@zhuma4/cli 4.0.0-alpha.1

package/rules/semgrep-registry/command-injection-process-builder.yaml

@@ -0,0 +1,148 @@
+rules:
+- id: command-injection-process-builder
+  pattern-either:
+  - patterns:
+    - pattern: |
+        new ProcessBuilder($CMD,...)
+    - pattern-not-inside: |
+        $CMD = "...";
+        ...
+    - pattern-not-inside: |
+        $CMD = Arrays.asList("...",...);
+        ...
+    - pattern-not-inside: |
+        $CMD = new String[]{"...",...};
+        ...
+    - pattern-not: |
+        new ProcessBuilder("...",...)
+    - pattern-not: |
+        new ProcessBuilder(new String[]{"...",...},...)
+    - pattern-not: |
+        new ProcessBuilder(Arrays.asList("...",...),...)
+  - patterns:
+    - pattern: |
+        $PB.command($CMD,...)
+    - pattern-inside: |
+        $TYPE $PB = new ProcessBuilder(...);
+        ...
+    - pattern-not-inside: |
+        $CMD = "...";
+        ...
+    - pattern-not-inside: |
+        $CMD = Arrays.asList("...",...);
+        ...
+    - pattern-not-inside: |
+        $CMD = new String[]{"...",...};
+        ...
+    - pattern-not: |
+        $PB.command("...",...)
+    - pattern-not: |
+        $PB.command(new String[]{"...",...},...)
+    - pattern-not: |
+        $PB.command(Arrays.asList("...",...),...)
+  - patterns:
+    - pattern-either:
+      - pattern: |
+          new ProcessBuilder("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$ARG,...)
+      - pattern: |
+          new ProcessBuilder("cmd","/c",$ARG,...)
+      - pattern: |
+          new ProcessBuilder(Arrays.asList("cmd","/c",$ARG,...),...)
+      - pattern: |
+          new ProcessBuilder(new String[]{"cmd","/c",$ARG,...},...)
+      - patterns:
+        - pattern-either:
+          - pattern: |
+              new ProcessBuilder($CMD,"/c",$ARG,...)
+          - pattern: |
+              new ProcessBuilder(Arrays.asList($CMD,"/c",$ARG,...),...)
+          - pattern: |
+              new ProcessBuilder(new String[]{$CMD,"/c",$ARG,...},...)
+        - pattern-inside: |
+            $CMD = "cmd";
+            ...
+    - pattern-not-inside: |
+        $ARG = "...";
+        ...
+    - pattern-not: |
+        new ProcessBuilder("...","...","...",...)
+    - pattern-not: |
+        new ProcessBuilder(new String[]{"...","...","...",...},...)
+    - pattern-not: |
+        new ProcessBuilder(Arrays.asList("...","...","...",...),...)
+  - patterns:
+    - pattern-either:
+      - pattern: |
+          $PB.command("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$ARG,...)
+      - pattern: |
+          $PB.command("cmd","/c",$ARG,...)
+      - pattern: |
+          $PB.command(Arrays.asList("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$ARG,...),...)
+      - pattern: |
+          $PB.command(Arrays.asList("cmd","/c",$ARG,...),...)
+      - pattern: |
+          $PB.command(new String[]{"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$ARG,...},...)
+      - pattern: |
+          $PB.command(new String[]{"cmd","/c",$ARG,...},...)
+      - patterns:
+        - pattern-either:
+          - pattern: |
+              $PB.command($CMD,"-c",$ARG,...)
+          - pattern: |
+              $PB.command(Arrays.asList($CMD,"-c",$ARG,...),...)
+          - pattern: |
+              $PB.command(new String[]{$CMD,"-c",$ARG,...},...)
+        - pattern-inside: |
+            $CMD = "=~/(sh|bash|ksh|csh|tcsh|zsh)/";
+            ...
+      - patterns:
+        - pattern-either:
+          - pattern: |
+              $PB.command($CMD,"/c",$ARG,...)
+          - pattern: |
+              $PB.command(Arrays.asList($CMD,"/c",$ARG,...),...)
+          - pattern: |
+              $PB.command(new String[]{$CMD,"/c",$ARG,...},...)
+        - pattern-inside: |
+            $CMD = "cmd";
+            ...
+    - pattern-inside: |
+        $TYPE $PB = new ProcessBuilder(...);
+        ...
+    - pattern-not-inside: |
+        $ARG = "...";
+        ...
+    - pattern-not: |
+        $PB.command("...","...","...",...)
+    - pattern-not: |
+        $PB.command(new String[]{"...","...","...",...},...)
+    - pattern-not: |
+        $PB.command(Arrays.asList("...","...","...",...),...)
+  message: >-
+    A formatted or concatenated string was detected as input to a ProcessBuilder call.
+    This is dangerous if a variable is controlled by user input and could result in
+    a
+    command injection. Ensure your variables are not controlled by users or sufficiently
+    sanitized.
+  metadata:
+    cwe:
+    - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
+    owasp:
+    - A01:2017 - Injection
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    category: security
+    technology:
+    - java
+    references:
+    - https://owasp.org/Top10/A03_2021-Injection
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: HIGH
+    confidence: LOW
+  severity: ERROR
+  languages:
+  - java

