trapline 0.1.0

data/lib/trapline/templates/cwe/cwe-79.yml

@@ -0,0 +1,164 @@
+cwe: CWE-79
+name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+title: Cross-site scripting (XSS)
+owasp: ["A03:2021 - Injection"]
+keywords: ["cross-site scripting", "xss", "inject arbitrary web script", "html injection"]
+message: >-
+  Untrusted input is written to an HTML response without escaping, which can
+  lead to cross-site scripting. Escape the value or use the framework's
+  auto-escaping templates.
+languages:
+  ruby:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: params
+        - pattern: cookies
+      pattern-sanitizers:
+        - pattern: ERB::Util.html_escape(...)
+        - pattern: CGI.escapeHTML(...)
+        - pattern: sanitize(...)
+        - pattern: $H.sanitize(...)
+        - pattern: h(...)
+      pattern-sinks:
+        - patterns:
+            - pattern-either:
+                - pattern: $X.html_safe
+                - pattern: raw($X)
+                - pattern: $H.raw($X)
+                - pattern: "render(..., inline: $X, ...)"
+            - focus-metavariable: $X
+    test: |
+      class SearchController < ApplicationController
+        def show
+          # ruleid: __RULE_ID__
+          render html: "<h1>#{params[:q]}</h1>".html_safe
+          # ruleid: __RULE_ID__
+          render inline: "<p>#{params[:q]}</p>"
+          # ok: __RULE_ID__
+          render html: "<h1>#{ERB::Util.html_escape(params[:q])}</h1>".html_safe
+        end
+      end
+  python:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: flask.request.$ANY
+      pattern-sanitizers:
+        - pattern: markupsafe.escape(...)
+        - pattern: flask.escape(...)
+        - pattern: html.escape(...)
+      pattern-sinks:
+        - pattern: flask.make_response(...)
+        - pattern: flask.Response(...)
+        - pattern: markupsafe.Markup(...)
+        - pattern: flask.render_template_string(...)
+    test: |
+      from flask import request, make_response
+      from markupsafe import escape
+
+      def hello():
+          name = request.args.get("name")
+          # ruleid: __RULE_ID__
+          return make_response("<h1>Hello " + name + "</h1>")
+
+      def hello_safe():
+          name = request.args.get("name")
+          # ok: __RULE_ID__
+          return make_response("<h1>Hello " + escape(name) + "</h1>")
+  javascript:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: $REQ.query
+        - pattern: $REQ.body
+        - pattern: $REQ.params
+        - pattern: location.hash
+        - pattern: location.search
+      pattern-sanitizers:
+        - pattern: escapeHtml(...)
+        - pattern: $L.escape(...)
+        - pattern: DOMPurify.sanitize(...)
+        - pattern: encodeURIComponent(...)
+      pattern-sinks:
+        - pattern: $RES.send(...)
+        - pattern: $RES.write(...)
+        - pattern: document.write(...)
+        - patterns:
+            - pattern-either:
+                - pattern: $EL.innerHTML = $X
+                - pattern: $EL.outerHTML = $X
+                - pattern: $EL.insertAdjacentHTML($POS, $X)
+            - focus-metavariable: $X
+    test: |
+      app.get("/hello", (req, res) => {
+        // ruleid: __RULE_ID__
+        res.send("<h1>Hello " + req.query.name + "</h1>");
+        // ok: __RULE_ID__
+        res.send("<h1>Hello " + escapeHtml(req.query.name) + "</h1>");
+      });
+
+      function render() {
+        // ruleid: __RULE_ID__
+        document.getElementById("out").innerHTML = location.hash.slice(1);
+        // ok: __RULE_ID__
+        document.getElementById("out").textContent = location.hash.slice(1);
+      }
+  java:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: (javax.servlet.http.HttpServletRequest $REQ).$GET(...)
+        - pattern: (jakarta.servlet.http.HttpServletRequest $REQ).$GET(...)
+      pattern-sanitizers:
+        - pattern: Encode.$FOR(...)
+        - pattern: StringEscapeUtils.escapeHtml4(...)
+        - pattern: HtmlUtils.htmlEscape(...)
+      pattern-sinks:
+        - pattern: $RESP.getWriter().$WRITE(...)
+        - pattern: (java.io.PrintWriter $W).$WRITE(...)
