codesentry-semgrep-rules 0.1.11 → 0.2.1

package/rules/owasp.yml

@@ -17122,138 +17122,6 @@ rules:
   pattern-sanitizers:
   - pattern: params.merge(:only_path => true)
   - pattern: params.merge(:host => ...)
-- id: ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path
-  metadata:
-    owasp:
-    - A05:2017 - Broken Access Control
-    - A01:2021 - Broken Access Control
-    - A01:2025 - Broken Access Control
-    cwe:
-    - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
-      Traversal'')'
-    references:
-    - https://brakemanscanner.org/docs/warning_types/dynamic_render_paths/
-    category: security
-    technology:
-    - rails
-    cwe2022-top25: true
-    cwe2021-top25: true
-    subcategory:
-    - vuln
-    likelihood: HIGH
-    impact: MEDIUM
-    confidence: MEDIUM
-    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
-    vulnerability_class:
-    - Path Traversal
-    source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path
-    shortlink: https://sg.run/GO2n
-    semgrep.dev:
-      rule:
-        r_id: 13592
-        rv_id: 1263635
-        rule_id: 6JU1bL
-        version_id: bZT53p0
-        url: https://semgrep.dev/playground/r/bZT53p0/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path
-        origin: community
-  message: Avoid rendering user input. It may be possible for a malicious user to
-    input a path that lets them access a template they shouldn't. To prevent this,
-    check dynamic template paths against a predefined allowlist to make sure it's
-    an allowed template.
-  languages:
-  - ruby
-  severity: WARNING
-  mode: taint
-  pattern-sources:
-  - pattern: params
-  - pattern: cookies
-  - pattern: request.env
-  pattern-sinks:
-  - patterns:
-    - pattern-inside: render($X => $INPUT, ...)
-    - pattern: $INPUT
-    - metavariable-pattern:
-        metavariable: $X
-        pattern-either:
-        - pattern: action
-        - pattern: template
-        - pattern: partial
-        - pattern: file
-- id: python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
-  languages:
-  - python
-  severity: WARNING
-  metadata:
-    category: security
-    owasp:
-    - A01:2021 - Broken Access Control
-    - A01:2025 - Broken Access Control
-    cwe:
-    - 'CWE-276: Incorrect Default Permissions'
-    technology:
-    - python
-    references:
-    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
-    cwe2022-top25: true
-    cwe2021-top25: true
-    subcategory:
-    - vuln
-    likelihood: LOW
-    impact: MEDIUM
-    confidence: MEDIUM
-    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
-    vulnerability_class:
-    - Improper Authorization
-    source: https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
-    shortlink: https://sg.run/AXY4
-    semgrep.dev:
-      rule:
-        r_id: 13594
-        rv_id: 1263482
-        rule_id: zdUYqR
-        version_id: O9Tpxqr
-        url: https://semgrep.dev/playground/r/O9Tpxqr/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
-        origin: community
-  message: These permissions `$BITS` are widely permissive and grant access to more
-    people than may be necessary. A good default is `0o644` which gives read and write
-    access to yourself and read access to everyone else.
-  patterns:
-  - pattern-inside: os.$METHOD(...)
-  - metavariable-pattern:
-      metavariable: $METHOD
-      patterns:
-      - pattern-either:
-        - pattern: chmod
-        - pattern: lchmod
-        - pattern: fchmod
-  - pattern-either:
-    - patterns:
-      - pattern: os.$METHOD($FILE, $BITS, ...)
-      - metavariable-comparison:
-          metavariable: $BITS
-          comparison: $BITS >= 0o650 and $BITS < 0o100000
-    - patterns:
-      - pattern: os.$METHOD($FILE, $BITS)
-      - metavariable-comparison:
-          metavariable: $BITS
-          comparison: $BITS >= 0o100650
-    - patterns:
-      - pattern: os.$METHOD($FILE, $BITS, ...)
-      - metavariable-pattern:
-          metavariable: $BITS
-          patterns:
-          - pattern-either:
-            - pattern: <... stat.S_IWGRP ...>
-            - pattern: <... stat.S_IXGRP ...>
-            - pattern: <... stat.S_IWOTH ...>
-            - pattern: <... stat.S_IXOTH ...>
-            - pattern: <... stat.S_IRWXO ...>
-            - pattern: <... stat.S_IRWXG ...>
-    - patterns:
-      - pattern: os.$METHOD($FILE, $EXPR | $MOD, ...)
-      - metavariable-comparison:
-          metavariable: $MOD
-          comparison: $MOD == 0o111
 - id: php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query
   languages:
   - php
@@ -17650,479 +17518,530 @@ rules:
         metavariable: $HTMLSTR
         language: generic
         pattern: <$TAG ...
