@zhuma4/cli 4.0.0-alpha.1

package/rules/semgrep-registry/overly-permissive-file-permission.yaml

@@ -0,0 +1,49 @@
+rules:
+- id: overly-permissive-file-permission
+  message: >-
+    Detected file permissions that are overly permissive (read, write, and execute).
+    It is generally a bad practices to set overly permissive file permission such
+    as read+write+exec for all users.
+    If the file affected is a configuration, a binary, a script or sensitive data,
+    it can lead to privilege escalation or information leakage.
+    Instead, follow the principle of least privilege and give users only the 
+    permissions they need.
+  severity: WARNING
+  languages: [java]
+  metadata:
+    cwe:
+    - 'CWE-276: Incorrect Default Permissions'
+    owasp:
+    - A01:2021 - Broken Access Control
+    - A01:2025 - Broken Access Control
+    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#OVERLY_PERMISSIVE_FILE_PERMISSION
+    category: security
+    technology:
+    - java
+    references:
+    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: MEDIUM
+    confidence: LOW
+  pattern-either:
+  - pattern: java.nio.file.Files.setPosixFilePermissions($FILE, java.nio.file.attribute.PosixFilePermissions.fromString("=~/(^......r..$)|(^.......w.$)|(^........x$)/"));
+  - pattern: |
+      $TYPE $P = java.nio.file.attribute.PosixFilePermissions.fromString("=~/(^......r..$)|(^.......w.$)|(^........x$)/");
+      ...
+      java.nio.file.Files.setPosixFilePermissions($FILE, $P);
+  - pattern: |
+      $P.add(java.nio.file.attribute.PosixFilePermission.OTHERS_READ);
+      ...
+      java.nio.file.Files.setPosixFilePermissions($FILE, $P);
+  - pattern: |
+      $P.add(java.nio.file.attribute.PosixFilePermission.OTHERS_WRITE);
+      ...
+      java.nio.file.Files.setPosixFilePermissions($FILE, $P);
+  - pattern: |-
+      $P.add(java.nio.file.attribute.PosixFilePermission.OTHERS_EXECUTE);
+      ...
+      java.nio.file.Files.setPosixFilePermissions($FILE, $P);

package/rules/semgrep-registry/permissive-cors.yaml

@@ -0,0 +1,77 @@
+rules:
+- id: permissive-cors
+  message: >-
+    https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS
+    Permissive CORS policy will allow a malicious application to communicate with
+    the victim application in an inappropriate way, leading to spoofing, data theft,
+    relay and other attacks.
+  metadata:
+    cwe:
+    - 'CWE-183: Permissive List of Allowed Inputs'
+    asvs:
+      section: 'V14: Configuration Verification Requirements'
+      control_id: 14.4.8 Permissive CORS
+      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x22-V14-Config.md#v144-http-security-headers-requirements
+      version: '4'
+    category: security
+    technology:
+    - java
+    owasp:
+    - A04:2021 - Insecure Design
+    - A06:2025 - Insecure Design
+    references:
+    - https://owasp.org/Top10/A04_2021-Insecure_Design
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: LOW
+    confidence: LOW
+  severity: WARNING
+  languages: [java]
+  pattern-either:
+  - pattern: |
+      HttpServletResponse $RES = ...;
+      ...
+      $RES.addHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
+  - pattern: |
+      HttpServletResponse $RES = ...;
+      ...
+      $RES.setHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
+  - pattern: |
+      ServerHttpResponse $RES = ...;
+      ...
+      $RES.getHeaders().add("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
+  - pattern: |
+      HttpHeaders $HEADERS = ...;
+      ...
+      $HEADERS.set("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
+  - pattern: |
+      ServerWebExchange $SWE = ...;
+      ...
+      $SWE.getResponse().getHeaders().add("Access-Control-Allow-Origin", "*");
+  - pattern: |
+      $X $METHOD(...,HttpServletResponse $RES,...) {
+        ...
+        $RES.addHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
+        ...
+      }
+  - pattern: |
+      $X $METHOD(...,HttpServletResponse $RES,...) {
+        ...
+        $RES.setHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
+        ...
+      }
+  - pattern: |
+      $X $METHOD(...,ServerHttpResponse $RES,...) {
+        ...
+        $RES.getHeaders().add("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
+        ...
+      }
+  - pattern: |
+      $X $METHOD(...,ServerWebExchange $SWE,...) {
+        ...
+        $SWE.getResponse().getHeaders().add("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
+        ...
+      }
+  - pattern: ResponseEntity.$RES().header("=~/access-control-allow-origin/i", "=~/^\*|null$/i")
+  - pattern: ServerResponse.$RES().header("=~/access-control-allow-origin/i", "=~/^\*|null$/i")