package/rules/semgrep-registry/cookie-missing-httponly.yaml

@@ -0,0 +1,38 @@
+rules:
+- id: cookie-missing-httponly
+  metadata:
+    cwe:
+    - "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag"
+    owasp:
+    - A05:2021 - Security Misconfiguration
+    - A02:2025 - Security Misconfiguration
+    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#HTTPONLY_COOKIE
+    asvs:
+      section: 'V3: Session Management Verification Requirements'
+      control_id: 3.4.2 Missing Cookie Attribute
+      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v34-cookie-based-session-management
+      version: '4'
+    category: security
+    technology:
+    - java
+    references:
+    - https://owasp.org/Top10/A05_2021-Security_Misconfiguration
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: LOW
+    confidence: LOW
+  message: >-
+    A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag
+    for cookies instructs the browser to forbid client-side scripts from reading the
+    cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'
+  severity: WARNING
+  languages: [java]
+  patterns:
+  - pattern-not-inside: $COOKIE.setValue(""); ...
+  - pattern-either:
+    - pattern: $COOKIE.setHttpOnly(false);
+    - patterns:
+      - pattern-not-inside: $COOKIE.setHttpOnly(...); ...
+      - pattern-not-inside: $COOKIE = ResponseCookie.from(...). ...; ...
+      - pattern: $RESPONSE.addCookie($COOKIE);

package/rules/semgrep-registry/cookie-missing-secure-flag.yaml

@@ -0,0 +1,38 @@
+rules:
+- id: cookie-missing-secure-flag
+  metadata:
+    cwe:
+    - "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"
+    owasp:
+    - A05:2021 - Security Misconfiguration
+    - A02:2025 - Security Misconfiguration
+    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#INSECURE_COOKIE
+    asvs:
+      section: 'V3: Session Management Verification Requirements'
+      control_id: 3.4.1 Missing Cookie Attribute
+      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v34-cookie-based-session-management
+      version: '4'
+    category: security
+    technology:
+    - java
+    references:
+    - https://owasp.org/Top10/A05_2021-Security_Misconfiguration
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: LOW
+    confidence: LOW
+  message: >-
+    A cookie was detected without setting the 'secure' flag. The 'secure' flag
+    for cookies prevents the client from transmitting the cookie over insecure
+    channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'
+  severity: WARNING
+  languages: [java]
+  patterns:
+  - pattern-not-inside: $COOKIE.setValue(""); ...
+  - pattern-either:
+    - pattern: $COOKIE.setSecure(false);
+    - patterns:
+      - pattern-not-inside: $COOKIE.setSecure(...); ...
+      - pattern-not-inside: $COOKIE = ResponseCookie.from(...). ...; ...
+      - pattern: $RESPONSE.addCookie($COOKIE);