-- id: go.lang.security.injection.tainted-sql-string.tainted-sql-string
+- id: ruby.rails.security.injection.raw-html-format.raw-html-format
   languages:
-  - go
-  message: User data flows into this manually-constructed SQL string. User data can
-    be safely inserted into SQL strings using prepared statements or an object-relational
-    mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL
-    injection, which could let an attacker steal or manipulate data from the database.
-    Instead, use prepared statements (`db.Query("SELECT * FROM t WHERE id = ?", id)`)
-    or a safe library.
-  options:
-    interfile: true
+  - ruby
+  severity: WARNING
+  message: Detected user input flowing into a manually constructed HTML string. You
+    may be accidentally bypassing secure methods of rendering HTML by manually constructing
+    HTML and this could create a cross-site scripting vulnerability, which could let
+    attackers steal sensitive user data. Use the `render template` and make template
+    files which will safely render HTML instead, or inspect that the HTML is absolutely
+    rendered safely with a function like `sanitize`.
   metadata:
     cwe:
-    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
-      (''SQL Injection'')'
+    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
+      Scripting'')'
     owasp:
-    - A01:2017 - Injection
+    - A07:2017 - Cross-Site Scripting (XSS)
     - A03:2021 - Injection
     - A05:2025 - Injection
-    references:
-    - https://golang.org/doc/database/sql-injection
-    - https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/
     category: security
     technology:
-    - go
-    confidence: HIGH
+    - rails
+    references:
+    - https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/
+    - https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html
     cwe2022-top25: true
     cwe2021-top25: true
     subcategory:
     - vuln
     likelihood: HIGH
     impact: MEDIUM
-    interfile: true
+    confidence: MEDIUM
     license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
     vulnerability_class:
-    - SQL Injection
-    source: https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string
-    shortlink: https://sg.run/PbEq
+    - Cross-Site-Scripting (XSS)
+    source: https://semgrep.dev/r/ruby.rails.security.injection.raw-html-format.raw-html-format
+    shortlink: https://sg.run/b2JQ
     semgrep.dev:
       rule:
-        r_id: 14689
-        rv_id: 1409388
-        rule_id: PeUoqy
-        version_id: nWTQ5qD
-        url: https://semgrep.dev/playground/r/nWTQ5qD/go.lang.security.injection.tainted-sql-string.tainted-sql-string
+        r_id: 14470
+        rv_id: 1409408
+        rule_id: kxUwZX
+        version_id: qkTvgYY
+        url: https://semgrep.dev/playground/r/qkTvgYY/ruby.rails.security.injection.raw-html-format.raw-html-format
         origin: community
   mode: taint
-  severity: ERROR
+  pattern-sanitizers:
+  - pattern-either:
+    - pattern: sanitize(...)
+    - pattern: strip_tags(...)
   pattern-sources:
   - patterns:
     - pattern-either:
-      - pattern: |
-          ($REQUEST : *http.Request).$ANYTHING
-      - pattern: |
-          ($REQUEST : http.Request).$ANYTHING
-    - metavariable-regex:
-        metavariable: $ANYTHING
-        regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
+      - pattern: params
+      - pattern: request
   pattern-sinks:
   - patterns:
     - pattern-either:
       - patterns:
-        - pattern-either:
-          - pattern: |
-              "$SQLSTR" + ...
-          - patterns:
-            - pattern-inside: |
-                $VAR = "$SQLSTR";
-                ...
-            - pattern: $VAR += ...
-          - patterns:
-            - pattern-inside: |
-                var $SB strings.Builder
-                ...
-            - pattern-inside: |
-                $SB.WriteString("$SQLSTR")
-                ...
-                $SB.String(...)
-            - pattern: |
-                $SB.WriteString(...)
-        - metavariable-regex:
-            metavariable: $SQLSTR
-            regex: (?i)(select|delete|insert|create|update|alter|drop).*
+        - pattern: |
+            $HTMLSTR
+        - pattern-regex: <\w+.*
       - patterns:
         - pattern-either:
-          - pattern: fmt.Fprintf($F, "$SQLSTR", ...)
-          - pattern: fmt.Sprintf("$SQLSTR", ...)
-          - pattern: fmt.Printf("$SQLSTR", ...)
-        - metavariable-regex:
-            metavariable: $SQLSTR
-            regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).*
-  pattern-sanitizers:
-  - pattern-either:
-    - pattern: strconv.Atoi(...)
-    - pattern: |
-        ($X: bool)
-- id: java.lang.security.audit.md5-used-as-password.md5-used-as-password
-  languages:
-  - java
+          - pattern: Kernel::sprintf("$HTMLSTR", ...)
