is tainted by `event` object. This could lead
to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `Example.find_by_sql ["SELECT
title FROM posts WHERE author = ? AND created > ?", author_id, start_date]`'
mode: taint
metadata:
references:
- https://guides.rubyonrails.org/active_record_querying.html#finding-by-sql
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- active-record
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli
shortlink: https://sg.run/vXvY
semgrep.dev:
rule:
r_id: 18277
rv_id: 1263581
rule_id: 0oUw9g
version_id: w8TRor7
url: https://semgrep.dev/playground/r/w8TRor7/ruby.aws-lambda.security.activerecord-sqli.activerecord-sqli
origin: community
pattern-sinks:
- patterns:
- pattern: $QUERY
- pattern-either:
- pattern: ActiveRecord::Base.connection.execute($QUERY,...)
- pattern: $MODEL.find_by_sql($QUERY,...)
- pattern: $MODEL.select_all($QUERY,...)
- pattern-inside: |
require 'active_record'
...
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context)
...
end
severity: WARNING
- id: ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli
languages:
- ruby
message: 'Detected SQL statement that is tainted by `event` object. This could lead
to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use sanitize statements like so: `escaped = client.escape(user_input)`'
mode: taint
metadata:
references:
- https://github.com/brianmario/mysql2
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- mysql2
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli
shortlink: https://sg.run/dJLE
semgrep.dev:
rule:
r_id: 18278
rv_id: 1263582
rule_id: KxUrQ3
version_id: xyTjzOe
url: https://semgrep.dev/playground/r/xyTjzOe/ruby.aws-lambda.security.mysql2-sqli.mysql2-sqli
origin: community
pattern-sinks:
- patterns:
- pattern: $QUERY
- pattern-either:
- pattern: $CLIENT.query($QUERY,...)
- pattern: $CLIENT.prepare($QUERY,...)
- pattern-inside: |
require 'mysql2'
...
pattern-sanitizers:
- pattern: $CLIENT.escape(...)
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context)
...
end
severity: WARNING
- id: ruby.aws-lambda.security.pg-sqli.pg-sqli
languages:
- ruby
message: 'Detected SQL statement that is tainted by `event` object. This could lead
to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `conn.exec_params(''SELECT
$1 AS a, $2 AS b, $3 AS c'', [1, 2, nil])`'
mode: taint
metadata:
references:
- https://www.rubydoc.info/gems/pg/PG/Connection
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- postgres
- pg
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/ruby.aws-lambda.security.pg-sqli.pg-sqli
shortlink: https://sg.run/ZKww
semgrep.dev:
rule:
r_id: 18279
rv_id: 1263583
rule_id: qNUQee
version_id: O9Tpxz7
url: https://semgrep.dev/playground/r/O9Tpxz7/ruby.aws-lambda.security.pg-sqli.pg-sqli
origin: community
pattern-sinks:
- patterns:
- pattern: $QUERY
- pattern-either:
- pattern: $CONN.exec($QUERY,...)
- pattern: $CONN.exec_params($QUERY,...)
- pattern: $CONN.exec_prepared($QUERY,...)
- pattern: $CONN.async_exec($QUERY,...)
- pattern: $CONN.async_exec_params($QUERY,...)
- pattern: $CONN.async_exec_prepared($QUERY,...)
- pattern-inside: |
require 'pg'
...
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context)
...
end
severity: WARNING
- id: ruby.aws-lambda.security.sequel-sqli.sequel-sqli
languages:
- ruby
message: 'Detected SQL statement that is tainted by `event` object. This could lead
to SQL injection if the variable is user-controlled and not properly sanitized.
In order to prevent SQL injection, use parameterized queries or prepared statements
instead. You can use parameterized statements like so: `DB[''select * from items
where name = ?'', name]`'
mode: taint
metadata:
references:
- https://github.com/jeremyevans/sequel#label-Arbitrary+SQL+queries
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
- sequel
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/ruby.aws-lambda.security.sequel-sqli.sequel-sqli
shortlink: https://sg.run/n9vY
semgrep.dev:
rule:
r_id: 18280
rv_id: 1263584
rule_id: lBUy2N
version_id: e1Tyj5j
url: https://semgrep.dev/playground/r/e1Tyj5j/ruby.aws-lambda.security.sequel-sqli.sequel-sqli
origin: community
pattern-sinks:
- patterns:
- pattern: $QUERY
- pattern-either:
- pattern: DB[$QUERY,...]
- pattern: DB.run($QUERY,...)
- pattern-inside: |
require 'sequel'
...
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context)
...
end
severity: WARNING
- id: ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string
languages:
- ruby
severity: ERROR
message: Detected user input used to manually construct a SQL string. This is usually
bad practice because manual construction could accidentally result in a SQL injection.
An attacker could use a SQL injection to steal or modify contents of the database.
Instead, use a parameterized query which is available by default in most database
engines. Alternatively, consider using an object-relational mapper (ORM) such
as Sequelize which will protect your queries.
metadata:
references:
- https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet
category: security
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
technology:
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string
shortlink: https://sg.run/EB7N
semgrep.dev:
rule:
r_id: 18281
rv_id: 1263586
rule_id: PeUxOE
version_id: d6Tyx1Z
url: https://semgrep.dev/playground/r/d6Tyx1Z/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context)
...
end
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: |
"...#{...}..."
- pattern-regex: (?i)(select|delete|insert|create|update|alter|drop)\b|\w+\s*!?[<>=].*
- patterns:
- pattern-either:
- pattern: Kernel::sprintf("$SQLSTR", ...)
- pattern: |
"$SQLSTR" + $EXPR
- pattern: |
"$SQLSTR" % $EXPR
- metavariable-regex:
metavariable: $SQLSTR
regex: (?i)(select|delete|insert|create|update|alter|drop)\b|\w+\s*!?[<>=].*
- pattern-not-inside: |
puts(...)
- id: go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check
patterns:
- pattern-inside: |
import ("github.com/gorilla/websocket")
...
- patterns:
- pattern-not-inside: |
$UPGRADER = websocket.Upgrader{..., CheckOrigin: $FN ,...}
...
- pattern-not-inside: |
$UPGRADER.CheckOrigin = $FN2
...
- pattern: |
$UPGRADER.Upgrade(...)
message: 'The Origin header in the HTTP WebSocket handshake is used to guarantee
that the connection accepted by the WebSocket is from a trusted origin domain.
Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per "gorilla/websocket"
documentation: "A CheckOrigin function should carefully validate the request origin
to prevent cross-site request forgery."'
languages:
- go
severity: WARNING
metadata:
category: security
cwe:
- 'CWE-352: Cross-Site Request Forgery (CSRF)'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://pkg.go.dev/github.com/gorilla/websocket#Upgrader
technology:
- gorilla
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site Request Forgery (CSRF)
source: https://semgrep.dev/r/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check
shortlink: https://sg.run/xXpz
semgrep.dev:
rule:
r_id: 18430
rv_id: 1262914
rule_id: ReUKdz
version_id: qkTR7RP
url: https://semgrep.dev/playground/r/qkTR7RP/go.gorilla.security.audit.websocket-missing-origin-check.websocket-missing-origin-check
origin: community
- id: javascript.aws-lambda.security.tainted-html-string.tainted-html-string
message: Detected user input flowing into a manually constructed HTML string. You
may be accidentally bypassing secure methods of rendering HTML by manually constructing
HTML and this could create a cross-site scripting vulnerability, which could let
attackers steal sensitive user data. To be sure this is safe, check that the HTML
is rendered safely. Otherwise, use templates which will safely render HTML instead.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
references:
- https://owasp.org/Top10/A03_2021-Injection
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-string.tainted-html-string
shortlink: https://sg.run/Lgqr
semgrep.dev:
rule:
r_id: 18483
rv_id: 1263112
rule_id: PeUxwW
version_id: DkTRbvp
url: https://semgrep.dev/playground/r/DkTRbvp/javascript.aws-lambda.security.tainted-html-string.tainted-html-string
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
exports.handler = function ($EVENT, ...) {
...
}
- pattern-inside: |
function $FUNC ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern-inside: |
$FUNC = function ($EVENT, ...) {...}
...
exports.handler = $FUNC
- pattern: $EVENT
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: |
"$HTMLSTR" + $EXPR
- pattern: |
"$HTMLSTR".concat(...)
- pattern: $UTIL.format($HTMLSTR, ...)
- pattern: format($HTMLSTR, ...)
- metavariable-pattern:
metavariable: $HTMLSTR
language: generic
pattern: <$TAG ...
- patterns:
- pattern: |
`...${...}...`
- pattern-regex: |
.*<\w+.*
- pattern-not-inside: |
console.$LOG(...)
- id: python.aws-lambda.security.tainted-html-string.tainted-html-string
languages:
- python
severity: WARNING
message: Detected user input flowing into a manually constructed HTML string. You
may be accidentally bypassing secure methods of rendering HTML by manually constructing
HTML and this could create a cross-site scripting vulnerability, which could let
attackers steal sensitive user data. To be sure this is safe, check that the HTML
is rendered safely. Otherwise, use templates which will safely render HTML instead.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- aws-lambda
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.aws-lambda.security.tainted-html-string.tainted-html-string
shortlink: https://sg.run/8zNy
semgrep.dev:
rule:
r_id: 18484
rv_id: 1263344
rule_id: JDUlwy
version_id: 7ZTE36K
url: https://semgrep.dev/playground/r/7ZTE36K/python.aws-lambda.security.tainted-html-string.tainted-html-string
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: '"$HTMLSTR" % ...'
- pattern: '"$HTMLSTR".format(...)'
- pattern: '"$HTMLSTR" + ...'
- pattern: f"$HTMLSTR{...}..."
- patterns:
- pattern-inside: |
$HTML = "$HTMLSTR"
...
- pattern-either:
- pattern: $HTML % ...
- pattern: $HTML.format(...)
- pattern: $HTML + ...
- metavariable-pattern:
metavariable: $HTMLSTR
language: generic
pattern: <$TAG ...
- pattern-not-inside: |
print(...)
- id: scala.lang.security.audit.io-source-ssrf.io-source-ssrf
patterns:
- pattern-either:
- pattern: Source.fromURL($URL,...)
- pattern: Source.fromURI($URL,...)
- pattern-inside: |
import scala.io.$SOURCE
...
- pattern-either:
- pattern-inside: |
def $FUNC(..., $URL: $T, ...) = $A {
...
}
- pattern-inside: |
def $FUNC(..., $URL: $T, ...) = {
...
}
message: A parameter being passed directly into `fromURL` most likely lead to SSRF.
This could allow an attacker to send data to their own server, potentially exposing
sensitive data sent with this request. They could also probe internal servers
or other resources that the server running this code can access. Do not allow
arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode
the correct host.
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
- https://www.scala-lang.org/api/current/scala/io/Source$.html#fromURL(url:java.net.URL)(implicitcodec:scala.io.Codec):scala.io.BufferedSource
category: security
technology:
- scala
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/scala.lang.security.audit.io-source-ssrf.io-source-ssrf
shortlink: https://sg.run/Qbz4
semgrep.dev:
rule:
r_id: 18486
rv_id: 1263675
rule_id: GdUDOZ
version_id: 1QTypG9
url: https://semgrep.dev/playground/r/1QTypG9/scala.lang.security.audit.io-source-ssrf.io-source-ssrf
origin: community
languages:
- scala
severity: WARNING
- id: scala.play.security.tainted-html-response.tainted-html-response
mode: taint
metadata:
category: security
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
technology:
- scala
- play
confidence: MEDIUM
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/scala.play.security.tainted-html-response.tainted-html-response
shortlink: https://sg.run/BG96
semgrep.dev:
rule:
r_id: 18795
rv_id: 1263686
rule_id: 0oUwn2
version_id: vdT06yj
url: https://semgrep.dev/playground/r/vdT06yj/scala.play.security.tainted-html-response.tainted-html-response
origin: community
message: Detected a request with potential user-input going into an `Ok()` response.
This bypasses any view or template environments, including HTML escaping, which
may expose this application to cross-site scripting (XSS) vulnerabilities. Consider
using a view technology such as Twirl which automatically escapes HTML views.
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern: $REQ
- pattern-either:
- pattern-inside: "Action {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action(...) {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action.async {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action.async(...) {\n $REQ: Request[$T] => \n ...\n}\n"
- patterns:
- pattern: $PARAM
- pattern-either:
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action(...) {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action.async {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action.async(...) {
...
}
pattern-sanitizers:
- pattern-either:
- pattern: org.apache.commons.lang3.StringEscapeUtils.escapeHtml4(...)
- pattern: org.owasp.encoder.Encode.forHtml(...)
pattern-sinks:
- pattern-either:
- pattern: Html.apply(...)
- pattern: Ok(...).as(HTML)
- pattern: Ok(...).as(ContentTypes.HTML)
- patterns:
- pattern: Ok(...).as($CTYPE)
- metavariable-regex:
metavariable: $CTYPE
regex: '"[tT][eE][xX][tT]/[hH][tT][mM][lL]"'
- patterns:
- pattern: Ok(...).as($CTYPE)
- pattern-not: Ok(...).as("...")
- pattern-either:
- pattern-inside: |
def $FUNC(..., $URL: $T, ...) = $A {
...
}
- pattern-inside: |
def $FUNC(..., $URL: $T, ...) = {
...
}
severity: WARNING
languages:
- scala
- id: scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled
patterns:
- pattern-either:
- pattern: |
$DF = DocumentBuilderFactory.newInstance(...)
...
$DB = $DF.newDocumentBuilder(...)
- patterns:
- pattern: $DB = DocumentBuilderFactory.newInstance(...)
- pattern-not-inside: |
...
$X = $DB.newDocumentBuilder(...)
- pattern: $DB = DocumentBuilderFactory.newInstance(...).newDocumentBuilder(...)
- pattern-not-inside: |
...
$DB.setXIncludeAware(true)
...
$DB.setNamespaceAware(true)
...
$DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
...
$DB.setFeature("http://xml.org/sax/features/external-general-entities", false)
...
$DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
- pattern-not-inside: |
...
$DB.setXIncludeAware(true)
...
$DB.setNamespaceAware(true)
...
$DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
...
$DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
...
$DB.setFeature("http://xml.org/sax/features/external-general-entities", false)
- pattern-not-inside: |
...
$DB.setXIncludeAware(true)
...
$DB.setNamespaceAware(true)
...
$DB.setFeature("http://xml.org/sax/features/external-general-entities", false)
...
$DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
...
$DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
- pattern-not-inside: |
...
$DB.setXIncludeAware(true)
...
$DB.setNamespaceAware(true)
...
$DB.setFeature("http://xml.org/sax/features/external-general-entities", false)
...
$DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
...
$DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
message: Document Builder being instantiated without calling the `setFeature` functions
that are generally used for disabling entity processing. User controlled data
in XML Document builder can result in XML Internal Entity Processing vulnerabilities
like the disclosure of confidential data, denial of service, Server Side Request
Forgery (SSRF), port scanning. Make sure to disable entity processing functionality.
languages:
- scala
severity: WARNING
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
category: security
technology:
- scala
confidence: HIGH
references:
- https://owasp.org/Top10/A05_2021-Security_Misconfiguration
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled
shortlink: https://sg.run/gRQn
semgrep.dev:
rule:
r_id: 19041
rv_id: 1263673
rule_id: 0oUwzP
version_id: X0TzyRq
url: https://semgrep.dev/playground/r/X0TzyRq/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled
origin: community
- id: scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled
patterns:
- pattern-either:
- pattern: $SR = new SAXReader(...)
- pattern: |
$SF = SAXParserFactory.newInstance(...)
...
$SR = $SF.newSAXParser(...)
- patterns:
- pattern: $SR = SAXParserFactory.newInstance(...)
- pattern-not-inside: |
...
$X = $SR.newSAXParser(...)
- pattern: $SR = SAXParserFactory.newInstance(...).newSAXParser(...)
- pattern: $SR = new SAXBuilder(...)
- pattern-not-inside: |
...
$SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
...
$SR.setFeature("http://xml.org/sax/features/external-general-entities", false)
...
$SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
- pattern-not-inside: |
...
$SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
...
$SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
...
$SR.setFeature("http://xml.org/sax/features/external-general-entities", false)
- pattern-not-inside: |
...
$SR.setFeature("http://xml.org/sax/features/external-general-entities", false)
...
$SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
...
$SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
- pattern-not-inside: |
...
$SR.setFeature("http://xml.org/sax/features/external-general-entities", false)
...
$SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
...
$SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
message: XML processor being instantiated without calling the `setFeature` functions
that are generally used for disabling entity processing. User controlled data
in XML Parsers can result in XML Internal Entity Processing vulnerabilities like
the disclosure of confidential data, denial of service, Server Side Request Forgery
(SSRF), port scanning. Make sure to disable entity processing functionality.
languages:
- scala
severity: WARNING
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
category: security
technology:
- scala
confidence: HIGH
references:
- https://owasp.org/Top10/A05_2021-Security_Misconfiguration
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled
shortlink: https://sg.run/QbYP
semgrep.dev:
rule:
r_id: 19042
rv_id: 1263678
rule_id: KxUrkq
version_id: rxTAKWY
url: https://semgrep.dev/playground/r/rxTAKWY/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled
origin: community
- id: scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled
patterns:
- pattern-not-inside: |
...
$XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", false)
- pattern-either:
- pattern: $XMLFACTORY = XMLInputFactory.newFactory(...)
- pattern: $XMLFACTORY = XMLInputFactory.newInstance(...)
- pattern: $XMLFACTORY = new XMLInputFactory(...)
message: XMLInputFactory being instantiated without calling the setProperty functions
that are generally used for disabling entity processing. User controlled data
in XML Document builder can result in XML Internal Entity Processing vulnerabilities
like the disclosure of confidential data, denial of service, Server Side Request
Forgery (SSRF), port scanning. Make sure to disable entity processing functionality.
languages:
- scala
severity: WARNING
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
category: security
technology:
- scala
confidence: HIGH
references:
- https://owasp.org/Top10/A05_2021-Security_Misconfiguration
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled
shortlink: https://sg.run/3BEb
semgrep.dev:
rule:
r_id: 19043
rv_id: 1263683
rule_id: qNUQ7w
version_id: xyTjzkA
url: https://semgrep.dev/playground/r/xyTjzkA/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled
origin: community
- id: scala.play.security.conf-csrf-headers-bypass.conf-csrf-headers-bypass
patterns:
- pattern-either:
- pattern: X-Requested-With = "*"
- pattern: Csrf-Token = "..."