+    test: |
+      import javax.servlet.http.HttpServletRequest;
+      import javax.servlet.http.HttpServletResponse;
+      import org.owasp.encoder.Encode;
+
+      public class HelloServlet {
+          public void doGet(HttpServletRequest request, HttpServletResponse response) throws Exception {
+              String name = request.getParameter("name");
+              // ruleid: __RULE_ID__
+              response.getWriter().write("<h1>Hello " + name + "</h1>");
+              // ok: __RULE_ID__
+              response.getWriter().write("<h1>Hello " + Encode.forHtml(name) + "</h1>");
+          }
+      }
+  go:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: '($R : *http.Request).URL.Query().Get(...)'
+        - pattern: '($R : *http.Request).FormValue(...)'
+      pattern-sanitizers:
+        - pattern: html.EscapeString(...)
+        - pattern: template.HTMLEscapeString(...)
+      pattern-sinks:
+        - pattern: template.HTML(...)
+        - pattern: '($W : http.ResponseWriter).Write(...)'
+        - pattern: 'fmt.Fprintf(($W : http.ResponseWriter), ...)'
+        - pattern: 'fmt.Fprint(($W : http.ResponseWriter), ...)'
+        - pattern: 'io.WriteString(($W : http.ResponseWriter), ...)'
+    test: |
+      package main
+
+      import (
+      	"fmt"
+      	"html"
+      	"net/http"
+      )
+
+      func hello(w http.ResponseWriter, r *http.Request) {
+      	name := r.URL.Query().Get("name")
+      	// ruleid: __RULE_ID__
+      	fmt.Fprintf(w, "<h1>Hello %s</h1>", name)
+      	// ok: __RULE_ID__
+      	fmt.Fprintf(w, "<h1>Hello %s</h1>", html.EscapeString(name))
+      }

data/lib/trapline/templates/cwe/cwe-798.yml

@@ -0,0 +1,125 @@
+cwe: CWE-798
+name: "Use of Hard-coded Credentials"
+title: Hard-coded credentials
+owasp: ["A07:2021 - Identification and Authentication Failures"]
+keywords: ["hard-coded", "hardcoded", "hard coded", "default password", "default credentials", "embedded credentials"]
+message: >-
+  A credential appears to be hard-coded in the source. Load secrets from the
+  environment or a secrets manager.
+languages:
+  ruby:
+    rule: |
+      patterns:
+        - pattern-either:
+            - pattern: $KEY = "$VALUE"
+            - pattern: '{..., $KEY: "$VALUE", ...}'
+            - pattern: '$FN(..., $KEY: "$VALUE", ...)'
+        - metavariable-regex:
+            metavariable: $KEY
+            regex: (?i).*(passw(or)?d|secret|api_?key|access_?key|auth_?token|private_?key)
+        - metavariable-regex:
+            metavariable: $VALUE
+            regex: .{6,}
+    test: |
+      # ruleid: __RULE_ID__
+      password = "SuperSecret123"
+      # ruleid: __RULE_ID__
+      client = Client.new(api_key: "sk_live_1234567890")
+      # ok: __RULE_ID__
+      password = ENV.fetch("DB_PASSWORD")
+      # ok: __RULE_ID__
+      password = ""
+  python:
+    rule: |
+      patterns:
+        - pattern-either:
+            - pattern: $KEY = "$VALUE"
+            - pattern: $FN(..., $KEY="$VALUE", ...)