+          - pattern: |
+              "$HTMLSTR" + $EXPR
+          - pattern: |
+              "$HTMLSTR" % $EXPR
+        - metavariable-pattern:
+            metavariable: $HTMLSTR
+            language: generic
+            pattern: <$TAG ...
+- id: bash.curl.security.curl-eval.curl-eval
   severity: WARNING
-  message: It looks like MD5 is used as a password hash. MD5 is not considered a secure
-    password hash because it can be cracked by an attacker in a short amount of time.
-    Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use
-    `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1")`
-    or, if using Spring, `org.springframework.security.crypto.bcrypt`.
-  metadata:
-    category: security
-    technology:
-    - java
-    - md5
-    references:
-    - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html
-    - https://github.com/returntocorp/semgrep-rules/issues/1609
-    - https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory
-    - https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.html
+  languages:
+  - bash
+  message: Data is being eval'd from a `curl` command. An attacker with control of
+    the server in the `curl` command could inject malicious code into the `eval`,
+    resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If
+    you must do this, consider checking the SHA sum of the content returned by the
+    server to verify its integrity.
+  metadata:
     owasp:
-    - A03:2017 - Sensitive Data Exposure
-    - A02:2021 - Cryptographic Failures
-    - A04:2025 - Cryptographic Failures
+    - A03:2021 - Injection
+    - A05:2025 - Injection
     cwe:
-    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
+    - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
+      (''Eval Injection'')'
+    category: security
+    technology:
+    - bash
+    - curl
+    confidence: MEDIUM
+    references:
+    - https://owasp.org/Top10/A03_2021-Injection
     subcategory:
     - vuln
-    likelihood: HIGH
+    likelihood: MEDIUM
     impact: MEDIUM
-    confidence: MEDIUM
     license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
     vulnerability_class:
-    - Cryptographic Issues
-    source: https://semgrep.dev/r/java.lang.security.audit.md5-used-as-password.md5-used-as-password
-    shortlink: https://sg.run/JxEQ
+    - Code Injection
+    source: https://semgrep.dev/r/bash.curl.security.curl-eval.curl-eval
+    shortlink: https://sg.run/0yqJ
     semgrep.dev:
       rule:
-        r_id: 14690
-        rv_id: 1263029
-        rule_id: JDULAW
-        version_id: bZT53QB
-        url: https://semgrep.dev/playground/r/bZT53QB/java.lang.security.audit.md5-used-as-password.md5-used-as-password
+        r_id: 14554
+        rv_id: 1262601
+        rule_id: KxU7Rq
+        version_id: JdTzxL2
+        url: https://semgrep.dev/playground/r/JdTzxL2/bash.curl.security.curl-eval.curl-eval
         origin: community
   mode: taint
   pattern-sources:
-  - patterns:
-    - pattern-inside: |
-        $TYPE $MD = MessageDigest.getInstance("MD5");
-        ...
-    - pattern: $MD.digest(...);
+  - pattern: |
+      $(curl ...)
+  - pattern: |
+      `curl ...`
   pattern-sinks:
-  - patterns:
-    - pattern: $MODEL.$METHOD(...);
-    - metavariable-regex:
-        metavariable: $METHOD
-        regex: (?i)(.*password.*)
-- id: javascript.express.security.injection.raw-html-format.raw-html-format
-  message: User data flows into the host portion of this manually-constructed HTML.
-    This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from
-    user-provided input. Consider using a sanitization library such as DOMPurify to
-    sanitize the HTML within.
+  - pattern: eval ...
+- id: python.flask.security.injection.tainted-url-host.tainted-url-host
+  languages:
+  - python
+  message: User data flows into the host portion of this manually-constructed URL.
+    This could allow an attacker to send data to their own server, potentially exposing
+    sensitive data such as cookies or authorization information sent with this request.
+    They could also probe internal servers or other resources that the server running
+    this code can access. (This is called server-side request forgery, or SSRF.) Do
+    not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or
+    hardcode the correct host.