package/rules/semgrep-registry/script-engine-injection.yaml

@@ -0,0 +1,66 @@
+rules:
+- id: script-engine-injection
+  message: >-
+    Detected potential code injection using ScriptEngine. Ensure
+    user-controlled data cannot enter '.eval()', otherwise, this is
+    a code injection vulnerability.
+  metadata:
+    cwe:
+    - "CWE-94: Improper Control of Generation of Code ('Code Injection')"
+    owasp:
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SCRIPT_ENGINE_INJECTION
+    category: security
+    technology:
+    - java
+    references:
+    - https://owasp.org/Top10/A03_2021-Injection
+    cwe2022-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: LOW
+    confidence: LOW
+  severity: WARNING
+  languages: [java]
+  patterns:
+  - pattern-either:
+    - pattern-inside: |
+        class $CLASS {
+          ...
+          ScriptEngine $SE;
+          ...
+        }
+    - pattern-inside: |
+        class $CLASS {
+          ...
+          ScriptEngine $SE = ...;
+          ...
+        }
+    - pattern-inside: |
+        $X $METHOD(...) {
+          ...
+          ScriptEngine $SE = ...;
+          ...
+        }
+  - pattern: |
+      $X $METHOD(...) {
+        ...
+        $SE.eval(...);
+        ...
+      }
+  - pattern-not: |
+      $X $METHOD(...) {
+        ...
+        $SE.eval("...");
+        ...
+      }
+  - pattern-not: |
+      $X $METHOD(...) {
+        ...
+        String $S = "...";
+        ...
+        $SE.eval($S);
+        ...
+      }

package/rules/semgrep-registry/tainted-cmd-from-http-request.yaml

@@ -0,0 +1,74 @@
+rules:
+- id: tainted-cmd-from-http-request
+  message: >-
+    Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could
+    lead to command injection if variables passed into the exec commands are not properly sanitized. Instead,
+    avoid using these OS commands with user-supplied input, or, if you must use these commands, use a
+    whitelist of specific values.
+  languages: [java]
+  severity: ERROR
+  mode: taint
+  pattern-sources:
+  - patterns:
+    - pattern-either:
+      - pattern: |
+          (HttpServletRequest $REQ)
+      - patterns:   # this pattern is a hack to get the rule to recognize `map` as tainted source when `cookie.getValue(user_input)` is used.
+        - pattern-inside: |
+            (javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);
+            ...
+            for (javax.servlet.http.Cookie $COOKIE: $COOKIES) {
+              ...
+            }
+        - pattern: |
+            $COOKIE.getValue(...)
+  pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: |
+                  (ProcessBuilder $PB) = ...;
+              - patterns:
+                - pattern: |
+                    (Process $P) = ...;
+                - pattern-not: |
+                    (Process $P) = (java.lang.Runtime $R).exec(...);
+              - patterns:
+                  - pattern: (java.lang.Runtime $R).exec($CMD, ...);
+                  - focus-metavariable: $CMD
+              - patterns:
+                  - pattern-either:
+                      - pattern-inside: |
+                          (java.util.List<$TYPE> $ARGLIST) = ...;  
+                          ...
+                          (ProcessBuilder $PB) = ...;
+                          ...
+                          $PB.command($ARGLIST);
+                      - pattern-inside: |
+                          (java.util.List<$TYPE> $ARGLIST) = ...;  
+                          ...
+                          (ProcessBuilder $PB) = ...;
+                      - pattern-inside: |
+                          (java.util.List<$TYPE> $ARGLIST) = ...;  
+                          ...
+                          (Process $P) = ...;
+                  - pattern: |
+                      $ARGLIST.add(...);
+  metadata:
+    category: security
+    technology:
+    - java
+    cwe:
+    - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
+    owasp:
+    - A01:2017 - Injection
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    references:
+    - https://owasp.org/Top10/A03_2021-Injection
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    confidence: MEDIUM