- pattern-inside: |
bypassHeaders {...
...
...}
- pattern-not-inside: |
{...
...
...blackList = [..."application/x-www-form-urlencoded"..."multipart/form-data"..."text/plain"...]
...
...}
- pattern-not-inside: |
{...
...
...blackList = [..."application/x-www-form-urlencoded"..."text/plain"..."multipart/form-data"...]
...
...}
- pattern-not-inside: |
{...
...
...blackList = [..."multipart/form-data"..."application/x-www-form-urlencoded"..."text/plain"...]
...
...}
- pattern-not-inside: |
{...
...
...blackList = [..."multipart/form-data"..."text/plain"..."application/x-www-form-urlencoded"...]
...
...}
- pattern-not-inside: |
{...
...
...blackList = [..."text/plain"..."application/x-www-form-urlencoded"..."multipart/form-data"...]
...
...}
- pattern-not-inside: |
{...
...
...blackList = [..."text/plain"..."multipart/form-data"..."application/x-www-form-urlencoded"...]
...
...}
message: "Possibly bypassable CSRF configuration found. CSRF is an attack that forces
an end user to execute unwanted actions on a web application in which they\u2019re
currently authenticated. Make sure that Content-Type black list is configured
and CORS filter is turned on."
languages:
- generic
severity: ERROR
paths:
include:
- '*.conf'
metadata:
references:
- https://www.playframework.com/documentation/2.8.x/Migration25#CSRF-changes
- https://owasp.org/www-community/attacks/csrf
cwe:
- 'CWE-352: Cross-Site Request Forgery (CSRF)'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
category: security
technology:
- scala
- play
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: LOW
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site Request Forgery (CSRF)
source: https://semgrep.dev/r/scala.play.security.conf-csrf-headers-bypass.conf-csrf-headers-bypass
shortlink: https://sg.run/4DEE
semgrep.dev:
rule:
r_id: 19044
rv_id: 1263684
rule_id: lBUyRR
version_id: O9Tpx53
url: https://semgrep.dev/playground/r/O9Tpx53/scala.play.security.conf-csrf-headers-bypass.conf-csrf-headers-bypass
origin: community
- id: ruby.rails.security.brakeman.check-dynamic-render-local-file-include.check-dynamic-render-local-file-include
mode: search
paths:
include:
- '*.erb'
patterns:
- pattern: |
params[...]
- pattern-inside: |
render :file => ...
message: Found request parameters in a call to `render` in a dynamic context. This
can allow end users to request arbitrary local files which may result in leaking
sensitive information persisted on disk.
languages:
- generic
severity: WARNING
metadata:
technology:
- ruby
- rails
category: security
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_render.rb
references:
- https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion
- https://github.com/presidentbeef/brakeman/blob/f74cb53ead47f0af821d98b5b41e16d63100c240/test/apps/rails2/app/views/home/test_render.html.erb
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Path Traversal
source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-dynamic-render-local-file-include.check-dynamic-render-local-file-include
shortlink: https://sg.run/3QWl
semgrep.dev:
rule:
r_id: 20043
rv_id: 1263651
rule_id: JDUokO
version_id: QkTGq9X
url: https://semgrep.dev/playground/r/QkTGq9X/ruby.rails.security.brakeman.check-dynamic-render-local-file-include.check-dynamic-render-local-file-include
origin: community
- id: ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include
mode: taint
pattern-sources:
- patterns:
- pattern: params[...]
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
render ..., file: $X
- pattern: |
render ..., inline: $X
- pattern: |
render ..., template: $X
- pattern: |
render ..., action: $X
- pattern: |
render $X, ...
- focus-metavariable: $X
pattern-sanitizers:
- patterns:
- pattern: $MAP[...]
- metavariable-pattern:
metavariable: $MAP
patterns:
- pattern-not-regex: params
- pattern: File.basename(...)
message: Found request parameters in a call to `render`. This can allow end users
to request arbitrary local files which may result in leaking sensitive information
persisted on disk. Where possible, avoid letting users specify template paths
for `render`. If you must allow user input, use an allow-list of known templates
or normalize the user-supplied value with `File.basename(...)`.
languages:
- ruby
severity: WARNING
metadata:
technology:
- ruby
- rails
category: security
cwe:
- 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
Traversal'')'
owasp:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_render.rb
references:
- https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion
- https://github.com/presidentbeef/brakeman/blob/f74cb53/test/apps/rails2/app/controllers/home_controller.rb#L48-L60
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
vulnerability_class:
- Path Traversal
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include
shortlink: https://sg.run/Jw8Z
semgrep.dev:
rule:
r_id: 20046
rv_id: 1409407
rule_id: ReU2pZ
version_id: K3TgANN
url: https://semgrep.dev/playground/r/K3TgANN/ruby.rails.security.brakeman.check-render-local-file-include.check-render-local-file-include
origin: community
- id: scala.lang.security.audit.tainted-sql-string.tainted-sql-string
languages:
- scala
severity: ERROR
mode: taint
message: User data flows into this manually-constructed SQL string. User data can
be safely inserted into SQL strings using prepared statements or an object-relational
mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL
injection, which could let an attacker steal or manipulate data from the database.
Instead, use prepared statements (`connection.PreparedStatement`) or a safe library.
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html
category: security
technology:
- scala
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/scala.lang.security.audit.tainted-sql-string.tainted-sql-string
shortlink: https://sg.run/ALD6
semgrep.dev:
rule:
r_id: 20050
rv_id: 1263682
rule_id: WAUY8B
version_id: w8TRoO6
url: https://semgrep.dev/playground/r/w8TRoO6/scala.lang.security.audit.tainted-sql-string.tainted-sql-string
origin: community
pattern-sources:
- patterns:
- pattern: $PARAM
- pattern-either:
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = $A {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = $A(...) {
...
}
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: |
"$SQLSTR" + ...
- pattern: |
"$SQLSTR".format(...)
- patterns:
- pattern-inside: |
$SB = new StringBuilder("$SQLSTR");
...
- pattern: $SB.append(...)
- patterns:
- pattern-inside: |
$VAR = "$SQLSTR"
...
- pattern: $VAR += ...
- metavariable-regex:
metavariable: $SQLSTR
regex: (?i)(select|delete|insert|create|update|alter|drop)\b
- patterns:
- pattern-either:
- pattern: s"..."
- pattern: f"..."
- pattern-regex: |
.*\b(?i)(select|delete|insert|create|update|alter|drop)\b.*
- pattern-not-inside: println(...)
- pattern-not-inside: throw new $EXCEPTION(...)
pattern-sanitizers:
- pattern-either:
- patterns:
- pattern-either:
- pattern: $LOGGER.$METHOD(...)
- pattern: $LOGGER(...)
- metavariable-regex:
metavariable: $LOGGER
regex: (i?)log.*
- patterns:
- pattern: $LOGGER.$METHOD(...)
- metavariable-regex:
metavariable: $METHOD
regex: (i?)(trace|info|warn|warning|warnToError|error|debug)
- id: scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request
languages:
- scala
severity: ERROR
mode: taint
message: User data flows into this manually-constructed SQL string. User data can
be safely inserted into SQL strings using prepared statements or an object-relational
mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL
injection, which could let an attacker steal or manipulate data from the database.
Instead, use prepared statements (`connection.PreparedStatement`) or a safe library.
metadata:
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html
category: security
technology:
- scala
- play
confidence: HIGH
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request
shortlink: https://sg.run/BeW9
semgrep.dev:
rule:
r_id: 20051
rv_id: 1263688
rule_id: 0oUpon
version_id: ZRTKAoG
url: https://semgrep.dev/playground/r/ZRTKAoG/scala.play.security.tainted-sql-from-http-request.tainted-sql-from-http-request
origin: community
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern: $REQ
- pattern-either:
- pattern-inside: "Action {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action(...) {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action.async {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action.async(...) {\n $REQ: Request[$T] => \n ...\n}\n"
- patterns:
- pattern: $PARAM
- pattern-either:
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action(...) {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action.async {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action.async(...) {
...
}
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: |
"$SQLSTR" + ...
- pattern: |
"$SQLSTR".format(...)
- patterns:
- pattern-inside: |
$SB = new StringBuilder("$SQLSTR");
...
- pattern: $SB.append(...)
- patterns:
- pattern-inside: |
$VAR = "$SQLSTR"
...
- pattern: $VAR += ...
- metavariable-regex:
metavariable: $SQLSTR
regex: (?i)(select|delete|insert|create|update|alter|drop)\b
- patterns:
- pattern: s"..."
- pattern-regex: |
.*\b(?i)(select|delete|insert|create|update|alter|drop)\b.*
- pattern-not-inside: println(...)
- id: yaml.kubernetes.security.secrets-in-config-file.secrets-in-config-file
patterns:
- pattern: |
$KEY: $VALUE
- pattern-inside: |
data: ...
- pattern-inside: |
kind: Secret
...
- metavariable-regex:
metavariable: $VALUE
regex: (?i)^[aA-zZ0-9+/]+={0,2}$
- metavariable-analysis:
analyzer: entropy
metavariable: $VALUE
message: 'Secrets ($VALUE) should not be stored in infrastructure as code files.
Use an alternative such as Bitnami Sealed Secrets or KSOPS to encrypt Kubernetes
Secrets. '
metadata:
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
category: security
technology:
- kubernetes
references:
- https://kubernetes.io/docs/concepts/configuration/secret/
- https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/0/CTR_Kubernetes_Hardening_Guidance_1.1_20220315.PDF
- https://docs.gitlab.com/ee/user/clusters/agent/gitops/secrets_management.html
- https://www.cncf.io/blog/2021/04/22/revealing-the-secrets-of-kubernetes-secrets/
- https://github.com/bitnami-labs/sealed-secrets
- https://www.cncf.io/blog/2022/01/25/secrets-management-essential-when-using-kubernetes/
- https://blog.oddbit.com/post/2021-03-09-getting-started-with-ksops/
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/yaml.kubernetes.security.secrets-in-config-file.secrets-in-config-file
shortlink: https://sg.run/KyL6
semgrep.dev:
rule:
r_id: 20055
rv_id: 1263942
rule_id: YGUYEb
version_id: xyTjz5B
url: https://semgrep.dev/playground/r/xyTjz5B/yaml.kubernetes.security.secrets-in-config-file.secrets-in-config-file
origin: community
languages:
- yaml
severity: WARNING
- id: ruby.rails.security.brakeman.check-sql.check-sql
mode: taint
pattern-sources:
- pattern-either:
- pattern: |
cookies[...]
- patterns:
- pattern: |
cookies. ... .$PROPERTY[...]
- metavariable-regex:
metavariable: $PROPERTY
regex: (?!signed|encrypted)
- pattern: |
params[...]
- pattern: |
request.env[...]
pattern-sanitizers:
- patterns:
- pattern-either:
- patterns:
- pattern: $X
- pattern-either:
- pattern-inside: |
:$KEY => $X
- pattern-inside: |
["...",$X,...]
- pattern: |
params[...].to_i
- pattern: |
params[...].to_f
- patterns:
- pattern: |
params[...] ? $A : $B
- metavariable-pattern:
metavariable: $A
patterns:
- pattern-not: |
params[...]
- metavariable-pattern:
metavariable: $B
patterns:
- pattern-not: |
params[...]
pattern-sinks:
- patterns:
- pattern: $X
- pattern-not-inside: |
$P.where("...",...)
- pattern-not-inside: |
$P.where(:$KEY => $VAL,...)
- pattern-either:
- pattern-inside: |
$P.$M(...)
- pattern-inside: |
$P.$M("...",...)
- pattern-inside: |
class $P < ActiveRecord::Base
...
end
- metavariable-regex:
metavariable: $M
regex: (where|find|first|last|select|minimum|maximum|calculate|sum|average)
message: Found potential SQL injection due to unsafe SQL query construction via
$X. Where possible, prefer parameterized queries.
languages:
- ruby
severity: ERROR
metadata:
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_sql.rb
category: security
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
technology:
- ruby
- rails
references:
- https://owasp.org/www-community/attacks/SQL_Injection
- https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails3.1/app/models/product.rb
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-sql.check-sql
shortlink: https://sg.run/vpgb
semgrep.dev:
rule:
r_id: 20533
rv_id: 1263661
rule_id: OrUv2z
version_id: DkTRbE4
url: https://semgrep.dev/playground/r/DkTRbE4/ruby.rails.security.brakeman.check-sql.check-sql
origin: community
- id: ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods
mode: taint
pattern-sources:
- pattern-either:
- pattern: |
cookies[...]
- patterns:
- pattern: |
cookies. ... .$PROPERTY[...]
- metavariable-regex:
metavariable: $PROPERTY
regex: (?!signed|encrypted)
- pattern: |
params[...]
- pattern: |
request.env[...]
pattern-sinks:
- patterns:
- pattern: $X
- pattern-either:
- pattern-inside: |
$X. ... .to_proc
- patterns:
- pattern-inside: |
$Y.method($Z)
- focus-metavariable: $Z
- patterns:
- pattern-inside: |
$Y.tap($Z)
- focus-metavariable: $Z
- patterns:
- pattern-inside: |
$Y.tap{ |$ANY| $Z }
- focus-metavariable: $Z
message: Found user-controllable input to a reflection method. This may allow a
user to alter program behavior and potentially execute arbitrary instructions
in the context of the process. Do not provide arbitrary user input to `tap`, `method`,
or `to_proc`
languages:
- ruby
severity: ERROR
metadata:
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_unsafe_reflection_methods.rb
category: security
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
technology:
- ruby
- rails
references:
- https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails6/app/controllers/groups_controller.rb
cwe2022-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods
shortlink: https://sg.run/dPYd
semgrep.dev:
rule:
r_id: 20534
rv_id: 1263662
rule_id: eqUZ2Q
version_id: WrTqKLA
url: https://semgrep.dev/playground/r/WrTqKLA/ruby.rails.security.brakeman.check-unsafe-reflection-methods.check-unsafe-reflection-methods
origin: community
- id: ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase
message: Found the use of an hardcoded passphrase for RSA. The passphrase can be
easily discovered, and therefore should not be stored in source-code. It is recommended
to remove the passphrase from source-code, and use system environment variables
or a restricted configuration file.
languages:
- ruby
severity: WARNING
metadata:
technology:
- ruby
- secrets
category: security
references:
- https://cwe.mitre.org/data/definitions/522.html
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase
shortlink: https://sg.run/xPEe
semgrep.dev:
rule:
r_id: 20730
rv_id: 1263607
rule_id: bwULyN
version_id: K3TKkEo
url: https://semgrep.dev/playground/r/K3TKkEo/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase
origin: community
patterns:
- pattern-either:
- pattern: OpenSSL::PKey::RSA.new(..., '...')
- pattern: OpenSSL::PKey::RSA.new(...).to_pem(..., '...')
- pattern: OpenSSL::PKey::RSA.new(...).export(..., '...')
- patterns:
- pattern-inside: |
$OPENSSL = OpenSSL::PKey::RSA.new(...)
...
- pattern-either:
- pattern: |
$OPENSSL.export(...,'...')
- pattern: |
$OPENSSL.to_pem(...,'...')
- patterns:
- pattern-either:
- patterns:
- pattern-inside: |
$ASSIGN = '...'
...
- pattern: OpenSSL::PKey::RSA.new(..., $ASSIGN)
- patterns:
- pattern-inside: |
def $METHOD1(...)
...
$ASSIGN = '...'
...
end
...
def $METHOD2(...)
...
end
- pattern: OpenSSL::PKey::RSA.new(..., $ASSIGN)
- patterns:
- pattern-inside: |
$ASSIGN = '...'
...
def $METHOD(...)
$OPENSSL = OpenSSL::PKey::RSA.new(...)
...
end
...
- pattern-either:
- pattern: $OPENSSL.export(...,$ASSIGN)
- pattern: $OPENSSL.to_pem(...,$ASSIGN)
- patterns:
- pattern-inside: |
def $METHOD1(...)
...
$OPENSSL = OpenSSL::PKey::RSA.new(...)
...
$ASSIGN = '...'
...
end
...
- pattern-either:
- pattern: $OPENSSL.export(...,$ASSIGN)
- pattern: $OPENSSL.to_pem(...,$ASSIGN)
- patterns:
- pattern-inside: |
def $METHOD1(...)
...
$ASSIGN = '...'
...
end
...
def $METHOD2(...)
...
$OPENSSL = OpenSSL::PKey::RSA.new(...)
...
end
...
- pattern-either:
- pattern: $OPENSSL.export(...,$ASSIGN)
- pattern: $OPENSSL.to_pem(...,$ASSIGN)
- id: ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection
mode: taint
pattern-sources:
- pattern-either:
- pattern: |
cookies[...]
- patterns:
- pattern: |
cookies. ... .$PROPERTY[...]
- metavariable-regex:
metavariable: $PROPERTY
regex: (?!signed|encrypted)
- pattern: |
params[...]
- pattern: |
request.env[...]
pattern-sinks:
- patterns:
- pattern: $X
- pattern-either:
- pattern-inside: |
$X.constantize
- pattern-inside: |
$X. ... .safe_constantize
- pattern-inside: |
const_get(...)
- pattern-inside: |
qualified_const_get(...)
message: Found user-controllable input to Ruby reflection functionality. This allows
a remote user to influence runtime behavior, up to and including arbitrary remote
code execution. Do not provide user-controllable input to reflection functionality.
Do not call symbol conversion on user-controllable input.
languages:
- ruby
severity: ERROR
metadata:
source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_unsafe_reflection.rb
category: security
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
technology:
- ruby
- rails
references:
- https://github.com/presidentbeef/brakeman/blob/main/test/apps/rails2/app/controllers/application_controller.rb
cwe2022-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection
shortlink: https://sg.run/vpEX
semgrep.dev:
rule:
r_id: 20733
rv_id: 1263663
rule_id: wdUkYA
version_id: 0bTKzn8
url: https://semgrep.dev/playground/r/0bTKzn8/ruby.rails.security.brakeman.check-unsafe-reflection.check-unsafe-reflection
origin: community
- id: python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally
patterns:
- pattern-inside: |
$CONFIG.set_default_csrf_options(..., check_origin=$CHECK_ORIGIN, ...)