   metadata:
     cwe:
-    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
-      Scripting'')'
+    - 'CWE-918: Server-Side Request Forgery (SSRF)'
     owasp:
-    - A07:2017 - Cross-Site Scripting (XSS)
-    - A03:2021 - Injection
-    - A05:2025 - Injection
+    - A10:2021 - Server-Side Request Forgery (SSRF)
+    - A01:2025 - Broken Access Control
     references:
-    - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
+    - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
     category: security
     technology:
-    - express
+    - flask
     cwe2022-top25: true
     cwe2021-top25: true
     subcategory:
     - vuln
-    likelihood: HIGH
     impact: MEDIUM
+    likelihood: MEDIUM
     confidence: MEDIUM
     license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
     vulnerability_class:
-    - Cross-Site-Scripting (XSS)
-    source: https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format
-    shortlink: https://sg.run/5DO3
+    - Server-Side Request Forgery (SSRF)
+    source: https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host
+    shortlink: https://sg.run/RXpK
     semgrep.dev:
       rule:
-        r_id: 14691
-        rv_id: 1263175
-        rule_id: 5rUL0X
-        version_id: NdTzyQv
-        url: https://semgrep.dev/playground/r/NdTzyQv/javascript.express.security.injection.raw-html-format.raw-html-format
+        r_id: 14649
+        rv_id: 1409403
+        rule_id: ReU3Wb
+        version_id: BjTy42w
+        url: https://semgrep.dev/playground/r/BjTy42w/python.flask.security.injection.tainted-url-host.tainted-url-host
         origin: community
-  languages:
-  - javascript
-  - typescript
-  severity: WARNING
   mode: taint
-  pattern-sources:
-  - label: EXPRESS
-    patterns:
-    - pattern-either:
-      - pattern-inside: function ... ($REQ, $RES) {...}
-      - pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
-      - patterns:
-        - pattern-either:
-          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
-          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
-        - metavariable-regex:
-            metavariable: $METHOD
-            regex: ^(get|post|put|head|delete|options)$
-    - pattern-either:
-      - pattern: $REQ.query
-      - pattern: $REQ.body
-      - pattern: $REQ.params
-      - pattern: $REQ.cookies
-      - pattern: $REQ.headers
-  - label: EXPRESSTS
-    patterns:
-    - pattern-either:
-      - pattern-inside: |
-          ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
-          {...}
-      - pattern-inside: |
-          ({ $REQ }: Request,$RES: Response) => {...}
-    - focus-metavariable: $REQ
-    - pattern-either:
-      - pattern: params
-      - pattern: query
-      - pattern: cookies
-      - pattern: headers
-      - pattern: body
-  - label: CLEAN
-    by-side-effect: true
-    patterns:
-    - pattern-either:
-      - pattern: $A($SOURCE)
-      - pattern: $SANITIZE. ... .$A($SOURCE)
-      - pattern: $A. ... .$SANITIZE($SOURCE)
-    - focus-metavariable: $SOURCE
-    - metavariable-regex:
-        metavariable: $A
-        regex: (?i)(.*valid|.*sanitiz)
   pattern-sinks:
-  - requires: (EXPRESS and not CLEAN) or (EXPRESSTS and not CLEAN)
-    patterns:
+  - patterns:
     - pattern-either:
       - patterns:
-        - pattern-either:
-          - pattern: '"$HTMLSTR" + $EXPR'
-          - pattern: '"$HTMLSTR".concat(...)'
-          - pattern: util.format($HTMLSTR, ...)
+        - pattern: '"$URLSTR" % ...'
         - metavariable-pattern:
-            metavariable: $HTMLSTR
+            metavariable: $URLSTR
             language: generic
-            pattern: <$TAG ...
+            patterns:
+            - pattern-either:
+              - pattern: $SCHEME://%s
+              - pattern: $SCHEME://%r
       - patterns:
-        - pattern: |
-            `...`
-        - pattern-regex: |
-            .*<\w+.*
-- id: kotlin.lang.security.ecb-cipher.ecb-cipher
+        - pattern: '"$URLSTR".format(...)'
+        - metavariable-pattern:
+            metavariable: $URLSTR
+            language: generic
+            pattern: $SCHEME:// { ... }
+      - patterns:
+        - pattern: '"$URLSTR" + ...'
+        - metavariable-regex:
+            metavariable: $URLSTR
+            regex: .*://$
+      - patterns:
+        - pattern: f"$URLSTR{...}..."
+        - metavariable-regex:
+            metavariable: $URLSTR
+            regex: .*://$
+      - patterns:
+        - pattern-inside: |
+            $URL = "$URLSTR"
+            ...
+        - pattern: $URL += ...
+        - metavariable-regex:
+            metavariable: $URLSTR
+            regex: .*://$
+  pattern-sources:
+  - patterns:
+    - pattern-either:
+      - pattern: flask.request.$ANYTHING
+      - patterns:
+        - pattern-inside: |
+            @$APP.route(...)
+            def $FUNC(..., $ROUTEVAR, ...):
+              ...
+        - pattern: $ROUTEVAR
+  severity: WARNING
+- id: go.lang.security.audit.md5-used-as-password.md5-used-as-password
+  languages:
+  - go
+  severity: WARNING
+  message: It looks like MD5 is used as a password hash. MD5 is not considered a secure
+    password hash because it can be cracked by an attacker in a short amount of time.