package/rules/semgrep-registry/tainted-env-from-http-request.yaml

@@ -0,0 +1,46 @@
+rules:
+- id: tainted-env-from-http-request
+  message: >-
+    Detected input from a HTTPServletRequest going into the environment variables of an 'exec' command. 
+    Instead, call the command with user-supplied arguments by using the overloaded method with one String array as the argument.
+    `exec({"command", "arg1", "arg2"})`.
+  languages: [java]
+  severity: ERROR
+  mode: taint
+  pattern-sources:
+  - patterns:
+    - pattern-either:
+      - pattern: |
+          (HttpServletRequest $REQ)
+      - patterns:   # this pattern is a hack to get the rule to recognize `map` as tainted source when `cookie.getValue(user_input)` is used.
+        - pattern-inside: |
+            (javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);
+            ...
+            for (javax.servlet.http.Cookie $COOKIE: $COOKIES) {
+              ...
+            }
+        - pattern: |
+            $COOKIE.getValue(...)
+  pattern-sinks:
+       - patterns:
+           - pattern: (java.lang.Runtime $R).exec($CMD, $ENV_ARGS, ...);
+           - focus-metavariable: $ENV_ARGS
+  metadata:
+    category: security
+    technology:
+    - java
+    cwe:
+    - "CWE-454: External Initialization of Trusted Variables or Data Stores"
+    owasp:
+    - A01:2017 - Injection
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    references:
+    - https://owasp.org/Top10/A03_2021-Injection
+    cwe2022-top25: false
+    cwe2021-top25: false
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    confidence: MEDIUM

package/rules/semgrep-registry/tainted-ldapi-from-http-request.yaml

@@ -0,0 +1,42 @@
+rules:
+- id: tainted-ldapi-from-http-request
+  message: >-
+    Detected input from a HTTPServletRequest going into an LDAP query.
+    This could lead to LDAP injection if the input is not properly sanitized,
+    which could result in attackers modifying objects in the LDAP tree structure.
+    Ensure data passed to an LDAP query is not controllable or properly sanitize
+    the data.
+  metadata:
+    cwe:
+    - "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')"
+    owasp:
+    - A01:2017 - Injection
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    references:
+    - https://sensei.securecodewarrior.com/recipes/scw%3Ajava%3ALDAP-injection
+    category: security
+    technology:
+    - java
+    subcategory:
+    - vuln
+    impact: MEDIUM
+    likelihood: MEDIUM
+    confidence: MEDIUM
+  severity: WARNING
+  languages: [java]
+  mode: taint
+  pattern-sources:
+  - patterns:
+    - pattern: (HttpServletRequest $REQ)
+  pattern-sinks:
+  - patterns:
+    - pattern-either:
+      - pattern: |
+          (javax.naming.directory.InitialDirContext $IDC).search(...)
+      - pattern: |
+          (javax.naming.directory.DirContext $CTX).search(...)
+    - pattern-not: |
+        (javax.naming.directory.InitialDirContext $IDC).search($Y, "...", ...)
+    - pattern-not: |
+        (javax.naming.directory.DirContext $CTX).search($Y, "...", ...)