package/rules/semgrep-registry/crlf-injection-logs.yaml

@@ -0,0 +1,86 @@
+rules:
+- id: crlf-injection-logs
+  message: >-
+    When data from an untrusted source is put into a logger and not neutralized correctly,
+    an attacker could forge log entries or include malicious content.
+  metadata:
+    cwe:
+    - "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')"
+    owasp:
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#CRLF_INJECTION_LOGS
+    category: security
+    technology:
+    - java
+    references:
+    - https://owasp.org/Top10/A03_2021-Injection
+    subcategory:
+    - vuln
+    likelihood: LOW
+    impact: MEDIUM
+    confidence: MEDIUM
+  severity: WARNING
+  languages: [java]
+  patterns:
+      # Enumerate possible enclosing scopes that define request and logger
+  - pattern-either:
+          # Logger is defined as a field on a class
+    - patterns:
+      - pattern-inside: |
+          class $CLASS {
+            ...
+            Logger $LOG = ...;
+            ...
+          }
+      - pattern-either:
+        - pattern-inside: |
+            $X $METHOD(...,HttpServletRequest $REQ,...) {
+              ...
+            }
+        - pattern-inside: |
+            $X $METHOD(...,ServletRequest $REQ,...) {
+              ...
+            }
+        - pattern-inside: |
+            $X $METHOD(...) {
+              ...
+              HttpServletRequest $REQ = ...;
+              ...
+            }
+        - pattern-inside: |
+            $X $METHOD(...) {
+              ...
+              ServletRequest $REQ = ...;
+              ...
+            }
+    - pattern-inside: |
+        $X $METHOD(...) {
+          ...
+          Logger $LOG = ...;
+          ...
+          HttpServletRequest $REQ = ...;
+          ...
+        }
+    - pattern-inside: |
+        $X $METHOD(...) {
+          ...
+          Logger $LOG = ...;
+          ...
+          ServletRequest $REQ = ...;
+          ...
+        }
+  - pattern-either:
+          # Enumerate possible injection sites
+    - pattern: |
+        String $VAL = $REQ.getParameter(...);
+        ...
+        $LOG.$LEVEL(<... $VAL ...>);
+    - pattern: |
+        String $VAL = $REQ.getParameter(...);
+        ...
+        $LOG.log($LEVEL,<... $VAL ...>);
+    - pattern: |
+        $LOG.$LEVEL(<... $REQ.getParameter(...) ...>);
+    - pattern: |
+        $LOG.log($LEVEL,<... $REQ.getParameter(...) ...>);

package/rules/semgrep-registry/dangerous-groovy-shell.yaml

@@ -0,0 +1,46 @@
+rules:
+- id: dangerous-groovy-shell
+  patterns:
+  - pattern-either:
+    - pattern: |
+        $SHELL.parse(...)
+    - pattern: |
+        $SHELL.evaluate(...)
+    - pattern: |
+        $SHELL.parseClass(...)
+  - pattern-either:
+    - pattern-inside: |
+        groovy.lang.GroovyShell $SHELL = ...;
+        ...
+    - pattern-inside: |
+        groovy.lang.GroovyClassLoader $SHELL = ...;
+        ...
+  - pattern-not: |
+      $SHELL.parse("...",...)
+  - pattern-not: |
+      $SHELL.evaluate("...",...)
+  - pattern-not: |
+      $SHELL.parseClass("...",...)
+  message: >-
+    A expression is built with a dynamic value. The source of the value(s) should
+    be verified to avoid that unfiltered values fall into this risky code evaluation.
+  metadata:
+    cwe:
+    - "CWE-94: Improper Control of Generation of Code ('Code Injection')"
+    owasp:
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#GROOVY_SHELL
+    category: security
+    technology:
+    - groovy
+    references:
+    - https://owasp.org/Top10/A03_2021-Injection
+    cwe2022-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: LOW
+    confidence: LOW
+  languages: [java]
+  severity: WARNING