- pattern: $CHECK_ORIGIN
- metavariable-comparison:
metavariable: $CHECK_ORIGIN
comparison: $CHECK_ORIGIN == False
message: Automatic check of the referrer for cross-site request forgery tokens has
been explicitly disabled globally, which might leave views unprotected when an
unsafe CSRF storage policy is used. Use 'pyramid.config.Configurator.set_default_csrf_options(check_origin=True)'
to turn the automatic check for all unsafe methods (per RFC2616).
languages:
- python
severity: ERROR
fix: |
True
metadata:
cwe:
- 'CWE-352: Cross-Site Request Forgery (CSRF)'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
category: security
technology:
- pyramid
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: LOW
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site Request Forgery (CSRF)
source: https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally
shortlink: https://sg.run/3GeW
semgrep.dev:
rule:
r_id: 21443
rv_id: 1263563
rule_id: eqU9Le
version_id: K3TKkeo
url: https://semgrep.dev/playground/r/K3TKkeo/python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally
origin: community
- id: python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled
message: Origin check for the CSRF token is disabled for this view. This might represent
a security risk if the CSRF storage policy is not known to be secure.
metadata:
cwe:
- 'CWE-352: Cross-Site Request Forgery (CSRF)'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
asvs:
section: V4 Access Control
control_id: 4.2.2 CSRF
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V4-Access-Control.md#v42-operation-level-access-control
version: '4'
category: security
technology:
- pyramid
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: LOW
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site Request Forgery (CSRF)
source: https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled
shortlink: https://sg.run/4RB9
semgrep.dev:
rule:
r_id: 21444
rv_id: 1263564
rule_id: v8UGpL
version_id: qkTR7Gv
url: https://semgrep.dev/playground/r/qkTR7Gv/python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled
origin: community
severity: WARNING
languages:
- python
patterns:
- pattern-inside: |
from pyramid.view import view_config
...
@view_config(..., check_origin=$CHECK_ORIGIN, ...)
def $VIEW(...):
...
- pattern: $CHECK_ORIGIN
- metavariable-comparison:
metavariable: $CHECK_ORIGIN
comparison: $CHECK_ORIGIN == False
fix: |
True
- id: python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally
patterns:
- pattern-inside: |
$CONFIG.set_default_csrf_options(..., require_csrf=$REQUIRE_CSRF, ...)
- pattern: $REQUIRE_CSRF
- metavariable-comparison:
metavariable: $REQUIRE_CSRF
comparison: $REQUIRE_CSRF == False
message: Automatic check of cross-site request forgery tokens has been explicitly
disabled globally, which might leave views unprotected. Use 'pyramid.config.Configurator.set_default_csrf_options(require_csrf=True)'
to turn the automatic check for all unsafe methods (per RFC2616).
languages:
- python
severity: ERROR
fix: |
True
metadata:
cwe:
- 'CWE-352: Cross-Site Request Forgery (CSRF)'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
category: security
technology:
- pyramid
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: LOW
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site Request Forgery (CSRF)
source: https://semgrep.dev/r/python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally
shortlink: https://sg.run/Bx2R
semgrep.dev:
rule:
r_id: 21451
rv_id: 1263571
rule_id: 8GUKqP
version_id: 2KTv2en
url: https://semgrep.dev/playground/r/2KTv2en/python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally
origin: community
- id: python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response
message: Detected data rendered directly to the end user via 'Response'. This bypasses
Pyramid's built-in cross-site scripting (XSS) defenses and could result in an
XSS vulnerability. Use Pyramid's template engines to safely render HTML.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- pyramid
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response
shortlink: https://sg.run/DX8G
semgrep.dev:
rule:
r_id: 21452
rv_id: 1263572
rule_id: gxUeA8
version_id: X0TzyEe
url: https://semgrep.dev/playground/r/X0TzyEe/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response
origin: community
languages:
- python
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-inside: |
@pyramid.view.view_config( ... )
def $VIEW($REQ):
...
- pattern: $REQ.$ANYTHING
- pattern-not: $REQ.dbsession
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
pyramid.request.Response.text($SINK)
- pattern: |
pyramid.request.Response($SINK)
- pattern: |
$REQ.response.body = $SINK
- pattern: |
$REQ.response.text = $SINK
- pattern: |
$REQ.response.ubody = $SINK
- pattern: |
$REQ.response.unicode_body = $SINK
- pattern: $SINK
- id: python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection
message: Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause
sql injections if the developer inputs raw SQL into the before-mentioned clauses.
This pattern captures relevant cases in which the developer inputs raw SQL into
the distinct, having, group_by, order_by or filter clauses and injects user-input
into the raw SQL with any function besides "bindparams". Use bindParams to securely
bind user-input to SQL statements.
languages:
- python
severity: ERROR
metadata:
category: security
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.sqlalchemy.org/en/14/tutorial/data_select.html#tutorial-selecting-data
technology:
- pyramid
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection
shortlink: https://sg.run/W7eE
semgrep.dev:
rule:
r_id: 21453
rv_id: 1263573
rule_id: QrUZ7l
version_id: jQTn5WA
url: https://semgrep.dev/playground/r/jQTn5WA/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern-inside: |
from pyramid.view import view_config
...
@view_config( ... )
def $VIEW($REQ):
...
- pattern: $REQ.$ANYTHING
- pattern-not: $REQ.dbsession
pattern-sinks:
- patterns:
- pattern-inside: |
$QUERY = $REQ.dbsession.query(...)
...
- pattern-either:
- pattern: |
$QUERY.$SQLFUNC("...".$FORMATFUNC(..., $SINK, ...))
- pattern: |
$QUERY.join(...).$SQLFUNC("...".$FORMATFUNC(..., $SINK, ...))
- pattern: $SINK
- metavariable-regex:
metavariable: $SQLFUNC
regex: (group_by|order_by|distinct|having|filter)
- metavariable-regex:
metavariable: $FORMATFUNC
regex: (?!bindparams)
fix-regex:
regex: format
replacement: bindparams
- id: javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint
message: Use of angular.element can lead to XSS if user-input is treated as part
of the HTML element within `$SINK`. It is recommended to contextually output encode
user-input, before inserting into `$SINK`. If the HTML needs to be preserved it
is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize.
metadata:
confidence: MEDIUM
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
references:
- https://docs.angularjs.org/api/ng/function/angular.element
- https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
category: security
technology:
- angularjs
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint
shortlink: https://sg.run/5AQ0
semgrep.dev:
rule:
r_id: 21503
rv_id: 1263091
rule_id: GdUP71
version_id: 44TEj8L
url: https://semgrep.dev/playground/r/44TEj8L/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: window.location.search
- pattern: window.document.location.search
- pattern: document.location.search
- pattern: location.search
- pattern: $location.search(...)
- patterns:
- pattern-either:
- pattern: $DECODE(<... location.hash ...>)
- pattern: $DECODE(<... window.location.hash ...>)
- pattern: $DECODE(<... document.location.hash ...>)
- pattern: $DECODE(<... location.href ...>)
- pattern: $DECODE(<... window.location.href ...>)
- pattern: $DECODE(<... document.location.href ...>)
- pattern: $DECODE(<... document.URL ...>)
- pattern: $DECODE(<... window.document.URL ...>)
- pattern: $DECODE(<... document.location.href ...>)
- pattern: $DECODE(<... document.location.href ...>)
- pattern: $DECODE(<... $location.absUrl() ...>)
- pattern: $DECODE(<... $location.url() ...>)
- pattern: $DECODE(<... $location.hash() ...>)
- metavariable-regex:
metavariable: $DECODE
regex: ^(unescape|decodeURI|decodeURIComponent)$
- patterns:
- pattern-inside: $http.$METHOD(...).$CONTINUE(function $FUNC($RES) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|delete|head|jsonp|post|put|patch)
- pattern: $RES.data
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
angular.element(...). ... .$SINK($QUERY)
- pattern-inside: |
$ANGULAR = angular.element(...)
...
$ANGULAR. ... .$SINK($QUERY)
- metavariable-regex:
metavariable: $SINK
regex: ^(after|append|html|prepend|replaceWith|wrap)$
- focus-metavariable: $QUERY
pattern-sanitizers:
- patterns:
- pattern-either:
- pattern: $sce.getTrustedHtml(...)
- pattern: $sanitize(...)
- pattern: DOMPurify.sanitize(...)
- id: python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization
mode: taint
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context):
...
pattern-sinks:
- patterns:
- focus-metavariable: $SINK
- pattern-either:
- pattern: pickle.load($SINK,...)
- pattern: pickle.loads($SINK,...)
- pattern: _pickle.load($SINK,...)
- pattern: _pickle.loads($SINK,...)
- pattern: cPickle.load($SINK,...)
- pattern: cPickle.loads($SINK,...)
- pattern: dill.load($SINK,...)
- pattern: dill.loads($SINK,...)
- pattern: shelve.open($SINK,...)
message: Avoid using `pickle`, which is known to lead to code execution vulnerabilities.
When unpickling, the serialized data could be manipulated to run arbitrary code.
Instead, consider serializing the relevant data as JSON or a similar text-based
serialization format.
metadata:
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
references:
- https://docs.python.org/3/library/pickle.html
- https://davidhamann.de/2020/04/05/exploiting-python-pickle/
category: security
technology:
- python
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization
shortlink: https://sg.run/JbjW
semgrep.dev:
rule:
r_id: 21602
rv_id: 1263345
rule_id: JDUDQg
version_id: LjTkgd9
url: https://semgrep.dev/playground/r/LjTkgd9/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization
origin: community
languages:
- python
severity: WARNING
- id: php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection
mode: taint
pattern-sources:
- patterns:
- focus-metavariable: $ARG
- pattern-inside: |
Route::$METHOD($ROUTE_NAME, function(...,$ARG,...){...})
pattern-sanitizers:
- patterns:
- pattern: |
DB::raw("...",[...])
pattern-sinks:
- patterns:
- pattern: |
DB::raw(...)
message: HTTP method [$METHOD] to Laravel route $ROUTE_NAME is vulnerable to SQL
injection via string concatenation or unsafe interpolation.
languages:
- php
severity: WARNING
metadata:
category: security
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md
technology:
- php
- laravel
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection
shortlink: https://sg.run/x94g
semgrep.dev:
rule:
r_id: 21674
rv_id: 1263305
rule_id: zdUln0
version_id: qkTR7A9
url: https://semgrep.dev/playground/r/qkTR7A9/php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection
origin: community
- id: php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator
mode: taint
pattern-sources:
- patterns:
- pattern: |
public function $F(...,Request $R,...){...}
- focus-metavariable: $R
- patterns:
- pattern-either:
- pattern: |
$this->$PROPERTY
- pattern: |
$this->$PROPERTY->$GET
- metavariable-pattern:
metavariable: $PROPERTY
patterns:
- pattern-either:
- pattern: query
- pattern: request
- pattern: headers
- pattern: cookies
- pattern: cookie
- pattern: files
- pattern: file
- pattern: allFiles
- pattern: input
- pattern: all
- pattern: post
- pattern: json
- pattern-either:
- pattern-inside: |
class $CL extends Illuminate\Http\Request {...}
- pattern-inside: |
class $CL extends Illuminate\Foundation\Http\FormRequest {...}
pattern-sinks:
- patterns:
- pattern: |
Illuminate\Validation\Rule::unique(...)->ignore(...,$IGNORE,...)
- focus-metavariable: $IGNORE
message: Found a request argument passed to an `ignore()` definition in a Rule constraint.
This can lead to SQL injection.
languages:
- php
severity: ERROR
metadata:
category: security
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
technology:
- php
- laravel
references:
- https://laravel.com/docs/9.x/validation#rule-unique
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator
shortlink: https://sg.run/vkeb
semgrep.dev:
rule:
r_id: 21677
rv_id: 1263314
rule_id: X5ULgE
version_id: DkTRbBl
url: https://semgrep.dev/playground/r/DkTRbBl/php.laravel.security.laravel-unsafe-validator.laravel-unsafe-validator
origin: community
- id: java.spring.security.injection.tainted-html-string.tainted-html-string
languages:
- java
severity: ERROR
message: Detected user input flowing into a manually constructed HTML string. You
may be accidentally bypassing secure methods of rendering HTML by manually constructing
HTML and this could create a cross-site scripting vulnerability, which could let
attackers steal sensitive user data. To be sure this is safe, check that the HTML
is rendered safely. You can use the OWASP ESAPI encoder if you must render user
data.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
category: security
technology:
- java
- spring
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/java.spring.security.injection.tainted-html-string.tainted-html-string
shortlink: https://sg.run/ObdR
semgrep.dev:
rule:
r_id: 22075
rv_id: 1409395
rule_id: YGUvkL
version_id: 3ZT2598
url: https://semgrep.dev/playground/r/3ZT2598/java.spring.security.injection.tainted-html-string.tainted-html-string
origin: community
mode: taint
pattern-sources:
- label: INPUT
patterns:
- pattern-either:
- pattern-inside: |
$METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {
...
}
- pattern-inside: |
$METHODNAME(..., @$REQ $TYPE $SOURCE,...) {
...
}
- metavariable-regex:
metavariable: $TYPE
regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean))
- metavariable-regex:
metavariable: $REQ
regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute)
- focus-metavariable: $SOURCE
- label: CONCAT
by-side-effect: true
requires: INPUT
patterns:
- pattern-either:
- pattern: |
"$HTMLSTR" + ...
- pattern: |
"$HTMLSTR".concat(...)
- patterns:
- pattern-inside: |
StringBuilder $SB = new StringBuilder("$HTMLSTR");
...
- pattern: $SB.append(...)
- patterns:
- pattern-inside: |
$VAR = "$HTMLSTR";
...
- pattern: $VAR += ...
- pattern: String.format("$HTMLSTR", ...)
- patterns:
- pattern-inside: |
String $VAR = "$HTMLSTR";
...
- pattern: String.format($VAR, ...)
- metavariable-regex:
metavariable: $HTMLSTR
regex: ^<\w+
pattern-propagators:
- pattern: (StringBuilder $SB).append($...TAINTED)
from: $...TAINTED
to: $SB
- pattern: $VAR += $...TAINTED
from: $...TAINTED
to: $VAR
pattern-sinks:
- requires: CONCAT
patterns:
- pattern-either:
- pattern: new ResponseEntity<>($PAYLOAD, ...)
- pattern: new ResponseEntity<$ERROR>($PAYLOAD, ...)
- pattern: ResponseEntity. ... .body($PAYLOAD)
- patterns:
- pattern: |
ResponseEntity.$RESPFUNC($PAYLOAD). ...
- metavariable-regex:
metavariable: $RESPFUNC
regex: ^(ok|of)$
- focus-metavariable: $PAYLOAD
pattern-sanitizers:
- pattern-either:
- pattern: Encode.forHtml(...)
- pattern: (PolicyFactory $POLICY).sanitize(...)
- pattern: (AntiSamy $AS).scan(...)
- pattern: JSoup.clean(...)
- id: java.spring.security.injection.tainted-system-command.tainted-system-command
languages:
- java
severity: ERROR
mode: taint
pattern-propagators:
- pattern: (StringBuilder $STRB).append($INPUT)
from: $INPUT
to: $STRB
label: CONCAT
requires: INPUT
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
$METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {
...
}
- pattern-inside: |
$METHODNAME(..., @$REQ $TYPE $SOURCE,...) {
...
}
- metavariable-regex:
metavariable: $TYPE
regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean))
- metavariable-regex:
metavariable: $REQ
regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute)
- focus-metavariable: $SOURCE
label: INPUT
- patterns:
- pattern-either:
- pattern: $X + $SOURCE
- pattern: $SOURCE + $Y
- pattern: String.format("...", ..., $SOURCE, ...)
- pattern: String.join("...", ..., $SOURCE, ...)
- pattern: (String $STR).concat($SOURCE)
- pattern: $SOURCE.concat(...)
- pattern: $X += $SOURCE
- pattern: $SOURCE += $X
label: CONCAT
requires: INPUT
pattern-sinks:
- patterns:
- pattern-either:
- pattern: |
(Process $P) = new Process(...);
- pattern: |
(ProcessBuilder $PB).command(...);
- patterns:
- pattern-either:
- pattern: |
(Runtime $R).$EXEC(...);
- pattern: |
Runtime.getRuntime(...).$EXEC(...);
- metavariable-regex:
metavariable: $EXEC
regex: (exec|loadLibrary|load)
- patterns:
- pattern: |
(ProcessBuilder $PB).command(...).$ADD(...);
- metavariable-regex:
metavariable: $ADD
regex: (add|addAll)
- patterns:
- pattern-either:
- patterns:
- pattern-inside: |
$BUILDER = new ProcessBuilder(...);
...
- pattern: $BUILDER.start(...)
- pattern: |
new ProcessBuilder(...). ... .start(...);
requires: CONCAT
message: 'Detected user input entering a method which executes a system command.
This could result in a command injection vulnerability, which allows an attacker
to inject an arbitrary system command onto the server. The attacker could download
malware onto or steal data from the server. Instead, use ProcessBuilder, separating
the command into individual arguments, like this: `new ProcessBuilder("ls", "-al",
targetDirectory)`. Further, make sure you hardcode or allowlist the actual command
so that attackers can''t run arbitrary commands.'
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
category: security
technology:
- java
- spring
confidence: HIGH
references:
- https://www.stackhawk.com/blog/command-injection-java/
- https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html
- https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.java
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/java.spring.security.injection.tainted-system-command.tainted-system-command
shortlink: https://sg.run/epY0
semgrep.dev:
rule:
r_id: 22076
rv_id: 1263087
rule_id: 6JUxGN
version_id: 8KT5rnP
url: https://semgrep.dev/playground/r/8KT5rnP/java.spring.security.injection.tainted-system-command.tainted-system-command
origin: community
- id: java.spring.security.injection.tainted-url-host.tainted-url-host
languages:
- java
severity: ERROR
message: User data flows into the host portion of this manually-constructed URL.
This could allow an attacker to send data to their own server, potentially exposing
sensitive data such as cookies or authorization information sent with this request.
They could also probe internal servers or other resources that the server running
this code can access. (This is called server-side request forgery, or SSRF.) Do
not allow arbitrary hosts. Instead, create an allowlist for approved hosts, hardcode
the correct host, or ensure that the user data can only affect the path or parameters.
options:
interfile: true
metadata:
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
category: security
technology:
- java
- spring
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
confidence: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/java.spring.security.injection.tainted-url-host.tainted-url-host
shortlink: https://sg.run/vkYn
semgrep.dev:
rule:
r_id: 22077
rv_id: 1263088
rule_id: oqUZo8
version_id: gETB708
url: https://semgrep.dev/playground/r/gETB708/java.spring.security.injection.tainted-url-host.tainted-url-host
origin: community
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: |
$METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {
...