package/rules/semgrep-registry/tainted-session-from-http-request.yaml

@@ -0,0 +1,70 @@
+rules:
+- id: tainted-session-from-http-request
+  message: >-
+    Detected input from a HTTPServletRequest going into a session command, like `setAttribute`.
+    User input into such a command could lead to an attacker inputting malicious code into your session
+    parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust
+    boundary violation.
+    This could lead to programmers trusting unvalidated data.
+    Instead, thoroughly sanitize user input before passing it
+    into such function calls.
+  languages: [java]
+  severity: WARNING
+  mode: taint
+  pattern-sources:
+  - patterns:
+    - pattern-either:
+      - patterns:
+        - pattern: |
+            (HttpServletRequest $REQ).$FUNC(...)
+        - pattern-not: |
+            (HttpServletRequest $REQ).getSession()
+      - patterns:   # this pattern is a hack to get the rule to      recognize `map` as tainted source when `cookie. getValue(user_input)` is used.
+        - pattern-inside: |
+            (javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);
+            ...
+            for (javax.servlet.http.Cookie $COOKIE: $COOKIES) {
+              ...
+            }
+        - pattern: |
+            $COOKIE.getValue(...)
+      - patterns:   # use this pattern to catch cases where tainted  array values are assigned to a variable (not caught by taint)
+        - pattern-inside: |
+            $TYPE[] $VALS = (HttpServletRequest $REQ).$GETFUNC(... );
+            ...
+        - pattern: |
+            $PARAM = $VALS[$INDEX];
+      - patterns:   # use this pattern to catch cases where request headers are later decoded
+        - pattern-inside: |
+            $HEADERS = (HttpServletRequest $REQ).getHeaders(...);
+            ...
+            $PARAM = $HEADERS.$FUNC(...);
+            ...
+        - pattern: |
+            java.net.URLDecoder.decode($PARAM, ...)
+  pattern-sinks:
+    - patterns:
+        - pattern: (HttpServletRequest $REQ).getSession().$FUNC($NAME, $VALUE);
+        - metavariable-regex:
+            metavariable: $FUNC
+            regex: ^(putValue|setAttribute)$
+        - focus-metavariable: $VALUE
+  options:
+    interfile: true
+  metadata:
+    category: security
+    technology:
+    - java
+    cwe:
+    - 'CWE-501: Trust Boundary Violation'
+    owasp:
+    - A04:2021 - Insecure Design
+    - A06:2025 - Insecure Design
+    references:
+    - https://owasp.org/Top10/A04_2021-Insecure_Design
+    subcategory:
+    - vuln
+    impact: MEDIUM
+    likelihood: MEDIUM
+    confidence: MEDIUM
+    interfile: true

package/rules/semgrep-registry/tainted-xpath-from-http-request.yaml

@@ -0,0 +1,38 @@
+rules:
+- id: tainted-xpath-from-http-request
+  message: >-
+    Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could
+    lead to xpath injection if variables passed into the evaluate or compile commands are not properly
+    sanitized.
+    Xpath injection could lead to unauthorized access to sensitive information in XML documents.
+    Instead, thoroughly sanitize user input or use parameterized xpath queries if you can.
+  languages: [java]
+  severity: WARNING
+  mode: taint
+  pattern-sources:
+  - patterns:
+    - pattern: |
+        (HttpServletRequest $REQ).$FUNC(...)
+  pattern-sinks:
+  - patterns:
+    - pattern-either:
+      - pattern: |
+          (javax.xml.xpath.XPath $XP).evaluate(...)
+      - pattern: |
+          (javax.xml.xpath.XPath $XP).compile(...).evaluate(...)
+  metadata:
+    category: security
+    technology:
+    - java
+    cwe:
+    - "CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')"
+    owasp:
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    references:
+    - https://owasp.org/Top10/A03_2021-Injection
+    subcategory:
+    - vuln
+    likelihood: HIGH
+    impact: MEDIUM
+    confidence: MEDIUM