+    Use a suitable password hashing function such as bcrypt. You can use the `golang.org/x/crypto/bcrypt`
+    package.
+  options:
+    interfile: true
   metadata:
-    cwe:
-    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
+    category: security
+    technology:
+    - md5
+    references:
+    - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html
+    - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords
+    - https://github.com/returntocorp/semgrep-rules/issues/1609
+    - https://pkg.go.dev/golang.org/x/crypto/bcrypt
     owasp:
     - A03:2017 - Sensitive Data Exposure
     - A02:2021 - Cryptographic Failures
     - A04:2025 - Cryptographic Failures
-    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#ECB_MODE
-    category: security
-    technology:
-    - kotlin
-    references:
-    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
+    cwe:
+    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
+    confidence: MEDIUM
     subcategory:
     - vuln
-    likelihood: LOW
+    likelihood: MEDIUM
     impact: MEDIUM
-    confidence: MEDIUM
+    interfile: true
     license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
     vulnerability_class:
     - Cryptographic Issues
-    source: https://semgrep.dev/r/kotlin.lang.security.ecb-cipher.ecb-cipher
-    shortlink: https://sg.run/DzLj
+    source: https://semgrep.dev/r/go.lang.security.audit.md5-used-as-password.md5-used-as-password
+    shortlink: https://sg.run/4eOE
     semgrep.dev:
       rule:
-        r_id: 14696
-        rv_id: 1263263
-        rule_id: DbU1Zd
-        version_id: YDTZexg
-        url: https://semgrep.dev/playground/r/YDTZexg/kotlin.lang.security.ecb-cipher.ecb-cipher
-        origin: community
-  message: Cipher in ECB mode is detected. ECB mode produces the same output for the
-    same input each time which allows an attacker to intercept and replay the data.
-    Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY.
-  severity: WARNING
+        r_id: 14688
+        rv_id: 1262938
+        rule_id: 4bU1Wj
+        version_id: nWT2L9r
+        url: https://semgrep.dev/playground/r/nWT2L9r/go.lang.security.audit.md5-used-as-password.md5-used-as-password
+        origin: community
+  mode: taint
+  pattern-sources:
+  - patterns:
+    - pattern-either:
+      - pattern: md5.New
+      - pattern: md5.Sum
+  pattern-sinks:
+  - patterns:
+    - pattern: $FUNCTION(...)
+    - metavariable-regex:
+        metavariable: $FUNCTION
+        regex: (?i)(.*password.*)
+- id: go.lang.security.injection.tainted-sql-string.tainted-sql-string
   languages:
-  - kt
-  patterns:
-  - pattern-either:
-    - pattern: |
-        val $VAR : Cipher = $CIPHER.getInstance($MODE)
-    - pattern: |
-        var $VAR : Cipher = $CIPHER.getInstance($MODE)
-    - pattern: |
-        val $VAR = $CIPHER.getInstance($MODE)
-    - pattern: |
-        var $VAR = $CIPHER.getInstance($MODE)
-  - metavariable-regex:
-      metavariable: $MODE
-      regex: .*ECB.*
-- id: kotlin.lang.security.no-null-cipher.no-null-cipher
-  pattern: NullCipher(...)
+  - go
+  message: User data flows into this manually-constructed SQL string. User data can
+    be safely inserted into SQL strings using prepared statements or an object-relational
+    mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL
+    injection, which could let an attacker steal or manipulate data from the database.
+    Instead, use prepared statements (`db.Query("SELECT * FROM t WHERE id = ?", id)`)
+    or a safe library.
+  options:
+    interfile: true
   metadata:
     cwe:
-    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
+    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
+      (''SQL Injection'')'
     owasp:
-    - A03:2017 - Sensitive Data Exposure
-    - A02:2021 - Cryptographic Failures
-    - A04:2025 - Cryptographic Failures
-    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#NULL_CIPHER
-    asvs:
-      section: V6 Stored Cryptography Verification Requirements
-      control_id: 6.2.5 Insecure Algorithm
-      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
-      version: '4'
+    - A01:2017 - Injection
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    references:
+    - https://golang.org/doc/database/sql-injection
+    - https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/
     category: security
     technology:
-    - kotlin
-    references:
-    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
+    - go
+    confidence: HIGH
+    cwe2022-top25: true
+    cwe2021-top25: true
     subcategory:
     - vuln
-    likelihood: LOW
+    likelihood: HIGH
     impact: MEDIUM
-    confidence: MEDIUM
+    interfile: true
     license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
     vulnerability_class:
-    - Cryptographic Issues
-    source: https://semgrep.dev/r/kotlin.lang.security.no-null-cipher.no-null-cipher
-    shortlink: https://sg.run/0ywb
+    - SQL Injection
+    source: https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string
+    shortlink: https://sg.run/PbEq
     semgrep.dev:
       rule:
-        r_id: 14698
-        rv_id: 1263265
-        rule_id: 0oU2Yy
-        version_id: o5TbDPj
-        url: https://semgrep.dev/playground/r/o5TbDPj/kotlin.lang.security.no-null-cipher.no-null-cipher
+        r_id: 14689
+        rv_id: 1409388
+        rule_id: PeUoqy
+        version_id: nWTQ5qD
+        url: https://semgrep.dev/playground/r/nWTQ5qD/go.lang.security.injection.tainted-sql-string.tainted-sql-string
         origin: community
-  message: 'NullCipher was detected. This will not encrypt anything; the cipher text
-    will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING").
