@zhuma4/cli 4.0.0-alpha.1

package/rules/semgrep-registry/url-rewriting.yaml

@@ -0,0 +1,82 @@
+rules:
+- id: url-rewriting
+  message: >-
+    URL rewriting has significant security risks.
+    Since session ID appears in the URL, it may be easily seen by third parties.
+  metadata:
+    cwe:
+    - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
+    owasp:
+    - A01:2021 - Broken Access Control
+    - A01:2025 - Broken Access Control
+    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#URL_REWRITING
+    category: security
+    technology:
+    - java
+    references:
+    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
+    cwe2021-top25: true
+    subcategory:
+    - vuln
+    likelihood: LOW
+    impact: MEDIUM
+    confidence: LOW
+  severity: WARNING
+  languages: [java]
+  pattern-either:
+  - pattern: |
+      $X $METHOD(...,HttpServletResponse $RES,...) {
+        ...
+        $RES.encodeURL(...);
+        ...
+      }
+  - pattern: |
+      $X $METHOD(...,HttpServletResponse $RES,...) {
+        ...
+        $RES.encodeUrl(...);
+        ...
+      }
+  - pattern: |
+      $X $METHOD(...,HttpServletResponse $RES,...) {
+        ...
+        $RES.encodeRedirectURL(...);
+        ...
+      }
+  - pattern: |
+      $X $METHOD(...,HttpServletResponse $RES,...) {
+        ...
+        $RES.encodeRedirectUrl(...);
+        ...
+      }
+  - pattern: |
+      $X $METHOD(...) {
+        ...
+        HttpServletResponse $RES = ...;
+        ...
+        $RES.encodeURL(...);
+        ...
+      }
+  - pattern: |
+      $X $METHOD(...) {
+        ...
+        HttpServletResponse $RES = ...;
+        ...
+        $RES.encodeUrl(...);
+        ...
+      }
+  - pattern: |
+      $X $METHOD(...) {
+        ...
+        HttpServletResponse $RES = ...;
+        ...
+        $RES.encodeRedirectURL(...);
+        ...
+      }
+  - pattern: |-
+      $X $METHOD(...) {
+        ...
+        HttpServletResponse $RES = ...;
+        ...
+        $RES.encodeRedirectUrl(...);
+        ...
+      }

package/rules/semgrep-registry/weak-ssl-context.yaml

@@ -0,0 +1,34 @@
+rules:
+- id: weak-ssl-context
+  metadata:
+    cwe:
+    - 'CWE-326: Inadequate Encryption Strength'
+    owasp:
+    - A03:2017 - Sensitive Data Exposure
+    - A02:2021 - Cryptographic Failures
+    - A04:2025 - Cryptographic Failures
+    source_rule_url: https://find-sec-bugs.github.io/bugs.htm#SSL_CONTEXT
+    references:
+    - https://tools.ietf.org/html/rfc7568
+    - https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html
+    category: security
+    technology:
+    - java
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: MEDIUM
+    confidence: HIGH
+  message: >-
+    An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions
+    are considered weak encryption and are deprecated.
+    Use SSLContext.getInstance("TLSv1.2") for the best security.
+  severity: WARNING
+  languages: [java]
+  patterns:
+  - pattern-not: SSLContext.getInstance("TLSv1.3")
+  - pattern-not: SSLContext.getInstance("TLSv1.2")
+  - pattern: SSLContext.getInstance("...")
+  fix-regex:
+    regex: (.*?)\.getInstance\(.*?\)
+    replacement: \1.getInstance("TLSv1.2")

package/rules/semgrep-registry/xml-decoder.yaml

@@ -0,0 +1,53 @@
+rules:
+- id: xml-decoder
+  message: >-
+    XMLDecoder should not be used to parse untrusted data.
+    Deserializing user input can lead to arbitrary code execution.
+    Use an alternative and explicitly disable external entities.
+    See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
+    for alternatives and vulnerability prevention.
+  metadata:
+    cwe:
+    - 'CWE-611: Improper Restriction of XML External Entity Reference'
+    owasp:
+    - A04:2017 - XML External Entities (XXE)
+    - A05:2021 - Security Misconfiguration
+    - A02:2025 - Security Misconfiguration
+    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XML_DECODER
+    references:
+    - https://semgrep.dev/blog/2022/xml-security-in-java
+    - https://semgrep.dev/docs/cheat-sheets/java-xxe/
+    - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
+    category: security
+    technology:
+    - java
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: HIGH
+    confidence: LOW
+  severity: WARNING
+  languages: [java]
+  patterns:
+  - pattern: |
+      $X $METHOD(...) {
+        ...
+        new XMLDecoder(...);
+        ...
+      }
+  - pattern-not: |
+      $X $METHOD(...) {
+        ...
+        new XMLDecoder("...");
+        ...
+      }
+  - pattern-not: |-
+      $X $METHOD(...) {
+        ...
+        String $STR = "...";
+        ...
+        new XMLDecoder($STR);
+        ...
+      }

package/rules/semgrep-registry/xssrequestwrapper-is-insecure.yaml

@@ -0,0 +1,40 @@
+rules:
+- id: xssrequestwrapper-is-insecure
+  metadata:
+    owasp:
+    - A07:2017 - Cross-Site Scripting (XSS)
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    cwe:
+    - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XSS_REQUEST_WRAPPER
+    category: security
+    technology:
+    - java
+    references:
+    - https://owasp.org/Top10/A03_2021-Injection
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: MEDIUM
+    confidence: LOW
+  message: >-
+    It looks like you're using an implementation of XSSRequestWrapper from dzone.
+    (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html)
+    The XSS filtering in this code is not secure and can be bypassed by malicious
+    actors.
+    It is recommended to use a stack that automatically escapes in your view or templates
+    instead of filtering yourself.
+  severity: WARNING
+  languages:
+  - java
+  pattern-either:
+  - pattern: |
+      class XSSRequestWrapper extends HttpServletRequestWrapper {
+        ...
+      }
+  - pattern: |-
+      $P = $X.compile("</script>", $X.CASE_INSENSITIVE);
+      $V = $P.matcher(...).replaceAll("");