package/rules/semgrep-registry/el-injection.yaml

@@ -0,0 +1,137 @@
+rules:
+- id: el-injection
+  metadata:
+    cwe:
+    - "CWE-94: Improper Control of Generation of Code ('Code Injection')"
+    owasp:
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#EL_INJECTION
+    category: security
+    technology:
+    - java
+    references:
+    - https://owasp.org/Top10/A03_2021-Injection
+    cwe2022-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: HIGH
+    confidence: LOW
+  message: >-
+    An expression is built with a dynamic value. The source of the value(s) should
+    be verified to avoid that unfiltered values fall into this risky code evaluation.
+  severity: WARNING
+  languages: [java]
+  patterns:
+  - pattern-either:
+    - pattern: |
+        class $CLASS {
+          ...
+          ExpressionFactory $EF;
+          ...
+          $X $METHOD(...) {
+            ...
+            $EF.createValueExpression($CTX,$INPUT,...);
+            ...
+          }
+          ...
+        }
+    - pattern: |
+        class $CLASS {
+          ...
+          ExpressionFactory $EF = ...;
+          ...
+          $X $METHOD(...) {
+            ...
+            $EF.createValueExpression($CTX,$INPUT,...);
+            ...
+          }
+          ...
+        }
+    - pattern: |
+        $X $METHOD(...) {
+          ...
+          ExpressionFactory $EF = ...;
+          ...
+          $EF.createValueExpression($CTX,$INPUT,...);
+          ...
+        }
+    - pattern: |
+        $X $METHOD(...,ExpressionFactory $EF,...) {
+          ...
+          $EF.createValueExpression($CTX,$INPUT,...);
+          ...
+        }
+    - pattern: |
+        class $CLASS {
+          ...
+          ExpressionFactory $EF;
+          ...
+          $X $METHOD(...) {
+            ...
+            $EF.createMethodExpression($CTX,$INPUT,...);
+            ...
+          }
+          ...
+        }
+    - pattern: |
+        class $CLASS {
+          ...
+          ExpressionFactory $EF = ...;
+          ...
+          $X $METHOD(...) {
+            ...
+            $EF.createMethodExpression($CTX,$INPUT,...);
+            ...
+          }
+          ...
+        }
+    - pattern: |
+        $X $METHOD(...) {
+          ...
+          ExpressionFactory $EF = ...;
+          ...
+          $EF.createMethodExpression($CTX,$INPUT,...);
+          ...
+        }
+    - pattern: |
+        $X $METHOD(...,ExpressionFactory $EF,...) {
+          ...
+          $EF.createMethodExpression($CTX,$INPUT,...);
+          ...
+        }
+    - pattern: |
+        $X $METHOD(String $INPUT, ...) {
+          ...
+          $OBJECT.buildConstraintViolationWithTemplate($INPUT, ...);
+          ...
+        }
+  - pattern-not: |
+      $X $METHOD(...) {
+        ...
+        $EF.createValueExpression($CTX,"...",...);
+        ...
+      }
+  - pattern-not: |
+      $X $METHOD(...) {
+        ...
+        String $S = "...";
+        ...
+        $EF.createValueExpression($CTX,$S,...);
+        ...
+      }
+  - pattern-not: |
+      $X $METHOD(...) {
+        ...
+        $EF.createMethodExpression($CTX,"...",...);
+        ...
+      }
+  - pattern-not: |
+      $X $METHOD(...) {
+        ...
+        String $S = "...";
+        ...
+        $EF.createMethodExpression($CTX,$S,...);
+        ...
+      }