}
- pattern-inside: |
$METHODNAME(..., @$REQ $TYPE $SOURCE,...) {
...
}
- metavariable-regex:
metavariable: $TYPE
regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean))
- metavariable-regex:
metavariable: $REQ
regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute)
- focus-metavariable: $SOURCE
pattern-sinks:
- pattern-either:
- pattern: new URL($ONEARG)
- patterns:
- pattern-either:
- pattern: |
"$URLSTR" + ...
- pattern: |
"$URLSTR".concat(...)
- patterns:
- pattern-inside: |
StringBuilder $SB = new StringBuilder("$URLSTR");
...
- pattern: $SB.append(...)
- patterns:
- pattern-inside: |
$VAR = "$URLSTR";
...
- pattern: $VAR += ...
- patterns:
- pattern: String.format("$URLSTR", ...)
- pattern-not: String.format("$URLSTR", "...", ...)
- patterns:
- pattern-inside: |
String $VAR = "$URLSTR";
...
- pattern: String.format($VAR, ...)
- metavariable-regex:
metavariable: $URLSTR
regex: http(s?)://%(v|s|q).*
- id: ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization
mode: taint
languages:
- ruby
message: Deserialization of a string tainted by `event` object found. Objects in
Ruby can be serialized into strings, then later loaded from strings. However,
uses of `load` can cause remote code execution. Loading user input with MARSHAL,
YAML or CSV can potentially be dangerous. If you need to deserialize untrusted
data, you should use JSON as it is only capable of returning 'primitive' types
such as strings, arrays, hashes, numbers and nil.
metadata:
references:
- https://ruby-doc.org/core-3.1.2/doc/security_rdoc.html
- https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ
- https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb
category: security
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
technology:
- ruby
- aws-lambda
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization
shortlink: https://sg.run/dplX
semgrep.dev:
rule:
r_id: 22078
rv_id: 1263585
rule_id: zdUlNJ
version_id: vdT06gR
url: https://semgrep.dev/playground/r/vdT06gR/ruby.aws-lambda.security.tainted-deserialization.tainted-deserialization
origin: community
pattern-sinks:
- patterns:
- pattern: $SINK
- pattern-either:
- pattern-inside: |
YAML.load($SINK,...)
- pattern-inside: |
CSV.load($SINK,...)
- pattern-inside: |
Marshal.load($SINK,...)
- pattern-inside: |
Marshal.restore($SINK,...)
pattern-sources:
- patterns:
- pattern: event
- pattern-inside: |
def $HANDLER(event, context)
...
end
severity: WARNING
- id: javascript.express.security.audit.express-libxml-noent.express-libxml-noent
message: The libxml library processes user-input with the `noent` attribute is set
to `true` which can lead to being vulnerable to XML External Entities (XXE) type
attacks. It is recommended to set `noent` to `false` when using this feature to
ensure you are protected.
options:
interfile: true
metadata:
interfile: true
references:
- https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
technology:
- express
category: security
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent
shortlink: https://sg.run/Z75x
semgrep.dev:
rule:
r_id: 22079
rv_id: 1263138
rule_id: pKUNeD
version_id: d6TyxpX
url: https://semgrep.dev/playground/r/d6TyxpX/javascript.express.security.audit.express-libxml-noent.express-libxml-noent
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- pattern: $REQ.files.$ANYTHING.data.toString('utf8')
- pattern: $REQ.files.$ANYTHING['data'].toString('utf8')
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
- pattern: files.$ANYTHING.data.toString('utf8')
- pattern: files.$ANYTHING['data'].toString('utf8')
pattern-sinks:
- pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
$XML = require('$IMPORT')
...
- pattern-inside: |
import $XML from '$IMPORT'
...
- pattern-inside: |
import * as $XML from '$IMPORT'
...
- metavariable-regex:
metavariable: $IMPORT
regex: ^(libxmljs|libxmljs2)$
- pattern-inside: $XML.$FUNC($QUERY, {...,noent:true,...})
- metavariable-regex:
metavariable: $FUNC
regex: ^(parseXmlString|parseXml)$
- focus-metavariable: $QUERY
- id: javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret
message: A hard-coded credential was detected. It is not recommended to store credentials
in source-code, as this risks secrets being leaked and used by either an internal
or external malicious adversary. It is recommended to use environment variables
to securely provide credentials or retrieve credentials from a secure vault or
HSM (Hardware Security Module).
options:
interfile: true
metadata:
interfile: true
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
category: security
technology:
- express
- secrets
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Hard-coded Secrets
source: https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret
shortlink: https://sg.run/LYvG
semgrep.dev:
rule:
r_id: 22083
rv_id: 1263143
rule_id: 10Uo39
version_id: LjTkgle
url: https://semgrep.dev/playground/r/LjTkgle/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret
origin: community
languages:
- javascript
- typescript
severity: WARNING
patterns:
- pattern-either:
- pattern-inside: |
$SESSION = require('express-session');
...
- pattern-inside: |
import $SESSION from 'express-session'
...
- pattern-inside: |
import {..., $SESSION, ...} from 'express-session'
...
- pattern-inside: |
import * as $SESSION from 'express-session'
...
- patterns:
- pattern-either:
- pattern-inside: $APP.use($SESSION({...}))
- pattern: |
$SECRET = $VALUE
...
$APP.use($SESSION($SECRET))
- pattern: |
secret: '$Y'
- id: javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization
message: The following function call $SER.$FUNC accepts user controlled data which
can result in Remote Code Execution (RCE) through Object Deserialization. It is
recommended to use secure data processing alternatives such as JSON.parse() and
Buffer.from().
options:
interfile: true
metadata:
interfile: true
technology:
- express
category: security
cwe:
- 'CWE-502: Deserialization of Untrusted Data'
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html
source_rule_url:
- https://github.com/ajinabraham/njsscan/blob/75bfbeb9c8d72999e4d527dfa2548f7f0f3cc48a/njsscan/rules/semantic_grep/eval/eval_deserialize.yaml
owasp:
- A08:2017 - Insecure Deserialization
- A08:2021 - Software and Data Integrity Failures
- A08:2025 - Software or Data Integrity Failures
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- 'Insecure Deserialization '
source: https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization
shortlink: https://sg.run/8W5j
semgrep.dev:
rule:
r_id: 22084
rv_id: 1263145
rule_id: 9AUyqj
version_id: gETB7nD
url: https://semgrep.dev/playground/r/gETB7nD/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- pattern: $REQ.files.$ANYTHING.data.toString('utf8')
- pattern: $REQ.files.$ANYTHING['data'].toString('utf8')
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
- pattern: files.$ANYTHING.data.toString('utf8')
- pattern: files.$ANYTHING['data'].toString('utf8')
pattern-sinks:
- pattern-either:
- patterns:
- pattern-either:
- pattern-inside: |
$SER = require('$IMPORT')
...
- pattern-inside: |
import $SER from '$IMPORT'
...
- pattern-inside: |
import * as $SER from '$IMPORT'
...
- metavariable-regex:
metavariable: $IMPORT
regex: ^(node-serialize|serialize-to-js)$
- pattern: $SER.$FUNC(...)
- metavariable-regex:
metavariable: $FUNC
regex: ^(unserialize|deserialize)$
- id: javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection
message: Detected a sequelize statement that is tainted by user-input. This could
lead to SQL injection if the variable is user-controlled and is not properly sanitized.
In order to prevent SQL injection, it is recommended to use parameterized queries
or prepared statements.
options:
interfile: true
metadata:
interfile: true
references:
- https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements
category: security
technology:
- express
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection
shortlink: https://sg.run/gjoe
semgrep.dev:
rule:
r_id: 22085
rv_id: 1263241
rule_id: yyU0GX
version_id: nWT2Llx
url: https://semgrep.dev/playground/r/nWT2Llx/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection
origin: community
languages:
- javascript
- typescript
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, $RES) {...}
- pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
- patterns:
- pattern-either:
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|head|delete|options)$
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- pattern: $REQ.files.$ANYTHING.data.toString('utf8')
- pattern: $REQ.files.$ANYTHING['data'].toString('utf8')
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
{...}
- pattern-inside: |
({ $REQ }: Request,$RES: Response) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
- pattern: files.$ANYTHING.data.toString('utf8')
- pattern: files.$ANYTHING['data'].toString('utf8')
pattern-sinks:
- pattern-either:
- patterns:
- pattern-either:
- pattern: sequelize.query($QUERY,...)
- pattern: $DB.sequelize.query($QUERY,...)
- focus-metavariable: $QUERY
pattern-sanitizers:
- pattern-either:
- pattern: parseInt(...)
- pattern: $FUNC. ... .hash(...)
- id: javascript.express.security.audit.express-ssrf.express-ssrf
message: 'The following request $REQUEST.$METHOD() was found to be crafted from
user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities.
It is recommended where possible to not allow user-input to craft the base request,
but to be treated as part of the path or query parameter. When user-input is necessary
to craft the request, it is recommeneded to follow OWASP best practices to prevent
abuse. '
metadata:
references:
- https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
cwe:
- 'CWE-918: Server-Side Request Forgery (SSRF)'
technology:
- express
category: security
owasp:
- A10:2021 - Server-Side Request Forgery (SSRF)
- A01:2025 - Broken Access Control
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Server-Side Request Forgery (SSRF)
source: https://semgrep.dev/r/javascript.express.security.audit.express-ssrf.express-ssrf
shortlink: https://sg.run/0PNw
semgrep.dev:
rule:
r_id: 22554
rv_id: 1263144
rule_id: eqU9l2
version_id: 8KT5rBr
url: https://semgrep.dev/playground/r/8KT5rBr/javascript.express.security.audit.express-ssrf.express-ssrf
origin: community
languages:
- javascript
- typescript
severity: WARNING
mode: taint
options:
taint_unify_mvars: true
pattern-sources:
- patterns:
- pattern-either:
- pattern-inside: function ... ($REQ, ...) {...}
- pattern-either:
- pattern: $REQ.query
- pattern: $REQ.body
- pattern: $REQ.params
- pattern: $REQ.cookies
- pattern: $REQ.headers
- patterns:
- pattern-either:
- pattern-inside: |
({ $REQ }: Request,...) =>
{...}
- pattern-inside: |
({ $REQ }: $EXPRESS.Request,...) => {...}
- focus-metavariable: $REQ
- pattern-either:
- pattern: params
- pattern: query
- pattern: cookies
- pattern: headers
- pattern: body
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: |
$REQUEST = require('request')
...
- pattern-inside: |
import * as $REQUEST from 'request'
...
- pattern-inside: |
import $REQUEST from 'request'
...
- pattern-either:
- pattern: $REQUEST.$METHOD("$HTTP"+$REQ. ... .$VALUE)
- pattern: $REQUEST.$METHOD("$HTTP"+$REQ. ... .$VALUE + $...A)
- pattern: $REQUEST.$METHOD(`$HTTP${$REQ. ... .$VALUE}...`)
- pattern: $REQUEST.$METHOD("$HTTP"+$REQ.$VALUE[...])
- pattern: $REQUEST.$METHOD("$HTTP"+$REQ.$VALUE[...] + $...A)
- pattern: $REQUEST.$METHOD(`$HTTP${$REQ.$VALUE[...]}...`)
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|patch|del|head|delete)$
- metavariable-regex:
metavariable: $HTTP
regex: ^(https?:\/\/|//)$
- pattern-either:
- pattern: $REQ. ... .$VALUE
- patterns:
- pattern-either:
- pattern-inside: |
$REQUEST = require('request')
...
- pattern-inside: |
import * as $REQUEST from 'request'
...
- pattern-inside: |
import $REQUEST from 'request'
...
- pattern-either:
- pattern: $REQUEST.$METHOD($REQ. ... .$VALUE,...)
- pattern: $REQUEST.$METHOD($REQ. ... .$VALUE + $...A,...)
- pattern: $REQUEST.$METHOD(`${$REQ. ... .$VALUE}...`,...)
- pattern: $REQ. ... .$VALUE
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|patch|del|head|delete)$
- patterns:
- pattern-either:
- pattern-inside: |
$REQUEST = require('request')
...
- pattern-inside: |
import * as $REQUEST from 'request'
...
- pattern-inside: |
import $REQUEST from 'request'
...
- pattern-either:
- pattern: $REQUEST.$METHOD($REQ.$VALUE['...'],...)
- pattern: $REQUEST.$METHOD($REQ.$VALUE['...'] + $...A,...)
- pattern: $REQUEST.$METHOD(`${$REQ.$VALUE['...']}...`,...)
- pattern: $REQ.$VALUE
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|patch|del|head|delete)$
- patterns:
- pattern-either:
- pattern-inside: |
$REQUEST = require('request')
...
- pattern-inside: |
import * as $REQUEST from 'request'
...
- pattern-inside: |
import $REQUEST from 'request'
...
- pattern-either:
- pattern-inside: |
$ASSIGN = $REQ. ... .$VALUE
...
- pattern-inside: |
$ASSIGN = $REQ. ... .$VALUE['...']
...
- pattern-inside: |
$ASSIGN = $REQ. ... .$VALUE + $...A
...
- pattern-inside: "$ASSIGN = $REQ. ... .$VALUE['...'] + $...A\n... \n"
- pattern-inside: |
$ASSIGN = `${$REQ. ... .$VALUE}...`
...
- pattern-inside: "$ASSIGN = `${$REQ. ... .$VALUE['...']}...`\n... \n"
- patterns:
- pattern-either:
- pattern-inside: |
$ASSIGN = "$HTTP"+ $REQ. ... .$VALUE
...
- pattern-inside: |
$ASSIGN = "$HTTP"+$REQ. ... .$VALUE + $...A
...
- pattern-inside: |
$ASSIGN = "$HTTP"+$REQ.$VALUE[...]
...
- pattern-inside: |
$ASSIGN = "$HTTP"+$REQ.$VALUE[...] + $...A
...
- pattern-inside: |
$ASSIGN = `$HTTP${$REQ.$VALUE[...]}...`
...
- metavariable-regex:
metavariable: $HTTP
regex: ^(https?:\/\/|//)$
- pattern-either:
- pattern: $REQUEST.$METHOD($ASSIGN,...)
- pattern: $REQUEST.$METHOD($ASSIGN + $...FOO,...)
- pattern: $REQUEST.$METHOD(`${$ASSIGN}...`,...)
- patterns:
- pattern-either:
- pattern: $REQUEST.$METHOD("$HTTP"+$ASSIGN,...)
- pattern: $REQUEST.$METHOD("$HTTP"+$ASSIGN + $...A,...)
- pattern: $REQUEST.$METHOD(`$HTTP${$ASSIGN}...`,...)
- metavariable-regex:
metavariable: $HTTP
regex: ^(https?:\/\/|//)$
- pattern: $ASSIGN
- metavariable-regex:
metavariable: $METHOD
regex: ^(get|post|put|patch|del|head|delete)$
- id: go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage
message: Detected usage of dangerous method $METHOD which does not escape inputs
(see link in references). If the argument is user-controlled, this can lead to
SQL injection. When using $METHOD function, do not trust user-submitted data and
only allow approved list of input (possibly, use an allowlist approach).
severity: WARNING
languages:
- go
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
($REQUEST : http.Request).$ANYTHING
- pattern: |
($REQUEST : *http.Request).$ANYTHING
- metavariable-regex:
metavariable: $ANYTHING
regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
pattern-sinks:
- patterns:
- pattern-inside: |
import ("gorm.io/gorm")
...
- patterns:
- pattern-inside: |
func $VAL(..., $GORM *gorm.DB,... ) {
...
}
- pattern-either:
- pattern: |
$GORM. ... .$METHOD($VALUE)
- pattern: |
$DB := $GORM. ... .$ANYTHING(...)
...
$DB. ... .$METHOD($VALUE)
- focus-metavariable: $VALUE
- metavariable-regex:
metavariable: $METHOD
regex: ^(Order|Exec|Raw|Group|Having|Distinct|Select|Pluck)$
pattern-sanitizers:
- pattern-either:
- pattern: strconv.Atoi(...)
- pattern: |
($X: bool)
options:
interfile: true
metadata:
category: security
technology:
- gorm
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://gorm.io/docs/security.html#SQL-injection-Methods
- https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
confidence: HIGH
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
interfile: true
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage
shortlink: https://sg.run/R4qg
semgrep.dev:
rule:
r_id: 24693
rv_id: 1262915
rule_id: AbU5o3
version_id: l4TJRJK
url: https://semgrep.dev/playground/r/l4TJRJK/go.gorm.security.audit.gorm-dangerous-methods-usage.gorm-dangerous-method-usage
origin: community
- id: csharp.dotnet.security.audit.missing-or-broken-authorization.missing-or-broken-authorization
message: Anonymous access shouldn't be allowed unless explicit by design. Access
control checks are missing and potentially can be bypassed. This finding violates
the principle of least privilege or deny by default, where access should only
be permitted for a specific set of roles or conforms to a custom policy or users.
severity: INFO
metadata:
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
category: security
cwe:
- 'CWE-862: Missing Authorization'
cwe2021-top25: true
cwe2022-top25: true
cwe2023-top25: true
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
- https://cwe.mitre.org/data/definitions/862.html
- https://docs.microsoft.com/en-us/aspnet/core/security/authorization/simple?view=aspnetcore-7.0
subcategory:
- vuln
technology:
- .net
- mvc
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/csharp.dotnet.security.audit.missing-or-broken-authorization.missing-or-broken-authorization
shortlink: https://sg.run/Z8GA
semgrep.dev:
rule:
r_id: 26335
rv_id: 1262615
rule_id: eqU32Y
version_id: o5TbD41
url: https://semgrep.dev/playground/r/o5TbD41/csharp.dotnet.security.audit.missing-or-broken-authorization.missing-or-broken-authorization
origin: community
languages:
- csharp
patterns:
- pattern: |
public class $CLASS : Controller {
...
}
- pattern-inside: |
using Microsoft.AspNetCore.Mvc;
...
- pattern-not: |
[AllowAnonymous]
public class $CLASS : Controller {
...
}
- pattern-not: |
[Authorize]
public class $CLASS : Controller {
...