-    See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for
-    more information.'
-  severity: WARNING
-  languages:
-  - kt
-  - scala
-- id: kotlin.lang.security.use-of-md5.use-of-md5
-  message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision
-    resistant and is therefore not suitable as a cryptographic signature. Use SHA256
-    or SHA3 instead.
+  mode: taint
+  severity: ERROR
+  pattern-sources:
+  - patterns:
+    - pattern-either:
+      - pattern: |
+          ($REQUEST : *http.Request).$ANYTHING
+      - pattern: |
+          ($REQUEST : http.Request).$ANYTHING
+    - metavariable-regex:
+        metavariable: $ANYTHING
+        regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
+  pattern-sinks:
+  - patterns:
+    - pattern-either:
+      - patterns:
+        - pattern-either:
+          - pattern: |
+              "$SQLSTR" + ...
+          - patterns:
+            - pattern-inside: |
+                $VAR = "$SQLSTR";
+                ...
+            - pattern: $VAR += ...
+          - patterns:
+            - pattern-inside: |
+                var $SB strings.Builder
+                ...
+            - pattern-inside: |
+                $SB.WriteString("$SQLSTR")
+                ...
+                $SB.String(...)
+            - pattern: |
+                $SB.WriteString(...)
+        - metavariable-regex:
+            metavariable: $SQLSTR
+            regex: (?i)(select|delete|insert|create|update|alter|drop).*
+      - patterns:
+        - pattern-either:
+          - pattern: fmt.Fprintf($F, "$SQLSTR", ...)
+          - pattern: fmt.Sprintf("$SQLSTR", ...)
+          - pattern: fmt.Printf("$SQLSTR", ...)
+        - metavariable-regex:
+            metavariable: $SQLSTR
+            regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).*
+  pattern-sanitizers:
+  - pattern-either:
+    - pattern: strconv.Atoi(...)
+    - pattern: |
+        ($X: bool)
+- id: java.lang.security.audit.md5-used-as-password.md5-used-as-password
   languages:
-  - kt
+  - java
   severity: WARNING
+  message: It looks like MD5 is used as a password hash. MD5 is not considered a secure
+    password hash because it can be cracked by an attacker in a short amount of time.
+    Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use
+    `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1")`
+    or, if using Spring, `org.springframework.security.crypto.bcrypt`.
   metadata:
+    category: security
+    technology:
+    - java
+    - md5
+    references:
+    - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html
+    - https://github.com/returntocorp/semgrep-rules/issues/1609
+    - https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory
+    - https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.html
     owasp:
     - A03:2017 - Sensitive Data Exposure
     - A02:2021 - Cryptographic Failures
     - A04:2025 - Cryptographic Failures
     cwe:
-    - 'CWE-328: Use of Weak Hash'
-    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_MD5
-    category: security
-    technology:
-    - kotlin
-    references:
-    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
+    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
     subcategory:
     - vuln
-    likelihood: LOW
+    likelihood: HIGH
     impact: MEDIUM
     confidence: MEDIUM
     license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
     vulnerability_class:
-    - Insecure Hashing Algorithm
-    source: https://semgrep.dev/r/kotlin.lang.security.use-of-md5.use-of-md5
-    shortlink: https://sg.run/4eQx
+    - Cryptographic Issues
+    source: https://semgrep.dev/r/java.lang.security.audit.md5-used-as-password.md5-used-as-password
+    shortlink: https://sg.run/JxEQ
     semgrep.dev:
       rule:
-        r_id: 14700
-        rv_id: 1263267
-        rule_id: qNUXPj
-        version_id: pZT03Jd
-        url: https://semgrep.dev/playground/r/pZT03Jd/kotlin.lang.security.use-of-md5.use-of-md5
+        r_id: 14690
+        rv_id: 1263029
+        rule_id: JDULAW
+        version_id: bZT53QB
+        url: https://semgrep.dev/playground/r/bZT53QB/java.lang.security.audit.md5-used-as-password.md5-used-as-password
         origin: community
-  pattern-either:
-  - pattern: |
-      java.security.MessageDigest.getInstance("MD5")
-  - pattern: |
-      org.apache.commons.codec.digest.DigestUtils.getMd5Digest()
-- id: python.flask.security.injection.tainted-sql-string.tainted-sql-string
-  message: Detected user input used to manually construct a SQL string. This is usually
-    bad practice because manual construction could accidentally result in a SQL injection.