package/rules/semgrep-registry/formatted-sql-string.yaml

@@ -0,0 +1,95 @@
+rules:
+- id: formatted-sql-string
+  metadata:
+    cwe:
+    - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+    owasp:
+    - A01:2017 - Injection
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SQL_INJECTION
+    asvs:
+      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
+      control_id: 5.3.5 Injection
+      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
+      version: '4'
+    references:
+    - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
+    - https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps
+    - https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement
+    category: security
+    technology:
+    - java
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - vuln
+    likelihood: HIGH
+    impact: MEDIUM
+    confidence: MEDIUM
+  options:
+    taint_assume_safe_numbers: true
+    taint_assume_safe_booleans: true
+  message: >-
+    Detected a formatted string in a SQL statement. This could lead to SQL
+    injection if variables in the SQL statement are not properly sanitized.
+    Use a prepared statements (java.sql.PreparedStatement) instead. You
+    can obtain a PreparedStatement using 'connection.prepareStatement'.
+  mode: taint
+  pattern-sources:
+  - patterns:
+    - pattern-either:
+      - pattern: |
+          (HttpServletRequest $REQ)
+      - patterns:
+        - pattern-inside: |
+            $ANNOT $FUNC (..., $INPUT, ...) {
+              ...
+            }
+        - pattern: (String $INPUT)
+        - focus-metavariable: $INPUT
+    label: INPUT
+  - patterns:
+    - pattern-either:
+      - pattern: $X + $INPUT
+      - pattern: $X += $INPUT
+      - pattern: String.format(..., $INPUT, ...)
+      - pattern: String.join(..., $INPUT, ...)
+      - pattern: (String $STR).concat($INPUT)
+      - pattern: $INPUT.concat(...)
+      - patterns:
+        - pattern-either:
+          - pattern: $STRB.append($INPUT)
+          - pattern: new $STRB(..., $INPUT, ...)
+        - metavariable-type:
+            metavariable: $STRB
+            type: StringBuilder
+    label: CONCAT
+    requires: INPUT
+  pattern-propagators:
+    - pattern: (StringBuffer $S).append($X)
+      from: $X
+      to: $S
+    - pattern: (StringBuilder $S).append($X)
+      from: $X
+      to: $S
+  pattern-sinks:
+  - patterns:
+    - pattern-not: $S.$SQLFUNC(<... "=~/.*TABLE *$/" ...>)
+    - pattern-not: $S.$SQLFUNC(<... "=~/.*TABLE %s$/" ...>)
+    - pattern-either:
+      - pattern: (Statement $S).$SQLFUNC(...)
+      - pattern: (PreparedStatement $P).$SQLFUNC(...)
+      - pattern: (Connection $C).createStatement(...).$SQLFUNC(...)
+      - pattern: (Connection $C).prepareStatement(...).$SQLFUNC(...)
+      - pattern: (EntityManager $EM).$SQLFUNC(...)
+    - metavariable-regex:
+        metavariable: $SQLFUNC
+        regex: execute|executeQuery|createQuery|query|addBatch|nativeSQL|create|prepare
+    requires: CONCAT
+  pattern-sanitizers:
+  - patterns:
+    - pattern: (CriteriaBuilder $CB).$ANY(...)
+  severity: ERROR
+  languages:
+  - java

package/rules/semgrep-registry/http-response-splitting.yaml

@@ -0,0 +1,44 @@
+rules:
+- id: http-response-splitting
+  metadata:
+    cwe:
+    - "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')"
+    owasp:
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#HTTP_RESPONSE_SPLITTING
+    references:
+    - https://www.owasp.org/index.php/HTTP_Response_Splitting
+    category: security
+    technology:
+    - java
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    confidence: MEDIUM
+  message: >-
+    Older Java application servers are vulnerable to HTTP response splitting, which
+    may occur if an HTTP
+    request can be injected with CRLF characters. This finding is reported for completeness;
+    it is recommended
+    to ensure your environment is not affected by testing this yourself.
+  severity: INFO
+  languages:
+  - java
+  pattern-either:
+  - pattern: |
+      $VAR = $REQ.getParameter(...);
+      ...
+      $COOKIE = new Cookie(..., $VAR, ...);
+      ...
+      $RESP.addCookie($COOKIE, ...);
+  - patterns:
+    - pattern-inside: |
+        $RETTYPE $FUNC(...,@PathVariable $TYPE $VAR, ...) {
+          ...
+        }
+    - pattern: |
+        $COOKIE = new Cookie(..., $VAR, ...);
+        ...
+        $RESP.addCookie($COOKIE, ...);

package/rules/semgrep-registry/index.txt

@@ -0,0 +1 @@
+770

package/rules/semgrep-registry/insecure-smtp-connection.yaml

@@ -0,0 +1,34 @@
+rules:
+- id: insecure-smtp-connection
+  metadata:
+    cwe:
+    - 'CWE-297: Improper Validation of Certificate with Host Mismatch'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#INSECURE_SMTP_SSL
+    category: security
+    technology:
+    - java
+    references:
+    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+    subcategory:
+    - vuln
+    likelihood: LOW
+    impact: MEDIUM
+    confidence: MEDIUM
+  message: >-
+    Insecure SMTP connection detected. This connection will trust any SSL certificate.
+    Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'.
+  severity: WARNING
+  patterns:
+  - pattern-not-inside: |
+      $EMAIL.setSSLCheckServerIdentity(true);
+      ...
+  - pattern-inside: |
+      $EMAIL = new SimpleEmail(...);
+      ...
+  - pattern: |-
+      $EMAIL.send(...);
+  languages:
+  - java