}
- pattern-not: |
[Authorize(Roles = ...)]
public class $CLASS : Controller {
...
}
- pattern-not: |
[Authorize(Policy = ...)]
public class $CLASS : Controller {
...
}
- id: python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args
mode: taint
options:
symbolic_propagation: true
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: os.environ
- pattern: os.environ.get('$FOO', ...)
- pattern: os.environb
- pattern: os.environb.get('$FOO', ...)
- pattern: os.getenv('$ANYTHING', ...)
- pattern: os.getenvb('$ANYTHING', ...)
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: sys.argv
- pattern: sys.orig_argv
- patterns:
- pattern-inside: |
$PARSER = argparse.ArgumentParser(...)
...
- pattern-inside: |
$ARGS = $PARSER.parse_args()
- pattern: <... $ARGS ...>
- patterns:
- pattern-inside: |
$PARSER = optparse.OptionParser(...)
...
- pattern-inside: |
$ARGS = $PARSER.parse_args()
- pattern: <... $ARGS ...>
- patterns:
- pattern-either:
- pattern-inside: |
$OPTS, $ARGS = getopt.getopt(...)
...
- pattern-inside: |
$OPTS, $ARGS = getopt.gnu_getopt(...)
...
- pattern-either:
- patterns:
- pattern-inside: |
for $O, $A in $OPTS:
...
- pattern: $A
- pattern: $ARGS
pattern-sinks:
- pattern-either:
- patterns:
- pattern-not: $LOOP.subprocess_exec($PROTOCOL, "...", ...)
- pattern-not: $LOOP.subprocess_exec($PROTOCOL, ["...",...], ...)
- pattern: $LOOP.subprocess_exec(...)
- patterns:
- pattern-not: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/",
"-c", "...", ...)
- pattern: $LOOP.subprocess_exec($PROTOCOL, "=~/(sh|bash|ksh|csh|tcsh|zsh)/",
"-c",...)
- patterns:
- pattern-not: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/",
"-c", "...", ...], ...)
- pattern: $LOOP.subprocess_exec($PROTOCOL, ["=~/(sh|bash|ksh|csh|tcsh|zsh)/",
"-c", ...], ...)
message: Detected subprocess function '$LOOP.subprocess_exec' with user controlled
data. You may consider using 'shlex.escape()'.
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.8 OS Command Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
references:
- https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec
- https://docs.python.org/3/library/shlex.html
- https://semgrep.dev/docs/cheat-sheets/python-command-injection/
category: security
technology:
- python
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args
shortlink: https://sg.run/Apjp
semgrep.dev:
rule:
r_id: 27250
rv_id: 1263460
rule_id: 7KUE1E
version_id: WrTqKXz
url: https://semgrep.dev/playground/r/WrTqKXz/python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args
origin: community
languages:
- python
severity: ERROR
- id: python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args
mode: taint
options:
symbolic_propagation: true
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: os.environ
- pattern: os.environ.get('$FOO', ...)
- pattern: os.environb
- pattern: os.environb.get('$FOO', ...)
- pattern: os.getenv('$ANYTHING', ...)
- pattern: os.getenvb('$ANYTHING', ...)
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: sys.argv
- pattern: sys.orig_argv
- patterns:
- pattern-inside: |
$PARSER = argparse.ArgumentParser(...)
...
- pattern-inside: |
$ARGS = $PARSER.parse_args()
- pattern: <... $ARGS ...>
- patterns:
- pattern-inside: |
$PARSER = optparse.OptionParser(...)
...
- pattern-inside: |
$ARGS = $PARSER.parse_args()
- pattern: <... $ARGS ...>
- patterns:
- pattern-either:
- pattern-inside: |
$OPTS, $ARGS = getopt.getopt(...)
...
- pattern-inside: |
$OPTS, $ARGS = getopt.gnu_getopt(...)
...
- pattern-either:
- patterns:
- pattern-inside: |
for $O, $A in $OPTS:
...
- pattern: $A
- pattern: $ARGS
pattern-sinks:
- patterns:
- pattern-either:
- pattern-inside: $LOOP.subprocess_shell($PROTOCOL, $CMD)
- pattern-inside: asyncio.subprocess.create_subprocess_shell($CMD, ...)
- pattern-inside: asyncio.create_subprocess_shell($CMD, ...)
- focus-metavariable: $CMD
- pattern-not-inside: |
$CMD = "..."
...
- pattern-not: $LOOP.subprocess_shell($PROTOCOL, "...")
- pattern-not: asyncio.subprocess.create_subprocess_shell("...", ...)
- pattern-not: asyncio.create_subprocess_shell("...", ...)
message: Detected asyncio subprocess function with user controlled data. You may
consider using 'shlex.escape()'.
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.8 OS Command Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
references:
- https://docs.python.org/3/library/asyncio-subprocess.html
- https://docs.python.org/3/library/shlex.html
- https://semgrep.dev/docs/cheat-sheets/python-command-injection/
category: security
technology:
- python
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args
shortlink: https://sg.run/Dx8Y
semgrep.dev:
rule:
r_id: 27252
rv_id: 1263462
rule_id: 8GU5q3
version_id: K3TKkDn
url: https://semgrep.dev/playground/r/K3TKkDn/python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args
origin: community
languages:
- python
severity: ERROR
- id: python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args
mode: taint
options:
symbolic_propagation: true
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: os.environ
- pattern: os.environ.get('$FOO', ...)
- pattern: os.environb
- pattern: os.environb.get('$FOO', ...)
- pattern: os.getenv('$ANYTHING', ...)
- pattern: os.getenvb('$ANYTHING', ...)
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: sys.argv
- pattern: sys.orig_argv
- patterns:
- pattern-inside: |
$PARSER = argparse.ArgumentParser(...)
...
- pattern-inside: |
$ARGS = $PARSER.parse_args()
- pattern: <... $ARGS ...>
- patterns:
- pattern-inside: |
$PARSER = optparse.OptionParser(...)
...
- pattern-inside: |
$ARGS = $PARSER.parse_args()
- pattern: <... $ARGS ...>
- patterns:
- pattern-either:
- pattern-inside: |
$OPTS, $ARGS = getopt.getopt(...)
...
- pattern-inside: |
$OPTS, $ARGS = getopt.gnu_getopt(...)
...
- pattern-either:
- patterns:
- pattern-inside: |
for $O, $A in $OPTS:
...
- pattern: $A
- pattern: $ARGS
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-not: os.$METHOD("...", ...)
- pattern: os.$METHOD(...)
- metavariable-regex:
metavariable: $METHOD
regex: (execl|execle|execlp|execlpe|execv|execve|execvp|execvpe)
- patterns:
- pattern-not: os.$METHOD("...", [$PATH,"...","...",...],...)
- pattern-inside: os.$METHOD($BASH,[$PATH,"-c",$CMD,...],...)
- pattern: $CMD
- metavariable-regex:
metavariable: $METHOD
regex: (execv|execve|execvp|execvpe)
- metavariable-regex:
metavariable: $BASH
regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
- patterns:
- pattern-not: os.$METHOD("...", $PATH, "...", "...",...)
- pattern-inside: os.$METHOD($BASH, $PATH, "-c", $CMD,...)
- pattern: $CMD
- metavariable-regex:
metavariable: $METHOD
regex: (execl|execle|execlp|execlpe)
- metavariable-regex:
metavariable: $BASH
regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
message: Found user controlled content when spawning a process. This is dangerous
because it allows a malicious actor to execute commands.
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://semgrep.dev/docs/cheat-sheets/python-command-injection/
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.8 OS Command Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
confidence: MEDIUM
category: security
technology:
- python
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args
shortlink: https://sg.run/qL6z
semgrep.dev:
rule:
r_id: 27256
rv_id: 1263466
rule_id: 4bUEAY
version_id: 6xT29l6
url: https://semgrep.dev/playground/r/6xT29l6/python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args
origin: community
languages:
- python
severity: ERROR
- id: python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args
mode: taint
options:
symbolic_propagation: true
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: os.environ
- pattern: os.environ.get('$FOO', ...)
- pattern: os.environb
- pattern: os.environb.get('$FOO', ...)
- pattern: os.getenv('$ANYTHING', ...)
- pattern: os.getenvb('$ANYTHING', ...)
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: sys.argv
- pattern: sys.orig_argv
- patterns:
- pattern-inside: |
$PARSER = argparse.ArgumentParser(...)
...
- pattern-inside: |
$ARGS = $PARSER.parse_args()
- pattern: <... $ARGS ...>
- patterns:
- pattern-inside: |
$PARSER = optparse.OptionParser(...)
...
- pattern-inside: |
$ARGS = $PARSER.parse_args()
- pattern: <... $ARGS ...>
- patterns:
- pattern-either:
- pattern-inside: |
$OPTS, $ARGS = getopt.getopt(...)
...
- pattern-inside: |
$OPTS, $ARGS = getopt.gnu_getopt(...)
...
- pattern-either:
- patterns:
- pattern-inside: |
for $O, $A in $OPTS:
...
- pattern: $A
- pattern: $ARGS
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-not: os.$METHOD($MODE, "...", ...)
- pattern-inside: os.$METHOD($MODE, $CMD, ...)
- pattern: $CMD
- metavariable-regex:
metavariable: $METHOD
regex: (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile)
- patterns:
- pattern-not: os.$METHOD($MODE, "...", ["...","...",...], ...)
- pattern-inside: os.$METHOD($MODE, $BASH, ["-c",$CMD,...],...)
- pattern: $CMD
- metavariable-regex:
metavariable: $METHOD
regex: (spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp)
- metavariable-regex:
metavariable: $BASH
regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
- patterns:
- pattern-not: os.$METHOD($MODE, "...", "...", "...", ...)
- pattern-inside: os.$METHOD($MODE, $BASH, "-c", $CMD,...)
- pattern: $CMD
- metavariable-regex:
metavariable: $METHOD
regex: (spawnl|spawnle|spawnlp|spawnlpe)
- metavariable-regex:
metavariable: $BASH
regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
message: Found user controlled content when spawning a process. This is dangerous
because it allows a malicious actor to execute commands.
metadata:
source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://semgrep.dev/docs/cheat-sheets/python-command-injection/
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.8 OS Command Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
category: security
technology:
- python
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args
shortlink: https://sg.run/Y3Ke
semgrep.dev:
rule:
r_id: 27258
rv_id: 1263468
rule_id: JDUz34
version_id: zyTb2wn
url: https://semgrep.dev/playground/r/zyTb2wn/python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args
origin: community
languages:
- python
severity: ERROR
- id: python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args
mode: taint
options:
symbolic_propagation: true
pattern-sanitizers:
- pattern: shlex.quote(...)
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: os.environ
- pattern: os.environ.get('$FOO', ...)
- pattern: os.environb
- pattern: os.environb.get('$FOO', ...)
- pattern: os.getenv('$ANYTHING', ...)
- pattern: os.getenvb('$ANYTHING', ...)
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: sys.argv
- pattern: sys.orig_argv
- patterns:
- pattern-inside: |
$PARSER = argparse.ArgumentParser(...)
...
- pattern-inside: |
$ARGS = $PARSER.parse_args()
- pattern: <... $ARGS ...>
- patterns:
- pattern-inside: |
$PARSER = optparse.OptionParser(...)
...
- pattern-inside: |
$ARGS = $PARSER.parse_args()
- pattern: <... $ARGS ...>
- patterns:
- pattern-either:
- pattern-inside: |
$OPTS, $ARGS = getopt.getopt(...)
...
- pattern-inside: |
$OPTS, $ARGS = getopt.gnu_getopt(...)
...
- pattern-either:
- patterns:
- pattern-inside: |
for $O, $A in $OPTS:
...
- pattern: $A
- pattern: $ARGS
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-not: subprocess.$FUNC("...", ...)
- pattern-not: subprocess.$FUNC(["...",...], ...)
- pattern-not: subprocess.$FUNC(("...",...), ...)
- pattern-not: subprocess.CalledProcessError(...)
- pattern-not: subprocess.SubprocessError(...)
- pattern: subprocess.$FUNC($CMD, ...)
- patterns:
- pattern-not: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...)
- pattern: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD)
- patterns:
- pattern-not: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...],...)
- pattern-not: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...),...)
- pattern-either:
- pattern: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD],
...)
- pattern: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD),
...)
- patterns:
- pattern-not: subprocess.$FUNC("=~/(python)/","...",...)
- pattern: subprocess.$FUNC("=~/(python)/", $CMD)
- patterns:
- pattern-not: subprocess.$FUNC(["=~/(python)/","...",...],...)
- pattern-not: subprocess.$FUNC(("=~/(python)/","...",...),...)
- pattern-either:
- pattern: subprocess.$FUNC(["=~/(python)/", $CMD],...)
- pattern: subprocess.$FUNC(("=~/(python)/", $CMD),...)
- focus-metavariable: $CMD
message: Detected subprocess function '$FUNC' with user controlled data. A malicious
actor could leverage this to perform command injection. You may consider using
'shlex.quote()'.
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.8 OS Command Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
references:
- https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess
- https://docs.python.org/3/library/subprocess.html
- https://docs.python.org/3/library/shlex.html
- https://semgrep.dev/docs/cheat-sheets/python-command-injection/
category: security
technology:
- python
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args
shortlink: https://sg.run/pLGg
semgrep.dev:
rule:
r_id: 27262
rv_id: 1263472
rule_id: AbUgrZ
version_id: jQTn54Y
url: https://semgrep.dev/playground/r/jQTn54Y/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args
origin: community
languages:
- python
severity: ERROR
- id: python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args
mode: taint
options:
symbolic_propagation: true
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: os.environ
- pattern: os.environ.get('$FOO', ...)
- pattern: os.environb
- pattern: os.environb.get('$FOO', ...)
- pattern: os.getenv('$ANYTHING', ...)
- pattern: os.getenvb('$ANYTHING', ...)
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: sys.argv
- pattern: sys.orig_argv
- patterns:
- pattern-inside: |
$PARSER = argparse.ArgumentParser(...)
...
- pattern-inside: |
$ARGS = $PARSER.parse_args()
- pattern: <... $ARGS ...>
- patterns:
- pattern-inside: |
$PARSER = optparse.OptionParser(...)
...
- pattern-inside: |
$ARGS = $PARSER.parse_args()
- pattern: <... $ARGS ...>
- patterns:
- pattern-either:
- pattern-inside: |
$OPTS, $ARGS = getopt.getopt(...)
...
- pattern-inside: |
$OPTS, $ARGS = getopt.gnu_getopt(...)
...
- pattern-either:
- patterns:
- pattern-inside: |
for $O, $A in $OPTS:
...
- pattern: $A
- pattern: $ARGS
pattern-sinks:
- patterns:
- pattern-not: os.$W("...", ...)
- pattern-either:
- pattern: os.system(...)
- pattern: |
$X = __import__("os")
...
$X.system(...)
- pattern: |
$X = __import__("os")
...
getattr($X, "system")(...)
- pattern: |
$X = getattr(os, "system")
...
$X(...)
- pattern: |
$X = __import__("os")
...
$Y = getattr($X, "system")
...
$Y(...)
- pattern: os.popen(...)
- pattern: os.popen2(...)
- pattern: os.popen3(...)
- pattern: os.popen4(...)
message: Found user-controlled data used in a system call. This could allow a malicious
actor to execute commands. Use the 'subprocess' module instead, which is easier
to use without accidentally exposing a command injection vulnerability.
metadata:
source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://semgrep.dev/docs/cheat-sheets/python-command-injection/
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.2.4 Dyanmic Code Execution Features
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements
version: '4'
category: security
technology:
- python
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args
shortlink: https://sg.run/XR2K
semgrep.dev:
rule:
r_id: 27264
rv_id: 1263474
rule_id: DbUR9g
version_id: 9lT4bG4
url: https://semgrep.dev/playground/r/9lT4bG4/python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args
origin: community
languages:
- python
severity: ERROR
- id: python.lang.security.dangerous-os-exec.dangerous-os-exec
mode: taint
options:
symbolic_propagation: true
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: flask.request.form.get(...)
- pattern: flask.request.form[...]
- pattern: flask.request.args.get(...)
- pattern: flask.request.args[...]
- pattern: flask.request.values.get(...)
- pattern: flask.request.values[...]
- pattern: flask.request.cookies.get(...)
- pattern: flask.request.cookies[...]
- pattern: flask.request.stream
- pattern: flask.request.headers.get(...)
- pattern: flask.request.headers[...]
- pattern: flask.request.data
- pattern: flask.request.full_path
- pattern: flask.request.url
- pattern: flask.request.json
- pattern: flask.request.get_json()
- pattern: flask.request.view_args.get(...)
- pattern: flask.request.view_args[...]
- patterns:
- pattern-inside: |
@$APP.route(...)
def $FUNC(..., $ROUTEVAR, ...):
...
- focus-metavariable: $ROUTEVAR
- patterns:
- pattern-inside: |
def $FUNC(request, ...):
...
- pattern-either:
- pattern: request.$PROPERTY.get(...)
- pattern: request.$PROPERTY[...]
- patterns:
- pattern-either:
- pattern-inside: |
@rest_framework.decorators.api_view(...)
def $FUNC($REQ, ...):
...
- patterns:
- pattern-either:
- pattern-inside: |
class $VIEW(..., rest_framework.views.APIView, ...):
...
- pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView,
...):\n ... \n"
- pattern-inside: |
def $METHOD(self, $REQ, ...):
...
- metavariable-regex:
metavariable: $METHOD
regex: (get|post|put|patch|delete|head)
- pattern-either:
- pattern: $REQ.POST.get(...)
- pattern: $REQ.POST[...]
- pattern: $REQ.FILES.get(...)
- pattern: $REQ.FILES[...]
- pattern: $REQ.DATA.get(...)
- pattern: $REQ.DATA[...]
- pattern: $REQ.QUERY_PARAMS.get(...)
- pattern: $REQ.QUERY_PARAMS[...]
- pattern: $REQ.data.get(...)
- pattern: $REQ.data[...]
- pattern: $REQ.query_params.get(...)
- pattern: $REQ.query_params[...]
- pattern: $REQ.content_type
- pattern: $REQ.content_type
- pattern: $REQ.stream
- pattern: $REQ.stream
- patterns:
- pattern-either:
- pattern-inside: |
class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):
...
- pattern-inside: |
class $SERVER(..., http.server.StreamRequestHandler, ...):
...
- pattern-inside: |
class $SERVER(..., http.server.DatagramRequestHandler, ...):
...