+        - metavariable-regex:
+            metavariable: $KEY
+            regex: (?i).*(passw(or)?d|secret|api_?key|access_?key|auth_?token|private_?key)
+        - metavariable-regex:
+            metavariable: $VALUE
+            regex: .{6,}
+    test: |
+      import os
+
+      # ruleid: __RULE_ID__
+      DB_PASSWORD = "SuperSecret123"
+      # ruleid: __RULE_ID__
+      client = Client(api_key="sk_live_1234567890")
+      # ok: __RULE_ID__
+      DB_PASSWORD = os.environ["DB_PASSWORD"]
+  javascript:
+    rule: |
+      patterns:
+        - pattern-either:
+            - pattern: $KEY = "$VALUE"
+            - pattern: '{..., $KEY: "$VALUE", ...}'
+        - metavariable-regex:
+            metavariable: $KEY
+            regex: (?i).*(passw(or)?d|secret|api_?key|access_?key|auth_?token|private_?key)
+        - metavariable-regex:
+            metavariable: $VALUE
+            regex: .{6,}
+    test: |
+      // ruleid: __RULE_ID__
+      const password = "SuperSecret123";
+      // ruleid: __RULE_ID__
+      const client = new Client({ apiKey: "sk_live_1234567890" });
+      // ok: __RULE_ID__
+      const token = process.env.API_TOKEN;
+  java:
+    rule: |
+      patterns:
+        - pattern-either:
+            - pattern: $TYPE $KEY = "$VALUE";
+            - pattern: $KEY = "$VALUE";
+        - metavariable-regex:
+            metavariable: $KEY
+            regex: (?i).*(passw(or)?d|secret|api_?key|access_?key|auth_?token|private_?key)
+        - metavariable-regex:
+            metavariable: $VALUE
+            regex: .{6,}
+    test: |
+      public class Config {
+          // ruleid: __RULE_ID__
+          private static final String DB_PASSWORD = "SuperSecret123";
+          // ok: __RULE_ID__
+          private static final String DB_HOST = "db.internal";
+
+          public String password() {
+              // ok: __RULE_ID__
+              String password = System.getenv("DB_PASSWORD");
+              return password;
+          }
+      }
+  go:
+    rule: |
+      patterns:
+        - pattern-either:
+            - pattern: $KEY := "$VALUE"
+            - pattern: $KEY = "$VALUE"
+            - pattern: const $KEY = "$VALUE"
+            - pattern: var $KEY = "$VALUE"
+        - metavariable-regex:
+            metavariable: $KEY
+            regex: (?i).*(passw(or)?d|secret|api_?key|access_?key|auth_?token|private_?key)
+        - metavariable-regex:
+            metavariable: $VALUE
+            regex: .{6,}
+    test: |
+      package main
+
+      import "os"
+
+      // ruleid: __RULE_ID__
+      const apiKey = "sk_live_1234567890"
+
+      func connect() {
+      	// ruleid: __RULE_ID__
+      	password := "SuperSecret123"
+      	// ok: __RULE_ID__
+      	token := os.Getenv("API_TOKEN")
+      	_, _ = password, token
+      }

data/lib/trapline/templates/cwe/cwe-89.yml

@@ -0,0 +1,189 @@
+cwe: CWE-89
+name: "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+title: SQL injection
+owasp: ["A03:2021 - Injection"]
+keywords: ["sql injection", "sqli", "sql command"]
+message: >-
+  Untrusted input flows into a SQL query built from strings. Use parameterized
+  queries / bind parameters instead of string concatenation or interpolation.
+languages:
+  ruby:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: params
+        - pattern: cookies
+      pattern-sanitizers:
+        - pattern: $X.to_i
+        - pattern: $M.sanitize_sql(...)
+        - pattern: $M.connection.quote(...)
+      pattern-sinks:
+        - patterns:
+            - pattern-either:
+                - pattern: $M.where($Q, ...)
+                - pattern: $M.order($Q, ...)
+                - pattern: $M.group($Q, ...)
+                - pattern: $M.having($Q, ...)
+                - pattern: $M.find_by_sql($Q, ...)
+                - pattern: $M.select($Q, ...)
+                - pattern: $M.pluck($Q, ...)
+                - pattern: $M.exists?($Q, ...)
+                - pattern: $M.execute($Q, ...)
+                - pattern: $M.exec_query($Q, ...)
+            - focus-metavariable: $Q
+            - pattern-not: "{...}"
+    test: |
+      class UsersController < ApplicationController
+        def index
+          # ruleid: __RULE_ID__
+          @users = User.where("name = '#{params[:name]}'")
+          # ruleid: __RULE_ID__
+          @users = User.order(params[:sort])
+          # ok: __RULE_ID__
+          @users = User.where(name: params[:name])
+          # ok: __RULE_ID__
+          @users = User.where("name = ?", params[:name])
+          # ok: __RULE_ID__
+          @users = User.where("id = #{params[:id].to_i}")
+        end
+      end
+  python:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: flask.request.$ANY
+        - patterns:
+            - pattern-inside: |
+                def $VIEW(request, ...):
+                  ...
+            - pattern: request.$ANY
+      pattern-sanitizers:
+        - pattern: int(...)