package/rules/semgrep-registry/unsafe-reflection.yaml

@@ -0,0 +1,39 @@
+rules:
+- id: unsafe-reflection
+  patterns:
+  - pattern: |
+      Class.forName($CLASS,...)
+  - pattern-not: |
+      Class.forName("...",...)
+  - pattern-not-inside: |
+      $CLASS = "...";
+      ...
+  message: >-
+    If an attacker can supply values that the application then uses to determine which
+    class to instantiate or which method to invoke,
+    the potential exists for the attacker to create control flow paths through the
+    application
+    that were not intended by the application developers.
+    This attack vector may allow the attacker to bypass authentication or access control
+    checks
+    or otherwise cause the application to behave in an unexpected manner.
+  metadata:
+    cwe:
+    - "CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')"
+    owasp:
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    source-rule-url: https://owasp.org/www-community/vulnerabilities/Unsafe_use_of_Reflection
+    category: security
+    technology:
+    - java
+    references:
+    - https://owasp.org/Top10/A03_2021-Injection
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: LOW
+    confidence: LOW
+  severity: WARNING
+  languages:
+  - java

package/rules/semgrep-registry/unvalidated-redirect.yaml

@@ -0,0 +1,127 @@
+rules:
+- id: unvalidated-redirect
+  message: >-
+    Application redirects to a destination URL specified by a user-supplied
+    parameter that is not validated. This could direct users to malicious locations.
+    Consider using an allowlist to validate URLs.
+  metadata:
+    cwe:
+    - "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"
+    owasp:
+    - A01:2021 - Broken Access Control
+    - A01:2025 - Broken Access Control
+    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNVALIDATED_REDIRECT
+    asvs:
+      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
+      control_id: 5.1.5 Open Redirect
+      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation-requirements
+      version: '4'
+    category: security
+    technology:
+    - java
+    references:
+    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
+    subcategory:
+    - vuln
+    impact: LOW
+    likelihood: MEDIUM
+    confidence: MEDIUM
+  severity: WARNING
+  languages: [java]
+  pattern-either:
+  - pattern: |
+      $X $METHOD(...,HttpServletResponse $RES,...,String $URL,...) {
+        ...
+        $RES.sendRedirect($URL);
+        ...
+      }
+  - pattern: |
+      $X $METHOD(...,String $URL,...,HttpServletResponse $RES,...) {
+        ...
+        $RES.sendRedirect($URL);
+        ...
+      }
+  - pattern: |
+      $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) {
+        ...
+        String $URL = $REQ.getParameter(...);
+        ...
+        $RES.sendRedirect($URL);
+        ...
+      }
+  - pattern: |
+      $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) {
+        ...
+        String $URL = $REQ.getParameter(...);
+        ...
+        $RES.sendRedirect($URL);
+        ...
+      }
+  - pattern: |
+      $X $METHOD(...,String $URL,...) {
+        ...
+        HttpServletResponse $RES = ...;
+        ...
+        $RES.sendRedirect($URL);
+        ...
+      }
+  - pattern: |
+      $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) {
+        ...
+        $RES.sendRedirect($REQ.getParameter(...));
+        ...
+      }
+  - pattern: |
+      $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) {
+        ...
+        $RES.sendRedirect($REQ.getParameter(...));
+        ...
+      }
+  - pattern: |
+      $X $METHOD(...,HttpServletResponse $RES,...,String $URL,...) {
+        ...
+        $RES.addHeader("Location",$URL);
+        ...
+      }
+  - pattern: |
+      $X $METHOD(...,String $URL,...,HttpServletResponse $RES,...) {
+        ...
+        $RES.addHeader("Location",$URL);
+        ...
+      }
+  - pattern: |
+      $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) {
+        ...
+        String $URL = $REQ.getParameter(...);
+        ...
+        $RES.addHeader("Location",$URL);
+        ...
+      }
+  - pattern: |
+      $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) {
+        ...
+        String $URL = $REQ.getParameter(...);
+        ...
+        $RES.addHeader("Location",$URL);
+        ...
+      }
+  - pattern: |
+      $X $METHOD(...,String $URL,...) {
+        ...
+        HttpServletResponse $RES = ...;
+        ...
+        $RES.addHeader("Location",$URL);
+        ...
+      }
+  - pattern: |
+      $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) {
+        ...
+        $RES.addHeader("Location",$REQ.getParameter(...));
+        ...
+      }
+  - pattern: |-
+      $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) {
+        ...
+        $RES.addHeader("Location",$REQ.getParameter(...));
+        ...
+      }