- pattern-either:
- pattern: self.requestline
- pattern: self.path
- pattern: self.headers[...]
- pattern: self.headers.get(...)
- pattern: self.rfile
- patterns:
- pattern-inside: |
@pyramid.view.view_config( ... )
def $VIEW($REQ):
...
- pattern: $REQ.$ANYTHING
- pattern-not: $REQ.dbsession
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-not: os.$METHOD("...", ...)
- pattern: os.$METHOD(...)
- metavariable-regex:
metavariable: $METHOD
regex: (execl|execle|execlp|execlpe|execv|execve|execvp|execvpe)
- patterns:
- pattern-not: os.$METHOD("...", [$PATH,"...","...",...],...)
- pattern-inside: os.$METHOD($BASH,[$PATH,"-c",$CMD,...],...)
- pattern: $CMD
- metavariable-regex:
metavariable: $METHOD
regex: (execv|execve|execvp|execvpe)
- metavariable-regex:
metavariable: $BASH
regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
- patterns:
- pattern-not: os.$METHOD("...", $PATH, "...", "...",...)
- pattern-inside: os.$METHOD($BASH, $PATH, "-c", $CMD,...)
- pattern: $CMD
- metavariable-regex:
metavariable: $METHOD
regex: (execl|execle|execlp|execlpe)
- metavariable-regex:
metavariable: $BASH
regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
message: Found user controlled content when spawning a process. This is dangerous
because it allows a malicious actor to execute commands.
metadata:
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://semgrep.dev/docs/cheat-sheets/python-command-injection/
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.8 OS Command Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
confidence: MEDIUM
category: security
technology:
- python
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.lang.security.dangerous-os-exec.dangerous-os-exec
shortlink: https://sg.run/yL9x
semgrep.dev:
rule:
r_id: 27268
rv_id: 1263523
rule_id: qNUR13
version_id: 6xT29rz
url: https://semgrep.dev/playground/r/6xT29rz/python.lang.security.dangerous-os-exec.dangerous-os-exec
origin: community
languages:
- python
severity: ERROR
- id: python.lang.security.dangerous-spawn-process.dangerous-spawn-process
mode: taint
options:
symbolic_propagation: true
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: flask.request.form.get(...)
- pattern: flask.request.form[...]
- pattern: flask.request.args.get(...)
- pattern: flask.request.args[...]
- pattern: flask.request.values.get(...)
- pattern: flask.request.values[...]
- pattern: flask.request.cookies.get(...)
- pattern: flask.request.cookies[...]
- pattern: flask.request.stream
- pattern: flask.request.headers.get(...)
- pattern: flask.request.headers[...]
- pattern: flask.request.data
- pattern: flask.request.full_path
- pattern: flask.request.url
- pattern: flask.request.json
- pattern: flask.request.get_json()
- pattern: flask.request.view_args.get(...)
- pattern: flask.request.view_args[...]
- patterns:
- pattern-inside: |
@$APP.route(...)
def $FUNC(..., $ROUTEVAR, ...):
...
- pattern: $ROUTEVAR
- patterns:
- pattern-inside: |
def $FUNC(request, ...):
...
- pattern-either:
- pattern: request.$PROPERTY.get(...)
- pattern: request.$PROPERTY[...]
- patterns:
- pattern-either:
- pattern-inside: |
@rest_framework.decorators.api_view(...)
def $FUNC($REQ, ...):
...
- patterns:
- pattern-either:
- pattern-inside: |
class $VIEW(..., rest_framework.views.APIView, ...):
...
- pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView,
...):\n ... \n"
- pattern-inside: |
def $METHOD(self, $REQ, ...):
...
- metavariable-regex:
metavariable: $METHOD
regex: (get|post|put|patch|delete|head)
- pattern-either:
- pattern: $REQ.POST.get(...)
- pattern: $REQ.POST[...]
- pattern: $REQ.FILES.get(...)
- pattern: $REQ.FILES[...]
- pattern: $REQ.DATA.get(...)
- pattern: $REQ.DATA[...]
- pattern: $REQ.QUERY_PARAMS.get(...)
- pattern: $REQ.QUERY_PARAMS[...]
- pattern: $REQ.data.get(...)
- pattern: $REQ.data[...]
- pattern: $REQ.query_params.get(...)
- pattern: $REQ.query_params[...]
- pattern: $REQ.content_type
- pattern: $REQ.content_type
- pattern: $REQ.stream
- pattern: $REQ.stream
- patterns:
- pattern-either:
- pattern-inside: |
class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):
...
- pattern-inside: |
class $SERVER(..., http.server.StreamRequestHandler, ...):
...
- pattern-inside: |
class $SERVER(..., http.server.DatagramRequestHandler, ...):
...
- pattern-either:
- pattern: self.requestline
- pattern: self.path
- pattern: self.headers[...]
- pattern: self.headers.get(...)
- pattern: self.rfile
- patterns:
- pattern-inside: |
@pyramid.view.view_config( ... )
def $VIEW($REQ):
...
- pattern: $REQ.$ANYTHING
- pattern-not: $REQ.dbsession
- patterns:
- pattern-either:
- pattern: os.environ['$ANYTHING']
- pattern: os.environ.get('$FOO', ...)
- pattern: os.environb['$ANYTHING']
- pattern: os.environb.get('$FOO', ...)
- pattern: os.getenv('$ANYTHING', ...)
- pattern: os.getenvb('$ANYTHING', ...)
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: sys.argv[...]
- pattern: sys.orig_argv[...]
- patterns:
- pattern-inside: |
$PARSER = argparse.ArgumentParser(...)
...
- pattern-inside: |
$ARGS = $PARSER.parse_args()
- pattern: <... $ARGS ...>
- patterns:
- pattern-inside: |
$PARSER = optparse.OptionParser(...)
...
- pattern-inside: |
$ARGS = $PARSER.parse_args()
- pattern: <... $ARGS ...>
- patterns:
- pattern-either:
- pattern-inside: |
$OPTS, $ARGS = getopt.getopt(...)
...
- pattern-inside: |
$OPTS, $ARGS = getopt.gnu_getopt(...)
...
- pattern-either:
- patterns:
- pattern-inside: |
for $O, $A in $OPTS:
...
- pattern: $A
- pattern: $ARGS
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-not: os.$METHOD($MODE, "...", ...)
- pattern-inside: os.$METHOD($MODE, $CMD, ...)
- pattern: $CMD
- metavariable-regex:
metavariable: $METHOD
regex: (spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile)
- patterns:
- pattern-not: os.$METHOD($MODE, "...", ["...","...",...], ...)
- pattern-inside: os.$METHOD($MODE, $BASH, ["-c",$CMD,...],...)
- pattern: $CMD
- metavariable-regex:
metavariable: $METHOD
regex: (spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp)
- metavariable-regex:
metavariable: $BASH
regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
- patterns:
- pattern-not: os.$METHOD($MODE, "...", "...", "...", ...)
- pattern-inside: os.$METHOD($MODE, $BASH, "-c", $CMD,...)
- pattern: $CMD
- metavariable-regex:
metavariable: $METHOD
regex: (spawnl|spawnle|spawnlp|spawnlpe)
- metavariable-regex:
metavariable: $BASH
regex: (.*)(sh|bash|ksh|csh|tcsh|zsh)
message: Found user controlled content when spawning a process. This is dangerous
because it allows a malicious actor to execute commands.
metadata:
source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://semgrep.dev/docs/cheat-sheets/python-command-injection/
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.8 OS Command Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
category: security
technology:
- python
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.lang.security.dangerous-spawn-process.dangerous-spawn-process
shortlink: https://sg.run/r8Zn
semgrep.dev:
rule:
r_id: 27269
rv_id: 1263524
rule_id: lBUJrn
version_id: o5TbDO5
url: https://semgrep.dev/playground/r/o5TbDO5/python.lang.security.dangerous-spawn-process.dangerous-spawn-process
origin: community
languages:
- python
severity: ERROR
- id: python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use
mode: taint
options:
symbolic_propagation: true
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: flask.request.form.get(...)
- pattern: flask.request.form[...]
- pattern: flask.request.args.get(...)
- pattern: flask.request.args[...]
- pattern: flask.request.values.get(...)
- pattern: flask.request.values[...]
- pattern: flask.request.cookies.get(...)
- pattern: flask.request.cookies[...]
- pattern: flask.request.stream
- pattern: flask.request.headers.get(...)
- pattern: flask.request.headers[...]
- pattern: flask.request.data
- pattern: flask.request.full_path
- pattern: flask.request.url
- pattern: flask.request.json
- pattern: flask.request.get_json()
- pattern: flask.request.view_args.get(...)
- pattern: flask.request.view_args[...]
- patterns:
- pattern-inside: |
@$APP.route(...)
def $FUNC(..., $ROUTEVAR, ...):
...
- focus-metavariable: $ROUTEVAR
- patterns:
- pattern-inside: |
def $FUNC(request, ...):
...
- pattern-either:
- pattern: request.$PROPERTY.get(...)
- pattern: request.$PROPERTY[...]
- patterns:
- pattern-either:
- pattern-inside: |
@rest_framework.decorators.api_view(...)
def $FUNC($REQ, ...):
...
- patterns:
- pattern-either:
- pattern-inside: |
class $VIEW(..., rest_framework.views.APIView, ...):
...
- pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView,
...):\n ... \n"
- pattern-inside: |
def $METHOD(self, $REQ, ...):
...
- metavariable-regex:
metavariable: $METHOD
regex: (get|post|put|patch|delete|head)
- pattern-either:
- pattern: $REQ.POST.get(...)
- pattern: $REQ.POST[...]
- pattern: $REQ.FILES.get(...)
- pattern: $REQ.FILES[...]
- pattern: $REQ.DATA.get(...)
- pattern: $REQ.DATA[...]
- pattern: $REQ.QUERY_PARAMS.get(...)
- pattern: $REQ.QUERY_PARAMS[...]
- pattern: $REQ.data.get(...)
- pattern: $REQ.data[...]
- pattern: $REQ.query_params.get(...)
- pattern: $REQ.query_params[...]
- pattern: $REQ.content_type
- pattern: $REQ.content_type
- pattern: $REQ.stream
- pattern: $REQ.stream
- patterns:
- pattern-either:
- pattern-inside: |
class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):
...
- pattern-inside: |
class $SERVER(..., http.server.StreamRequestHandler, ...):
...
- pattern-inside: |
class $SERVER(..., http.server.DatagramRequestHandler, ...):
...
- pattern-either:
- pattern: self.requestline
- pattern: self.path
- pattern: self.headers[...]
- pattern: self.headers.get(...)
- pattern: self.rfile
- patterns:
- pattern-inside: |
@pyramid.view.view_config( ... )
def $VIEW($REQ):
...
- pattern: $REQ.$ANYTHING
- pattern-not: $REQ.dbsession
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern-not: subprocess.$FUNC("...", ...)
- pattern-not: subprocess.$FUNC(["...",...], ...)
- pattern-not: subprocess.$FUNC(("...",...), ...)
- pattern-not: subprocess.CalledProcessError(...)
- pattern-not: subprocess.SubprocessError(...)
- pattern: subprocess.$FUNC($CMD, ...)
- patterns:
- pattern-not: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...)
- pattern: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD)
- patterns:
- pattern-not: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...],...)
- pattern-not: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...),...)
- pattern-either:
- pattern: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD],
...)
- pattern: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD),
...)
- patterns:
- pattern-not: subprocess.$FUNC("=~/(python)/","...",...)
- pattern: subprocess.$FUNC("=~/(python)/", $CMD)
- patterns:
- pattern-not: subprocess.$FUNC(["=~/(python)/","...",...],...)
- pattern-not: subprocess.$FUNC(("=~/(python)/","...",...),...)
- pattern-either:
- pattern: subprocess.$FUNC(["=~/(python)/", $CMD],...)
- pattern: subprocess.$FUNC(("=~/(python)/", $CMD),...)
- focus-metavariable: $CMD
message: Detected subprocess function '$FUNC' with user controlled data. A malicious
actor could leverage this to perform command injection. You may consider using
'shlex.escape()'.
metadata:
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.3.8 OS Command Injection
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
version: '4'
references:
- https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess
- https://docs.python.org/3/library/subprocess.html
- https://docs.python.org/3/library/shlex.html
- https://semgrep.dev/docs/cheat-sheets/python-command-injection/
category: security
technology:
- python
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use
shortlink: https://sg.run/NWxp
semgrep.dev:
rule:
r_id: 27271
rv_id: 1263526
rule_id: JDUz3R
version_id: pZT038J
url: https://semgrep.dev/playground/r/pZT038J/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use
origin: community
languages:
- python
severity: ERROR
- id: python.lang.security.dangerous-system-call.dangerous-system-call
mode: taint
options:
symbolic_propagation: true
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern-either:
- pattern: flask.request.form.get(...)
- pattern: flask.request.form[...]
- pattern: flask.request.args.get(...)
- pattern: flask.request.args[...]
- pattern: flask.request.values.get(...)
- pattern: flask.request.values[...]
- pattern: flask.request.cookies.get(...)
- pattern: flask.request.cookies[...]
- pattern: flask.request.stream
- pattern: flask.request.headers.get(...)
- pattern: flask.request.headers[...]
- pattern: flask.request.data
- pattern: flask.request.full_path
- pattern: flask.request.url
- pattern: flask.request.json
- pattern: flask.request.get_json()
- pattern: flask.request.view_args.get(...)
- pattern: flask.request.view_args[...]
- patterns:
- pattern-inside: |
@$APP.route(...)
def $FUNC(..., $ROUTEVAR, ...):
...
- focus-metavariable: $ROUTEVAR
- patterns:
- pattern-inside: |
def $FUNC(request, ...):
...
- pattern-either:
- pattern: request.$PROPERTY.get(...)
- pattern: request.$PROPERTY[...]
- patterns:
- pattern-either:
- pattern-inside: |
@rest_framework.decorators.api_view(...)
def $FUNC($REQ, ...):
...
- patterns:
- pattern-either:
- pattern-inside: |
class $VIEW(..., rest_framework.views.APIView, ...):
...
- pattern-inside: "class $VIEW(..., rest_framework.generics.GenericAPIView,
...):\n ... \n"
- pattern-inside: |
def $METHOD(self, $REQ, ...):
...
- metavariable-regex:
metavariable: $METHOD
regex: (get|post|put|patch|delete|head)
- pattern-either:
- pattern: $REQ.POST.get(...)
- pattern: $REQ.POST[...]
- pattern: $REQ.FILES.get(...)
- pattern: $REQ.FILES[...]
- pattern: $REQ.DATA.get(...)
- pattern: $REQ.DATA[...]
- pattern: $REQ.QUERY_PARAMS.get(...)
- pattern: $REQ.QUERY_PARAMS[...]
- pattern: $REQ.data.get(...)
- pattern: $REQ.data[...]
- pattern: $REQ.query_params.get(...)
- pattern: $REQ.query_params[...]
- pattern: $REQ.content_type
- pattern: $REQ.content_type
- pattern: $REQ.stream
- pattern: $REQ.stream
- patterns:
- pattern-either:
- pattern-inside: |
class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):
...
- pattern-inside: |
class $SERVER(..., http.server.StreamRequestHandler, ...):
...
- pattern-inside: |
class $SERVER(..., http.server.DatagramRequestHandler, ...):
...
- pattern-either:
- pattern: self.requestline
- pattern: self.path
- pattern: self.headers[...]
- pattern: self.headers.get(...)
- pattern: self.rfile
- patterns:
- pattern-inside: |
@pyramid.view.view_config( ... )
def $VIEW($REQ):
...
- pattern: $REQ.$ANYTHING
- pattern-not: $REQ.dbsession
pattern-sinks:
- patterns:
- pattern-not: os.$W("...", ...)
- pattern-either:
- pattern: os.system(...)
- pattern: getattr(os, "system")(...)
- pattern: __import__("os").system(...)
- pattern: getattr(__import__("os"), "system")(...)
- pattern: |
$X = __import__("os")
...
$X.system(...)
- pattern: |
$X = __import__("os")
...
getattr($X, "system")(...)
- pattern: |
$X = getattr(os, "system")
...
$X(...)
- pattern: |
$X = __import__("os")
...
$Y = getattr($X, "system")
...
$Y(...)
- pattern: os.popen(...)
- pattern: os.popen2(...)
- pattern: os.popen3(...)
- pattern: os.popen4(...)
message: Found user-controlled data used in a system call. This could allow a malicious
actor to execute commands. Use the 'subprocess' module instead, which is easier
to use without accidentally exposing a command injection vulnerability.
metadata:
source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://semgrep.dev/docs/cheat-sheets/python-command-injection/
asvs:
section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
control_id: 5.2.4 Dyanmic Code Execution Features
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements
version: '4'
category: security
technology:
- python
confidence: MEDIUM
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.lang.security.dangerous-system-call.dangerous-system-call
shortlink: https://sg.run/k0W7
semgrep.dev:
rule:
r_id: 27272
rv_id: 1263527
rule_id: 5rUoP1
version_id: 2KTv2Zn
url: https://semgrep.dev/playground/r/2KTv2Zn/python.lang.security.dangerous-system-call.dangerous-system-call
origin: community
languages:
- python
severity: ERROR
- id: python.django.security.injection.command.subprocess-injection.subprocess-injection
languages:
- python
mode: taint
options:
symbolic_propagation: true
pattern-sources:
- patterns:
- pattern-inside: |
def $FUNC(..., $REQUEST, ...):
...
- focus-metavariable: $REQUEST
- metavariable-pattern:
metavariable: $REQUEST
patterns:
- pattern: request
- pattern-not-inside: request.build_absolute_uri
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: subprocess.$FUNC(...)
- pattern-not: subprocess.$FUNC("...", ...)
- pattern-not: subprocess.$FUNC(["...", ...], ...)
- pattern-not-inside: |
$CMD = ["...", ...]
...
subprocess.$FUNC($CMD, ...)
- patterns:
- pattern: subprocess.$FUNC(["$SHELL", "-c", ...], ...)
- metavariable-regex:
metavariable: $SHELL
regex: ^(sh|bash|ksh|csh|tcsh|zsh)$
- patterns:
- pattern: subprocess.$FUNC(["$INTERPRETER", ...], ...)