+      pattern-sinks:
+        - patterns:
+            - pattern-either:
+                - pattern: $CUR.execute($Q, ...)
+                - pattern: $CUR.executemany($Q, ...)
+                - pattern: $M.objects.raw($Q, ...)
+                - pattern: sqlalchemy.text($Q, ...)
+            - focus-metavariable: $Q
+    test: |
+      from flask import request
+
+      def search(cursor):
+          name = request.args.get("name")
+          # ruleid: __RULE_ID__
+          cursor.execute("SELECT * FROM users WHERE name = '%s'" % name)
+          # ruleid: __RULE_ID__
+          cursor.execute(f"SELECT * FROM users WHERE name = '{name}'")
+          # ok: __RULE_ID__
+          cursor.execute("SELECT * FROM users WHERE name = %s", (name,))
+  javascript:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: $REQ.query
+        - pattern: $REQ.body
+        - pattern: $REQ.params
+      pattern-sanitizers:
+        - pattern: parseInt(...)
+        - pattern: Number(...)
+      pattern-sinks:
+        - patterns:
+            - pattern-either:
+                - pattern: $DB.query($Q, ...)
+                - pattern: $DB.execute($Q, ...)
+                - pattern: $DB.raw($Q, ...)
+                - pattern: $DB.$RAW`...`
+            - focus-metavariable: $Q
+    test: |
+      app.get("/users", (req, res) => {
+        // ruleid: __RULE_ID__
+        db.query("SELECT * FROM users WHERE name = '" + req.query.name + "'");
+        // ruleid: __RULE_ID__
+        db.query(`SELECT * FROM users WHERE id = ${req.params.id}`);
+        // ok: __RULE_ID__
+        db.query("SELECT * FROM users WHERE name = ?", [req.query.name]);
+        // ok: __RULE_ID__
+        db.query("SELECT * FROM users WHERE id = " + parseInt(req.query.id));
+      });
+  java:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: (javax.servlet.http.HttpServletRequest $REQ).$GET(...)
+        - pattern: (jakarta.servlet.http.HttpServletRequest $REQ).$GET(...)
+        - patterns:
+            - pattern-inside: |
+                $RET $METHOD(..., @RequestParam $T $P, ...) { ... }
+            - pattern: $P
+      pattern-sanitizers:
+        - pattern: Integer.parseInt(...)
+        - pattern: Long.parseLong(...)
+      pattern-sinks:
+        - patterns:
+            - pattern-either:
+                - pattern: $S.executeQuery($Q)
+                - pattern: $S.executeUpdate($Q)
+                - pattern: $S.execute($Q)
+                - pattern: $S.addBatch($Q)
+                - pattern: $C.prepareStatement($Q, ...)
+                - pattern: $EM.createQuery($Q, ...)
+                - pattern: $EM.createNativeQuery($Q, ...)
+                - pattern: $JDBC.queryForObject($Q, ...)
+                - pattern: $JDBC.queryForList($Q, ...)
+            - focus-metavariable: $Q
+    test: |
+      import javax.servlet.http.HttpServletRequest;
+      import java.sql.Connection;
+      import java.sql.PreparedStatement;
+      import java.sql.Statement;
+
+      public class UserDao {
+          public void find(HttpServletRequest request, Connection conn) throws Exception {
+              String name = request.getParameter("name");
+              Statement st = conn.createStatement();
+              // ruleid: __RULE_ID__
+              st.executeQuery("SELECT * FROM users WHERE name = '" + name + "'");
+              // ok: __RULE_ID__
+              PreparedStatement ps = conn.prepareStatement("SELECT * FROM users WHERE name = ?");
+              ps.setString(1, name);
+              ps.executeQuery();
+          }
+      }
+  go:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: '($R : *http.Request).URL.Query().Get(...)'
+        - pattern: '($R : *http.Request).FormValue(...)'
+        - pattern: '($R : *http.Request).PostFormValue(...)'
+      pattern-sanitizers:
+        - pattern: strconv.Atoi(...)
+      pattern-sinks:
+        - patterns:
+            - pattern-either:
+                - pattern: $DB.Query($Q, ...)
+                - pattern: $DB.QueryRow($Q, ...)
+                - pattern: $DB.Exec($Q, ...)
+                - pattern: $DB.QueryContext($CTX, $Q, ...)