-    An attacker could use a SQL injection to steal or modify contents of the database.
-    Instead, use a parameterized query which is available by default in most database
-    engines. Alternatively, consider using an object-relational mapper (ORM) such
-    as SQLAlchemy which will protect your queries.
+  mode: taint
+  pattern-sources:
+  - patterns:
+    - pattern-inside: |
+        $TYPE $MD = MessageDigest.getInstance("MD5");
+        ...
+    - pattern: $MD.digest(...);
+  pattern-sinks:
+  - patterns:
+    - pattern: $MODEL.$METHOD(...);
+    - metavariable-regex:
+        metavariable: $METHOD
+        regex: (?i)(.*password.*)
+- id: javascript.express.security.injection.raw-html-format.raw-html-format
+  message: User data flows into the host portion of this manually-constructed HTML.
+    This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from
+    user-provided input. Consider using a sanitization library such as DOMPurify to
+    sanitize the HTML within.
   metadata:
     cwe:
-    - 'CWE-704: Incorrect Type Conversion or Cast'
+    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
+      Scripting'')'
     owasp:
-    - A01:2017 - Injection
+    - A07:2017 - Cross-Site Scripting (XSS)
     - A03:2021 - Injection
     - A05:2025 - Injection
     references:
-    - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql
-    - https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm
-    - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column
+    - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
     category: security
     technology:
-    - sqlalchemy
-    - flask
+    - express
+    cwe2022-top25: true
+    cwe2021-top25: true
     subcategory:
     - vuln
+    likelihood: HIGH
     impact: MEDIUM
-    likelihood: MEDIUM
     confidence: MEDIUM
     license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
     vulnerability_class:
-    - Improper Validation
-    source: https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string
-    shortlink: https://sg.run/JxZj
+    - Cross-Site-Scripting (XSS)
+    source: https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format
+    shortlink: https://sg.run/5DO3
     semgrep.dev:
       rule:
-        r_id: 14702
-        rv_id: 1409402
-        rule_id: YGUDKQ
-        version_id: A8TEvb4
-        url: https://semgrep.dev/playground/r/A8TEvb4/python.flask.security.injection.tainted-sql-string.tainted-sql-string
-        origin: community
-  severity: ERROR
-  languages:
-  - python
+        r_id: 14691
+        rv_id: 1263175
+        rule_id: 5rUL0X
+        version_id: NdTzyQv
+        url: https://semgrep.dev/playground/r/NdTzyQv/javascript.express.security.injection.raw-html-format.raw-html-format
+        origin: community
+  languages:
+  - javascript
+  - typescript
+  severity: WARNING
   mode: taint
   pattern-sources:
-  - patterns:
+  - label: EXPRESS
+    patterns:
     - pattern-either:
-      - pattern: flask.request.$ANYTHING
+      - pattern-inside: function ... ($REQ, $RES) {...}
+      - pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
       - patterns:
-        - pattern-inside: |
-            @$APP.route(...)
-            def $FUNC(..., $ROUTEVAR, ...):
-              ...
-        - pattern: $ROUTEVAR
-  pattern-sinks:
-  - patterns:
+        - pattern-either:
+          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
+          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
+        - metavariable-regex:
+            metavariable: $METHOD
+            regex: ^(get|post|put|head|delete|options)$
     - pattern-either:
-      - pattern: |
-          "$SQLSTR" + ...
-      - pattern: |
-          "$SQLSTR" % ...
-      - pattern: |
-          "$SQLSTR".format(...)
-      - pattern: |
-          f"$SQLSTR{...}..."