- metavariable-regex:
metavariable: $INTERPRETER
regex: ^(python|python\d)$
pattern-sanitizers:
- patterns:
- pattern: $DICT[$KEY]
- focus-metavariable: $KEY
severity: ERROR
message: Detected user input entering a `subprocess` call unsafely. This could result
in a command injection vulnerability. An attacker could use this vulnerability
to execute arbitrary commands on the host, which allows them to download malware,
scan sensitive data, or run any command they wish on the server. Do not let users
choose the command to run. In general, prefer to use Python API versions of system
commands. If you must use subprocess, use a dictionary to allowlist a set of commands.
metadata:
category: security
technology:
- flask
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
references:
- https://semgrep.dev/docs/cheat-sheets/python-command-injection/
confidence: HIGH
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection
shortlink: https://sg.run/49BE
semgrep.dev:
rule:
r_id: 31144
rv_id: 1263388
rule_id: EwUepx
version_id: 7ZTE3qK
url: https://semgrep.dev/playground/r/7ZTE3qK/python.django.security.injection.command.subprocess-injection.subprocess-injection
origin: community
- id: python.flask.security.injection.subprocess-injection.subprocess-injection
languages:
- python
mode: taint
options:
symbolic_propagation: true
pattern-sources:
- pattern-either:
- patterns:
- pattern-either:
- pattern: flask.request.form.get(...)
- pattern: flask.request.form[...]
- pattern: flask.request.args.get(...)
- pattern: flask.request.args[...]
- pattern: flask.request.values.get(...)
- pattern: flask.request.values[...]
- pattern: flask.request.cookies.get(...)
- pattern: flask.request.cookies[...]
- pattern: flask.request.stream
- pattern: flask.request.headers.get(...)
- pattern: flask.request.headers[...]
- pattern: flask.request.data
- pattern: flask.request.full_path
- pattern: flask.request.url
- pattern: flask.request.json
- pattern: flask.request.get_json()
- pattern: flask.request.view_args.get(...)
- pattern: flask.request.view_args[...]
- patterns:
- pattern-inside: |
@$APP.route($ROUTE, ...)
def $FUNC(..., $ROUTEVAR, ...):
...
- focus-metavariable: $ROUTEVAR
pattern-sinks:
- patterns:
- pattern-either:
- patterns:
- pattern: subprocess.$FUNC(...)
- pattern-not: subprocess.$FUNC("...", ...)
- pattern-not: subprocess.$FUNC(["...", ...], ...)
- pattern-not-inside: |
$CMD = ["...", ...]
...
subprocess.$FUNC($CMD, ...)
- patterns:
- pattern: subprocess.$FUNC(["$SHELL", "-c", ...], ...)
- metavariable-regex:
metavariable: $SHELL
regex: ^(sh|bash|ksh|csh|tcsh|zsh)$
- patterns:
- pattern: subprocess.$FUNC(["$INTERPRETER", ...], ...)
- metavariable-regex:
metavariable: $INTERPRETER
regex: ^(python|python\d)$
pattern-sanitizers:
- patterns:
- pattern: $DICT[$KEY]
- focus-metavariable: $KEY
severity: ERROR
message: Detected user input entering a `subprocess` call unsafely. This could result
in a command injection vulnerability. An attacker could use this vulnerability
to execute arbitrary commands on the host, which allows them to download malware,
scan sensitive data, or run any command they wish on the server. Do not let users
choose the command to run. In general, prefer to use Python API versions of system
commands. If you must use subprocess, use a dictionary to allowlist a set of commands.
metadata:
category: security
technology:
- flask
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
references:
- https://semgrep.dev/docs/cheat-sheets/python-command-injection/
confidence: HIGH
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection
shortlink: https://sg.run/5gW3
semgrep.dev:
rule:
r_id: 31147
rv_id: 1263433
rule_id: 8GU3qp
version_id: bZT53gQ
url: https://semgrep.dev/playground/r/bZT53gQ/python.flask.security.injection.subprocess-injection.subprocess-injection
origin: community
- id: yaml.github-actions.security.github-script-injection.github-script-injection
languages:
- yaml
message: 'Using variable interpolation `${{...}}` with `github` context data in
a `actions/github-script`''s `script:` step could allow an attacker to inject
their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted.
Instead, use an intermediate environment variable with `env:` to store the data
and use the environment variable in the `run:` script. Be sure to use double-quotes
the environment variable, like this: "$ENVVAR".'
metadata:
category: security
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
- https://securitylab.github.com/research/github-actions-untrusted-input/
- https://github.com/actions/github-script
technology:
- github-actions
cwe2022-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/yaml.github-actions.security.github-script-injection.github-script-injection
shortlink: https://sg.run/g1G0
semgrep.dev:
rule:
r_id: 31441
rv_id: 1423394
rule_id: OrUQvK
version_id: 5PT7Zyw
url: https://semgrep.dev/playground/r/5PT7Zyw/yaml.github-actions.security.github-script-injection.github-script-injection
origin: community
patterns:
- pattern-inside: 'steps: [...]'
- pattern-inside: |
uses: $ACTION
...
- pattern-inside: |
with:
...
script: ...
...
- pattern: 'script: $SHELL'
- metavariable-regex:
metavariable: $ACTION
regex: actions/github-script@.*
- metavariable-pattern:
language: generic
metavariable: $SHELL
patterns:
- pattern-either:
- pattern: ${{ ... github.event.issue.title ... }}
- pattern: ${{ ... github.event.issue.body ... }}
- pattern: ${{ ... github.event.pull_request.title ... }}
- pattern: ${{ ... github.event.pull_request.body ... }}
- pattern: ${{ ... github.event.comment.body ... }}
- pattern: ${{ ... github.event.review.body ... }}
- pattern: ${{ ... github.event.review_comment.body ... }}
- pattern: ${{ ... github.event.pages ... .page_name ... }}
- pattern: ${{ ... github.event.head_commit.message ... }}
- pattern: ${{ ... github.event.head_commit.author.email ... }}
- pattern: ${{ ... github.event.head_commit.author.name ... }}
- pattern: ${{ ... github.event.commits ... .author.email ... }}
- pattern: ${{ ... github.event.commits ... .author.name ... }}
- pattern: ${{ ... github.event.commits ... .message ... }}
- pattern: ${{ ... github.event.pull_request.head.ref ... }}
- pattern: ${{ ... github.event.pull_request.head.label ... }}
- pattern: ${{ ... github.event.pull_request.head.repo.default_branch ...
}}
- pattern: ${{ ... github.ref ... }}
- pattern: ${{ ... github.base_ref ... }}
- pattern: ${{ ... github.head_ref ... }}
- pattern: ${{ ... github.ref_name ... }}
- pattern: ${{ ... github.workflow ... }}
- pattern: ${{ ... github.event.inputs ... }}
- pattern: ${{ ... github.event.discussion.title ... }}
- pattern: ${{ ... github.event.discussion.body ... }}
- pattern: ${{ ... github.event.workflow_run.head_branch ... }}
- pattern: ${{ ... github.event.workflow_run.head_commit.message ... }}
- pattern: ${{ ... github.event.milestone.title ... }}
- pattern: ${{ ... github.event.milestone.description ... }}
- pattern: ${{ ... github.event.project_card.note ... }}
- pattern: ${{ ... github.event.project.name ... }}
- pattern: ${{ ... github.event.project_column.name ... }}
- pattern: ${{ ... github.event.release.name ... }}
- pattern: ${{ ... github.event.release.body ... }}
- pattern: ${{ ... github.event.deployment.ref ... }}
- pattern: ${{ ... inputs ... }}
- pattern-not: ${{ ... github.event.issue.title && ... }}
- pattern-not: ${{ ... github.event.issue.body && ... }}
- pattern-not: ${{ ... github.event.pull_request.title && ... }}
- pattern-not: ${{ ... github.event.pull_request.body && ... }}
- pattern-not: ${{ ... github.event.comment.body && ... }}
- pattern-not: ${{ ... github.event.review.body && ... }}
- pattern-not: ${{ ... github.event.review_comment.body && ... }}
- pattern-not: ${{ ... github.event.pages ... .page_name && ... }}
- pattern-not: ${{ ... github.event.head_commit.message && ... }}
- pattern-not: ${{ ... github.event.head_commit.author.email && ... }}
- pattern-not: ${{ ... github.event.head_commit.author.name && ... }}
- pattern-not: ${{ ... github.event.commits ... .author.email && ... }}
- pattern-not: ${{ ... github.event.commits ... .author.name && ... }}
- pattern-not: ${{ ... github.event.commits ... .message && ... }}
- pattern-not: ${{ ... github.event.pull_request.head.ref && ... }}
- pattern-not: ${{ ... github.event.pull_request.head.label && ... }}
- pattern-not: ${{ ... github.event.pull_request.head.repo.default_branch &&
... }}
- pattern-not: ${{ ... github.ref && ... }}
- pattern-not: ${{ ... github.base_ref && ... }}
- pattern-not: ${{ ... github.head_ref && ... }}
- pattern-not: ${{ ... github.ref_name && ... }}
- pattern-not: ${{ ... github.workflow && ... }}
- pattern-not: ${{ ... github.event.inputs && ... }}
- pattern-not: ${{ ... github.event.discussion.title && ... }}
- pattern-not: ${{ ... github.event.discussion.body && ... }}
- pattern-not: ${{ ... github.event.workflow_run.head_branch && ... }}
- pattern-not: ${{ ... github.event.workflow_run.head_commit.message && ...
}}
- pattern-not: ${{ ... github.event.milestone.title && ... }}
- pattern-not: ${{ ... github.event.milestone.description && ... }}
- pattern-not: ${{ ... github.event.project_card.note && ... }}
- pattern-not: ${{ ... github.event.project.name && ... }}
- pattern-not: ${{ ... github.event.project_column.name && ... }}
- pattern-not: ${{ ... github.event.release.name && ... }}
- pattern-not: ${{ ... github.event.release.body && ... }}
- pattern-not: ${{ ... github.event.deployment.ref && ... }}
severity: ERROR
- id: php.lang.security.injection.echoed-request.echoed-request
mode: taint
message: '`Echo`ing user input risks cross-site scripting vulnerability. You should
use `htmlentities()` when showing data to users.'
languages:
- php
severity: ERROR
pattern-sources:
- pattern: $_REQUEST
- pattern: $_GET
- pattern: $_POST
pattern-sinks:
- pattern: echo $...VARS;
pattern-sanitizers:
- pattern: htmlentities(...)
- pattern: htmlspecialchars(...)
- pattern: strip_tags(...)
- pattern: isset(...)
- pattern: empty(...)
- pattern: esc_html(...)
- pattern: esc_attr(...)
- pattern: wp_kses(...)
- pattern: e(...)
- pattern: twig_escape_filter(...)
- pattern: xss_clean(...)
- pattern: html_escape(...)
- pattern: Html::escape(...)
- pattern: Xss::filter(...)
- pattern: escapeHtml(...)
- pattern: escapeHtml(...)
- pattern: escapeHtmlAttr(...)
fix: echo htmlentities($...VARS);
metadata:
technology:
- php
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
references:
- https://www.php.net/manual/en/function.htmlentities.php
- https://www.php.net/manual/en/reserved.variables.request.php
- https://www.php.net/manual/en/reserved.variables.post.php
- https://www.php.net/manual/en/reserved.variables.get.php
- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/php.lang.security.injection.echoed-request.echoed-request
shortlink: https://sg.run/Bqqb
semgrep.dev:
rule:
r_id: 31707
rv_id: 1263283
rule_id: BYUyyg
version_id: d6TyxE9
url: https://semgrep.dev/playground/r/d6TyxE9/php.lang.security.injection.echoed-request.echoed-request
origin: community
- id: java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing
severity: ERROR
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://blog.sonarsource.com/secure-xml-processor
- https://xerces.apache.org/xerces2-j/features.html
category: security
technology:
- java
- xml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing
shortlink: https://sg.run/Gj32
semgrep.dev:
rule:
r_id: 59048
rv_id: 1263061
rule_id: j2Udpk
version_id: YDTZeko
url: https://semgrep.dev/playground/r/YDTZeko/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing
origin: community
message: DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable
to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl`
to true. Alternatively, allow DOCTYPE declarations and only prohibit external
entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities`
and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE -
The previous links are not meant to be clicked. They are the literal config key
values that are supposed to be used to disable these features. For more information,
see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory.
mode: taint
pattern-sources:
- by-side-effect: true
patterns:
- pattern-either:
- pattern: |
$FACTORY = SAXParserFactory.newInstance();
- patterns:
- pattern: $FACTORY
- pattern-inside: |
class $C {
...
$V $FACTORY = SAXParserFactory.newInstance();
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = SAXParserFactory.newInstance();
static {
...
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
...
}
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = SAXParserFactory.newInstance();
static {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
}
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = SAXParserFactory.newInstance();
static {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
}
...
}
pattern-sinks:
- patterns:
- pattern: $FACTORY.newSAXParser();
pattern-sanitizers:
- by-side-effect: true
pattern-either:
- patterns:
- pattern-either:
- pattern: |
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
- pattern: |
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
- pattern: |
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
- focus-metavariable: $FACTORY
- patterns:
- pattern-either:
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl",
true);
...
}
...
}
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
}
...
}
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
...
$FACTORY.setFeature("http://xml.org/sax/features/external-general-entities",false);
...
}
...
}
- pattern: $M($X)
- focus-metavariable: $X
fix: |
$FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
$FACTORY.newSAXParser();
languages:
- java
- id: java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled
severity: ERROR
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://blog.sonarsource.com/secure-xml-processor
- https://xerces.apache.org/xerces2-j/features.html
category: security
technology:
- java
- xml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled
shortlink: https://sg.run/1wyQ
semgrep.dev:
rule:
r_id: 59622
rv_id: 1263062
rule_id: v8UeQ1
version_id: 6xT29GK
url: https://semgrep.dev/playground/r/6xT29GK/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled
origin: community
message: DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable
to XML external entity attacks. Disable this by setting the attributes "accessExternalDTD"
and "accessExternalStylesheet" to "".
mode: taint
pattern-sources:
- by-side-effect: true
patterns:
- pattern-either:
- pattern: |
$FACTORY = TransformerFactory.newInstance();
- patterns:
- pattern: $FACTORY
- pattern-inside: |
class $C {
...
$V $FACTORY = TransformerFactory.newInstance();
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = TransformerFactory.newInstance();
static {
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
...
}
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = TransformerFactory.newInstance();
static {
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
...
}
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = TransformerFactory.newInstance();
static {
...
$FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
...
$FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", "");
...
}
...
}
- pattern-not-inside: |
class $C {
...
$V $FACTORY = TransformerFactory.newInstance();
static {
...
$FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", "");
...
$FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
...
}
...
}
pattern-sinks:
- patterns:
- pattern: $FACTORY.newTransformer(...);
pattern-sanitizers:
- by-side-effect: true
pattern-either:
- patterns:
- pattern-either:
- pattern: |
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); ...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
- pattern: |
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
- pattern: |
$FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", ""); ...
$FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
- pattern: |
$FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
...
$FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", "");
- focus-metavariable: $FACTORY
- patterns:
- pattern-either:
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
...
}
...
}
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
...
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
...
}
...
}
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", "");
...
$FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
...
}
...
}
- pattern-inside: |
class $C {
...
$T $M(...) {
...
$FACTORY.setAttribute("=~/.*accessExternalDTD.*/", "");
...
$FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", "");
...
}
...
}
- pattern: $M($X)
- focus-metavariable: $X
fix: |
$FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
$FACTORY.newTransformer(...);
languages:
- java
- id: java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request
message: Detected input from a HTTPServletRequest going into the environment variables
of an 'exec' command. Instead, call the command with user-supplied arguments
by using the overloaded method with one String array as the argument. `exec({"command",
"arg1", "arg2"})`.
languages:
- java
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: |
(HttpServletRequest $REQ)
- patterns:
- pattern-inside: |
(javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);
...
for (javax.servlet.http.Cookie $COOKIE: $COOKIES) {
...
}
- pattern: |
$COOKIE.getValue(...)
pattern-sinks:
- patterns:
- pattern: (java.lang.Runtime $R).exec($CMD, $ENV_ARGS, ...);
- focus-metavariable: $ENV_ARGS
metadata:
category: security
technology:
- java
cwe:
- 'CWE-454: External Initialization of Trusted Variables or Data Stores'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://owasp.org/Top10/A03_2021-Injection
cwe2022-top25: false
cwe2021-top25: false
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Other
source: https://semgrep.dev/r/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request
shortlink: https://sg.run/EJAB
semgrep.dev:
rule:
r_id: 70981
rv_id: 1409391
rule_id: nJULjy
version_id: LjTRL6W
url: https://semgrep.dev/playground/r/LjTRL6W/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request
origin: community
- id: clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe
languages:
- clojure
severity: ERROR
metadata:
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
asvs:
section: V5 Validation, Sanitization and Encoding
control_id: 5.5.2 Insecue XML Deserialization
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
version: '4'
references:
- https://semgrep.dev/blog/2022/xml-security-in-java
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://xerces.apache.org/xerces2-j/features.html
source-rule-url: https://github.com/clj-holmes/clj-holmes-rules/blob/main/security/xxe-clojure-xml/xxe-clojure-xml.yml
category: security
technology:
- clojure
- xml
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe
shortlink: https://sg.run/v7An
semgrep.dev:
rule:
r_id: 71533
rv_id: 1262608
rule_id: bwU3Gj
version_id: WrTqKyD
url: https://semgrep.dev/playground/r/WrTqKyD/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe
origin: community
message: DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory.
Without prohibiting external entity declarations, this is vulnerable to XML external
entity attacks. Disable this by setting the feature "http://apache.org/xml/features/disallow-doctype-decl"
to true. Alternatively, allow DOCTYPE declarations and only prohibit external
entities declarations. This can be done by setting the features "http://xml.org/sax/features/external-general-entities"
and "http://xml.org/sax/features/external-parameter-entities" to false.
patterns:
- pattern-inside: |
(ns ... (:require [clojure.xml :as ...]))
...
- pattern-either:
- pattern-inside: |
(def ... ... ( ... ))
- pattern-inside: |
(defn ... ... ( ... ))
- pattern-either:
- pattern: (clojure.xml/parse $INPUT)
- patterns:
- pattern-inside: |
(doto (javax.xml.parsers.SAXParserFactory/newInstance) ...)
- pattern: (.setFeature "http://apache.org/xml/features/disallow-doctype-decl"
false)
- pattern-not-inside: |
(doto (javax.xml.parsers.SAXParserFactory/newInstance)
...