+                - pattern: $DB.ExecContext($CTX, $Q, ...)
+            - focus-metavariable: $Q
+    test: |
+      package main
+
+      import (
+      	"database/sql"
+      	"fmt"
+      	"net/http"
+      )
+
+      func handler(db *sql.DB, r *http.Request) {
+      	name := r.URL.Query().Get("name")
+      	// ruleid: __RULE_ID__
+      	db.Query(fmt.Sprintf("SELECT * FROM users WHERE name = '%s'", name))
+      	// ruleid: __RULE_ID__
+      	db.Exec("DELETE FROM users WHERE name = '" + name + "'")
+      	// ok: __RULE_ID__
+      	db.Query("SELECT * FROM users WHERE name = $1", name)
+      }

data/lib/trapline/templates/cwe/cwe-917.yml

@@ -0,0 +1,46 @@
+cwe: CWE-917
+name: "Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')"
+title: Expression language / JNDI lookup injection
+owasp: ["A03:2021 - Injection"]
+keywords: ["expression language", "jndi", "lookup", "log4j", "log4shell", "message lookup", "el injection", "logging untrusted", "log messages"]
+message: >-
+  Untrusted input is logged with Log4j 2. On vulnerable versions (< 2.17.1)
+  message lookups such as ${jndi:...} can lead to remote code execution.
+  Upgrade Log4j and avoid logging raw request data.
+languages:
+  java:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: (javax.servlet.http.HttpServletRequest $REQ).$GET(...)
+        - pattern: (jakarta.servlet.http.HttpServletRequest $REQ).$GET(...)
+        - patterns:
+            - pattern-inside: |
+                $RET $METHOD(..., @RequestHeader $T $P, ...) { ... }
+            - pattern: $P
+        - patterns:
+            - pattern-inside: |
+                $RET $METHOD(..., @RequestParam $T $P, ...) { ... }
+            - pattern: $P
+      pattern-sinks:
+        - patterns:
+            - pattern: (org.apache.logging.log4j.Logger $LOG).$LEVEL(...)
+            - metavariable-regex:
+                metavariable: $LEVEL
+                regex: ^(trace|debug|info|warn|error|fatal|log|printf)$
+    test: |
+      import javax.servlet.http.HttpServletRequest;
+      import org.apache.logging.log4j.LogManager;
+      import org.apache.logging.log4j.Logger;
+
+      public class LoginServlet {
+          private static final Logger logger = LogManager.getLogger(LoginServlet.class);
+
+          public void doPost(HttpServletRequest request) {
+              String agent = request.getHeader("User-Agent");
+              // ruleid: __RULE_ID__
+              logger.info("Login attempt from " + agent);
+              // ok: __RULE_ID__
+              logger.info("Login attempt");
+          }
+      }

data/lib/trapline/templates/cwe/cwe-918.yml

@@ -0,0 +1,166 @@
+cwe: CWE-918
+name: "Server-Side Request Forgery (SSRF)"
+title: Server-side request forgery (SSRF)
+owasp: ["A10:2021 - Server-Side Request Forgery (SSRF)"]
+keywords: ["server-side request forgery", "ssrf", "internal network", "arbitrary url", "arbitrary requests"]
+message: >-
+  An outbound HTTP request is made to a URL controlled by the user (SSRF).
+  Validate the destination against an allowlist of hosts and block internal
+  addresses.
+languages:
+  ruby:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: params
+        - pattern: cookies
+      pattern-sinks:
+        - patterns:
+            - pattern-either:
+                - pattern: Net::HTTP.get($U, ...)
+                - pattern: Net::HTTP.get_response($U, ...)
+                - pattern: Net::HTTP.start($U, ...)
+                - pattern: Net::HTTP.new($U, ...)
+                - pattern: URI.open($U, ...)
+                - pattern: open($U, ...)
+                - pattern: HTTParty.$VERB($U, ...)
+                - pattern: Faraday.$VERB($U, ...)
+                - pattern: Faraday.new($U, ...)
+                - pattern: RestClient.$VERB($U, ...)
+                - pattern: HTTP.$VERB($U, ...)