(.setFeature "http://xml.org/sax/features/external-general-entities" false)
...
(.setFeature "http://xml.org/sax/features/external-parameter-entities" false)
...)
- pattern-not-inside: |
(doto (javax.xml.parsers.SAXParserFactory/newInstance)
...
(.setFeature "http://xml.org/sax/features/external-parameter-entities" false)
...
(.setFeature "http://xml.org/sax/features/external-general-entities" false)
...)
- id: generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param
languages:
- generic
severity: ERROR
message: To remediate this issue, ensure that all URL parameters are properly escaped
before including them in scripts. Please update your code to use either the JSENCODE
method to escape URL parameters or the escape="true" attribute on <apex:outputText>
tags. Passing URL parameters directly into scripts and DOM sinks creates an opportunity
for Cross-Site Scripting attacks. Cross-Site Scripting (XSS) attacks are a type
of injection, in which malicious scripts are injected into otherwise benign and
trusted websites. To remediate this issue, ensure that all URL parameters are
properly escaped before including them in scripts.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/pages_security_tips_xss.htm
category: security
subcategory:
- vuln
technology:
- salesforce
- visualforce
cwe2022-top25: true
cwe2021-top25: true
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param
shortlink: https://sg.run/9bGk
semgrep.dev:
rule:
r_id: 72423
rv_id: 1262906
rule_id: BYUAJ2
version_id: GxTkekB
url: https://semgrep.dev/playground/r/GxTkekB/generic.visualforce.security.ncino.vf.xssfromunescapedurlparam.xss-from-unescaped-url-param
origin: community
patterns:
- pattern-either:
- pattern: <apex:outputText...escape="false"...value="{!...CurrentPage.parameters.$URL_PARAM}".../>
- pattern: <apex:outputText...value="{!...CurrentPage.parameters.$URL_PARAM}"...escape="false".../>
- pattern: <script>...'{!...CurrentPage.parameters.$URL_PARAM}'...</script>
- pattern-not: <script>...'{!...JSENCODE(...CurrentPage.parameters.$URL_PARAM})'...</script>
paths:
include:
- '*.component'
- '*.page'
- id: generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute
languages:
- generic
severity: INFO
message: Visualforce Pages must have the cspHeader attribute set to true. This attribute
is available in API version 55 or higher.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://help.salesforce.com/s/articleView?id=sf.csp_trusted_sites.htm&type=5
category: security
subcategory:
- vuln
technology:
- salesforce
- visualforce
cwe2022-top25: true
cwe2021-top25: true
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute
shortlink: https://sg.run/yoj8
semgrep.dev:
rule:
r_id: 72424
rv_id: 1262907
rule_id: DbUj7d
version_id: RGT0L0r
url: https://semgrep.dev/playground/r/RGT0L0r/generic.visualforce.security.ncino.xml.cspheaderattribute.csp-header-attribute
origin: community
patterns:
- pattern: <apex:page...>...</apex:page>
- pattern-not: <apex:page...cspHeader="true"...>...</apex:page>
- pattern-not: <apex:page...>...<!--deprecated-->...</apex:page>
- pattern-not: <apex:page...>...<!-- deprecated -->...</apex:page>
paths:
include:
- '*.page'
- id: generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version
languages:
- generic
severity: WARNING
message: Visualforce Pages must use API version 55 or higher for required use of
the cspHeader attribute set to true.
metadata:
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
references:
- https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_pages.htm
category: security
subcategory:
- vuln
technology:
- salesforce
- visualforce
cwe2022-top25: true
cwe2021-top25: true
likelihood: HIGH
impact: MEDIUM
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version
shortlink: https://sg.run/rWr6
semgrep.dev:
rule:
r_id: 72425
rv_id: 1262908
rule_id: WAUwJW
version_id: A8Tgdgn
url: https://semgrep.dev/playground/r/A8Tgdgn/generic.visualforce.security.ncino.xml.visualforceapiversion.visualforce-page-api-version
origin: community
patterns:
- pattern-inside: <apiVersion.../apiVersion>
- pattern-either:
- pattern-regex: '[>][0-9].[0-9][<]'
- pattern-regex: '[>][1-4][0-9].[0-9][<]'
- pattern-regex: '[>][5][0-4].[0-9][<]'
paths:
include:
- '*.page-meta.xml'
- id: python.lang.security.use-defused-xml-parse.use-defused-xml-parse
metadata:
owasp:
- A04:2017 - XML External Entities (XXE)
- A05:2021 - Security Misconfiguration
- A02:2025 - Security Misconfiguration
cwe:
- 'CWE-611: Improper Restriction of XML External Entity Reference'
references:
- https://docs.python.org/3/library/xml.html
- https://github.com/tiran/defusedxml
- https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
category: security
technology:
- python
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- XML Injection
source: https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse
shortlink: https://sg.run/n3jG
semgrep.dev:
rule:
r_id: 72436
rv_id: 1263541
rule_id: X5Uqnx
version_id: vdT06ER
url: https://semgrep.dev/playground/r/vdT06ER/python.lang.security.use-defused-xml-parse.use-defused-xml-parse
origin: community
message: The native Python `xml` library is vulnerable to XML External Entity (XXE)
attacks. These attacks can leak confidential data and "XML bombs" can cause denial
of service. Do not use this library to parse untrusted input. Instead the Python
documentation recommends using `defusedxml`.
languages:
- python
severity: ERROR
patterns:
- pattern: xml.etree.ElementTree.parse($...ARGS)
- pattern-not: xml.etree.ElementTree.parse("...")
fix: defusedxml.etree.ElementTree.parse($...ARGS)
- id: php.lang.security.tainted-exec.tainted-exec
mode: taint
pattern-sources:
- pattern: $_REQUEST
- pattern: $_GET
- pattern: $_POST
- pattern: $_COOKIE
pattern-sinks:
- pattern: exec(...)
- pattern: system(...)
- pattern: popen(...)
- pattern: passthru(...)
- pattern: shell_exec(...)
- pattern: pcntl_exec(...)
- pattern: proc_open(...)
pattern-sanitizers:
- pattern: escapeshellarg(...)
message: Executing non-constant commands. This can lead to command injection. You
should use `escapeshellarg()` when using command.
metadata:
cwe:
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
references:
- https://www.stackhawk.com/blog/php-command-injection/
- https://brightsec.com/blog/code-injection-php/
- https://www.acunetix.com/websitesecurity/php-security-2/
category: security
technology:
- php
owasp:
- A03:2021 - Injection
- A05:2025 - Injection
cwe2022-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Code Injection
source: https://semgrep.dev/r/php.lang.security.tainted-exec.tainted-exec
shortlink: https://sg.run/JAkP
semgrep.dev:
rule:
r_id: 73146
rv_id: 1263300
rule_id: 9AUw06
version_id: BjTkZ4y
url: https://semgrep.dev/playground/r/BjTkZ4y/php.lang.security.tainted-exec.tainted-exec
origin: community
languages:
- php
severity: ERROR
- id: php.lang.security.injection.tainted-session.tainted-session
severity: WARNING
message: Session key based on user input risks session poisoning. The user can determine
the key used for the session, and thus write any session variable. Session variables
are typically trusted to be set only by the application, and manipulating the
session can result in access control issues.
metadata:
technology:
- php
category: security
cwe:
- 'CWE-284: Improper Access Control'
owasp:
- A01:2021 - Broken Access Control
- A01:2025 - Broken Access Control
references:
- https://en.wikipedia.org/wiki/Session_poisoning
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
impact: MEDIUM
likelihood: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Improper Authorization
source: https://semgrep.dev/r/php.lang.security.injection.tainted-session.tainted-session
shortlink: https://sg.run/bxNp
semgrep.dev:
rule:
r_id: 73470
rv_id: 1263289
rule_id: 4bUdoP
version_id: 8KT5rPE
url: https://semgrep.dev/playground/r/8KT5rPE/php.lang.security.injection.tainted-session.tainted-session
origin: community
languages:
- php
mode: taint
pattern-sources:
- patterns:
- pattern-either:
- pattern: $_GET
- pattern: $_POST
- pattern: $_COOKIE
- pattern: $_REQUEST
pattern-sanitizers:
- patterns:
- pattern-either:
- pattern: $A . $B
- pattern: bin2hex(...)
- pattern: crc32(...)
- pattern: crypt(...)
- pattern: filter_input(...)
- pattern: filter_var(...)
- pattern: hash(...)
- pattern: md5(...)
- pattern: preg_filter(...)
- pattern: preg_grep(...)
- pattern: preg_match_all(...)
- pattern: sha1(...)
- pattern: sprintf(...)
- pattern: str_contains(...)
- pattern: str_ends_with(...)
- pattern: str_starts_with(...)
- pattern: strcasecmp(...)
- pattern: strchr(...)
- pattern: stripos(...)
- pattern: stristr(...)
- pattern: strnatcasecmp(...)
- pattern: strnatcmp(...)
- pattern: strncmp(...)
- pattern: strpbrk(...)
- pattern: strpos(...)
- pattern: strripos(...)
- pattern: strrpos(...)
- pattern: strspn(...)
- pattern: strstr(...)
- pattern: strtok(...)
- pattern: substr_compare(...)
- pattern: substr_count(...)
- pattern: vsprintf(...)
pattern-sinks:
- patterns:
- pattern-inside: $_SESSION[$KEY] = $VAL;
- pattern: $KEY
- id: php.lang.security.injection.printed-request.printed-request
mode: taint
message: '`Printing user input risks cross-site scripting vulnerability. You should
use `htmlentities()` when showing data to users.'
languages:
- php
severity: ERROR
pattern-sources:
- pattern: $_REQUEST
- pattern: $_GET
- pattern: $_POST
pattern-sinks:
- pattern: print($...VARS);
pattern-sanitizers:
- pattern: htmlentities(...)
- pattern: htmlspecialchars(...)
- pattern: strip_tags(...)
- pattern: isset(...)
- pattern: empty(...)
- pattern: esc_html(...)
- pattern: esc_attr(...)
- pattern: wp_kses(...)
- pattern: e(...)
- pattern: twig_escape_filter(...)
- pattern: xss_clean(...)
- pattern: html_escape(...)
- pattern: Html::escape(...)
- pattern: Xss::filter(...)
- pattern: escapeHtml(...)
- pattern: escapeHtml(...)
- pattern: escapeHtmlAttr(...)
fix: print(htmlentities($...VARS));
metadata:
technology:
- php
cwe:
- 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
Scripting'')'
owasp:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection
- A05:2025 - Injection
category: security
references:
- https://www.php.net/manual/en/function.htmlentities.php
- https://www.php.net/manual/en/reserved.variables.request.php
- https://www.php.net/manual/en/reserved.variables.post.php
- https://www.php.net/manual/en/reserved.variables.get.php
- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Cross-Site-Scripting (XSS)
source: https://semgrep.dev/r/php.lang.security.injection.printed-request.printed-request
shortlink: https://sg.run/QrxEJ
semgrep.dev:
rule:
r_id: 128886
rv_id: 1263284
rule_id: KxUvRBw
version_id: ZRTKAk4
url: https://semgrep.dev/playground/r/ZRTKAk4/php.lang.security.injection.printed-request.printed-request
origin: community
- id: kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded
message: A secret is hard-coded in the application. Secrets stored in source code,
such as credentials, identifiers, and other types of sensitive data, can be leaked
and used by internal or external malicious actors. It is recommended to rotate
the secret and retrieve them from a secure secret vault or Hardware Security Module
(HSM), alternatively environment variables can be used if allowed by your company
policy.
severity: WARNING
metadata:
likelihood: LOW
impact: HIGH
confidence: MEDIUM
category: security
subcategory:
- vuln
cwe:
- 'CWE-798: Use of Hard-coded Credentials'
cwe2020-top25: true
cwe2021-top25: true
cwe2022-top25: true
owasp:
- A07:2021 - Identification and Authentication Failures
- A07:2025 - Authentication Failures
references:
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
technology:
- secrets
vulnerability_class:
- Hard-coded Secrets
source_rule_url: https://semgrep.dev/playground/r/d8Ur5BA/achufistov6_personal_org.build-gradle-password-hardcoded
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
source: https://semgrep.dev/r/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded
shortlink: https://sg.run/qN29x
semgrep.dev:
rule:
r_id: 137856
rv_id: 1263257
rule_id: ReUD6Kg
version_id: DkTRbLX
url: https://semgrep.dev/playground/r/DkTRbLX/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded
origin: community
languages:
- kotlin
options:
symbolic_propagation: true
patterns:
- pattern-either:
- pattern: '$PASS = env[...] ?: $VALUE'
- metavariable-regex:
metavariable: $PASS
regex: (password|pass|passwd|loginPassword)
- metavariable-pattern:
language: generic
metavariable: $VALUE
patterns:
- pattern-either:
- pattern-regex: ^[A-Za-z0-9/+=]+$
paths:
include:
- '*build.gradle.kts'
- id: yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor
languages:
- yaml
message: The Shai-hulud backdoor creates a purposefully vulnerable github action
with the name `discussion.yaml`.
paths:
include:
- '**/.github/workflows/discussion.yaml'
metadata:
category: security
cwe:
- 'CWE-509: Replicating Malicious Code (Virus or Worm)'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
technology:
- github-actions
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source_rule_url: https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
references:
- https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
source: https://semgrep.dev/r/yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor
shortlink: https://sg.run/JdYPZ
semgrep.dev:
rule:
r_id: 238946
rv_id: 1263927
rule_id: 7KUDRPj
version_id: 6xT29ol
url: https://semgrep.dev/playground/r/6xT29ol/yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor
origin: community
patterns:
- pattern-inside: 'steps: [...]'
- pattern-inside: |
- run: ...
...
- pattern: 'run: $SHELL'
- metavariable-pattern:
language: generic
metavariable: $SHELL
patterns:
- pattern-either:
- pattern: ${{ github.event.issue.title }}
- pattern: ${{ github.event.issue.body }}
- pattern: ${{ github.event.pull_request.title }}
- pattern: ${{ github.event.pull_request.body }}
- pattern: ${{ github.event.comment.body }}
- pattern: ${{ github.event.review.body }}
- pattern: ${{ github.event.review_comment.body }}
- pattern: ${{ github.event.pages. ... .page_name}}
- pattern: ${{ github.event.head_commit.message }}
- pattern: ${{ github.event.head_commit.author.email }}
- pattern: ${{ github.event.head_commit.author.name }}
- pattern: ${{ github.event.commits ... .author.email }}
- pattern: ${{ github.event.commits ... .author.name }}
- pattern: ${{ github.event.pull_request.head.ref }}
- pattern: ${{ github.event.pull_request.head.label }}
- pattern: ${{ github.event.pull_request.head.repo.default_branch }}
- pattern: ${{ github.head_ref }}
- pattern: ${{ github.event.inputs ... }}
- pattern: ${{ github.event.discussion.title }}
- pattern: ${{ github.event.discussion.body }}
- pattern: ${{ inputs ... }}
severity: ERROR
- id: yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell
languages:
- yaml
message: "A `run:` step pipes the output of `curl` or `wget` directly into a shell
interpreter. This is the \"curl | bash\" install pattern \u2014 if the remote
server is compromised or the URL is hijacked, an attacker can execute arbitrary
code in your CI runner. Consider downloading the file first, verifying its checksum
or signature, and then executing it."
metadata:
category: security
cwe:
- 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS
Command Injection'')'
owasp:
- A03:2021 - Injection
- A03:2025 - Injection
references:
- https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
- https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/
technology:
- github-actions
- bash
- curl
cwe2021-top25: true
cwe2022-top25: true
subcategory:
- vuln
likelihood: MEDIUM
impact: HIGH
confidence: HIGH
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- Command Injection
source: https://semgrep.dev/r/yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell
shortlink: https://sg.run/GR8K1
semgrep.dev:
rule:
r_id: 309392
rv_id: 1443456
rule_id: x8UAgrE
version_id: 9lT3zYb
url: https://semgrep.dev/playground/r/9lT3zYb/yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell
origin: community
patterns:
- pattern-inside: 'steps: [...]'
- pattern-inside: |
- run: ...
...
- pattern: 'run: $SHELL'
- metavariable-pattern:
language: bash
metavariable: $SHELL
patterns:
- pattern-either:
- pattern: curl ... | $CMD ...
- pattern: wget ... | $CMD ...
- metavariable-regex:
metavariable: $CMD
regex: ^(bash|sh|python3?|ruby|perl)$
severity: ERROR
- id: scala.play.security.tainted-slick-sqli.tainted-slick-sqli
mode: taint
metadata:
references:
- https://scala-slick.org/doc/3.3.3/sql.html#splicing-literal-values
- https://scala-slick.org/doc/3.2.0/sql-to-slick.html#non-optimal-sql-code
category: security
cwe:
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
(''SQL Injection'')'
owasp:
- A01:2017 - Injection
- A03:2021 - Injection
- A05:2025 - Injection
technology:
- scala
- slick
- play
confidence: HIGH
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: HIGH
impact: MEDIUM
license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
vulnerability_class:
- SQL Injection
source: https://semgrep.dev/r/scala.play.security.tainted-slick-sqli.tainted-slick-sqli
shortlink: https://sg.run/k9K2
semgrep.dev:
rule:
r_id: 18328
rv_id: 1263687
rule_id: GdUDWO
version_id: d6TyxJe
url: https://semgrep.dev/playground/r/d6TyxJe/scala.play.security.tainted-slick-sqli.tainted-slick-sqli
origin: community
message: Detected a tainted SQL statement. This could lead to SQL injection if variables
in the SQL statement are not properly sanitized. Avoid using using user input
for generating SQL strings.
pattern-sources:
- patterns:
- pattern-either:
- patterns:
- pattern: $REQ
- pattern-either:
- pattern-inside: "Action {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action(...) {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action.async {\n $REQ: Request[$T] => \n ...\n}\n"
- pattern-inside: "Action.async(...) {\n $REQ: Request[$T] => \n ...\n}\n"
- patterns:
- pattern: $PARAM
- pattern-either:
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action(...) {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action.async {
...
}
- pattern-inside: |
def $CTRL(..., $PARAM: $TYPE, ...) = Action.async(...) {
...
}
pattern-sinks:
- patterns:
- pattern-either:
- pattern: $MODEL.overrideSql(...)
- pattern: sql"..."
- pattern-inside: |
import slick.$DEPS
...
severity: ERROR
languages:
- scala
Reference in New Issue View Git Blame Copy Permalink