+            - focus-metavariable: $U
+    test: |
+      require "net/http"
+
+      class PreviewController < ApplicationController
+        def show
+          # ruleid: __RULE_ID__
+          body = Net::HTTP.get(URI(params[:url]))
+          # ruleid: __RULE_ID__
+          resp = HTTParty.get(params[:url])
+          # ok: __RULE_ID__
+          resp = HTTParty.get("https://api.example.com/items", query: { q: params[:q] })
+        end
+      end
+  python:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: flask.request.$ANY
+        - patterns:
+            - pattern-inside: |
+                def $VIEW(request, ...):
+                  ...
+            - pattern: request.$ANY
+      pattern-sinks:
+        - patterns:
+            - pattern-either:
+                - pattern: requests.$VERB($U, ...)
+                - pattern: requests.request($M, $U, ...)
+                - pattern: httpx.$VERB($U, ...)
+                - pattern: urllib.request.urlopen($U, ...)
+                - pattern: urllib.request.Request($U, ...)
+            - focus-metavariable: $U
+    test: |
+      import requests
+      from flask import request
+
+      def preview():
+          url = request.args.get("url")
+          # ruleid: __RULE_ID__
+          r = requests.get(url, timeout=5)
+          # ok: __RULE_ID__
+          r = requests.get("https://api.example.com/items", params={"q": url}, timeout=5)
+  javascript:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: $REQ.query
+        - pattern: $REQ.body
+        - pattern: $REQ.params
+      pattern-sinks:
+        - patterns:
+            - pattern-either:
+                - pattern: axios($U, ...)
+                - pattern: axios.$VERB($U, ...)
+                - pattern: fetch($U, ...)
+                - pattern: got($U, ...)
+                - pattern: got.$VERB($U, ...)
+                - pattern: http.get($U, ...)
+                - pattern: https.get($U, ...)
+                - pattern: http.request($U, ...)
+                - pattern: https.request($U, ...)
+            - focus-metavariable: $U
+    test: |
+      const axios = require("axios");
+
+      app.get("/preview", async (req, res) => {
+        // ruleid: __RULE_ID__
+        const r = await axios.get(req.query.url);
+        // ok: __RULE_ID__
+        const s = await axios.get("https://api.example.com/items", { params: { q: req.query.q } });
+        res.send(r.data + s.data);
+      });
+  java:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: (javax.servlet.http.HttpServletRequest $REQ).$GET(...)
+        - pattern: (jakarta.servlet.http.HttpServletRequest $REQ).$GET(...)
+        - patterns:
+            - pattern-inside: |
+                $RET $METHOD(..., @RequestParam $T $P, ...) { ... }
+            - pattern: $P
+      pattern-sinks:
+        - pattern: new URL(...)
+        - pattern: URI.create(...)
+        - pattern: new URI(...)
+        - patterns:
+            - pattern-either:
+                - pattern: (RestTemplate $R).$METHOD($U, ...)
+                - pattern: (WebClient $W).get().uri($U, ...)
+            - focus-metavariable: $U
+    test: |
+      import javax.servlet.http.HttpServletRequest;
+      import java.net.URL;
+      import java.io.InputStream;
+
+      public class PreviewServlet {
+          public void doGet(HttpServletRequest request) throws Exception {
+              String target = request.getParameter("url");
+              // ruleid: __RULE_ID__
+              InputStream in = new URL(target).openStream();
+              // ok: __RULE_ID__
+              InputStream fixed = new URL("https://api.example.com/items").openStream();
+          }
+      }
+  go:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: '($R : *http.Request).URL.Query().Get(...)'
+        - pattern: '($R : *http.Request).FormValue(...)'
+      pattern-sinks:
+        - patterns:
+            - pattern-either:
+                - pattern: http.Get($U)
+                - pattern: http.Head($U)
+                - pattern: http.Post($U, ...)
+                - pattern: http.PostForm($U, ...)
+                - pattern: http.NewRequest($M, $U, ...)
+                - pattern: http.NewRequestWithContext($CTX, $M, $U, ...)
+            - focus-metavariable: $U
+    test: |
+      package main
+
+      import "net/http"
+
+      func preview(w http.ResponseWriter, r *http.Request) {
+      	target := r.URL.Query().Get("url")
+      	// ruleid: __RULE_ID__
+      	resp, _ := http.Get(target)
+      	// ok: __RULE_ID__
+      	fixed, _ := http.Get("https://api.example.com/items?q=" + "static")
+      	_ = resp
+      	_ = fixed
+      }