+      - pattern: $REQ.query
+      - pattern: $REQ.body
+      - pattern: $REQ.params
+      - pattern: $REQ.cookies
+      - pattern: $REQ.headers
+  - label: EXPRESSTS
+    patterns:
+    - pattern-either:
+      - pattern-inside: |
+          ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
+          {...}
+      - pattern-inside: |
+          ({ $REQ }: Request,$RES: Response) => {...}
+    - focus-metavariable: $REQ
+    - pattern-either:
+      - pattern: params
+      - pattern: query
+      - pattern: cookies
+      - pattern: headers
+      - pattern: body
+  - label: CLEAN
+    by-side-effect: true
+    patterns:
+    - pattern-either:
+      - pattern: $A($SOURCE)
+      - pattern: $SANITIZE. ... .$A($SOURCE)
+      - pattern: $A. ... .$SANITIZE($SOURCE)
+    - focus-metavariable: $SOURCE
     - metavariable-regex:
-        metavariable: $SQLSTR
-        regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*
-- id: python.lang.security.audit.md5-used-as-password.md5-used-as-password
-  severity: WARNING
-  message: It looks like MD5 is used as a password hash. MD5 is not considered a secure
-    password hash because it can be cracked by an attacker in a short amount of time.
-    Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`.
-  languages:
-  - python
+        metavariable: $A
+        regex: (?i)(.*valid|.*sanitiz)
+  pattern-sinks:
+  - requires: (EXPRESS and not CLEAN) or (EXPRESSTS and not CLEAN)
+    patterns:
+    - pattern-either:
+      - patterns:
+        - pattern-either:
+          - pattern: '"$HTMLSTR" + $EXPR'
+          - pattern: '"$HTMLSTR".concat(...)'
+          - pattern: util.format($HTMLSTR, ...)
+        - metavariable-pattern:
+            metavariable: $HTMLSTR
+            language: generic
+            pattern: <$TAG ...
+      - patterns:
+        - pattern: |
+            `...`
+        - pattern-regex: |
+            .*<\w+.*
+- id: kotlin.lang.security.ecb-cipher.ecb-cipher
   metadata:
     cwe:
     - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
@@ -18130,127 +18049,341 @@ rules:
     - A03:2017 - Sensitive Data Exposure
     - A02:2021 - Cryptographic Failures
     - A04:2025 - Cryptographic Failures
-    references:
-    - https://tools.ietf.org/html/rfc6151
-    - https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision
-    - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
-    - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords
-    - https://github.com/returntocorp/semgrep-rules/issues/1609
-    - https://docs.python.org/3/library/hashlib.html#hashlib.scrypt
+    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#ECB_MODE
     category: security
     technology:
-    - pycryptodome
-    - hashlib
-    - md5
+    - kotlin
+    references:
+    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
     subcategory:
     - vuln
-    likelihood: HIGH
-    impact: LOW
+    likelihood: LOW
+    impact: MEDIUM
     confidence: MEDIUM
     license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
     vulnerability_class:
     - Cryptographic Issues
-    source: https://semgrep.dev/r/python.lang.security.audit.md5-used-as-password.md5-used-as-password
-    shortlink: https://sg.run/5DwD
+    source: https://semgrep.dev/r/kotlin.lang.security.ecb-cipher.ecb-cipher
+    shortlink: https://sg.run/DzLj
     semgrep.dev:
       rule:
-        r_id: 14703
-        rv_id: 1263504
-        rule_id: 6JU1w1
-        version_id: WrTqKDz
-        url: https://semgrep.dev/playground/r/WrTqKDz/python.lang.security.audit.md5-used-as-password.md5-used-as-password
+        r_id: 14696
+        rv_id: 1263263
+        rule_id: DbU1Zd
+        version_id: YDTZexg
+        url: https://semgrep.dev/playground/r/YDTZexg/kotlin.lang.security.ecb-cipher.ecb-cipher
         origin: community
-  mode: taint
-  pattern-sources:
-  - patterns:
-    - pattern-either:
-      - pattern: hashlib.md5
-      - pattern: hashlib.new(..., name="MD5", ...)
-      - pattern: Cryptodome.Hash.MD5
-      - pattern: Crypto.Hash.MD5
-      - pattern: cryptography.hazmat.primitives.hashes.MD5
-  pattern-sinks:
-  - patterns:
-    - pattern: $FUNCTION(...)
-    - metavariable-regex:
-        metavariable: $FUNCTION
-        regex: (?i)(.*password.*)
-- id: ruby.lang.security.md5-used-as-password.md5-used-as-password
-  languages:
-  - ruby
+  message: Cipher in ECB mode is detected. ECB mode produces the same output for the
+    same input each time which allows an attacker to intercept and replay the data.
+    Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY.
   severity: WARNING
-  message: It looks like MD5 is used as a password hash. MD5 is not considered a secure
-    password hash because it can be cracked by an attacker in a short amount of time.
-    Instead, use a suitable password hashing function such as bcrypt. You can use
-    the `bcrypt` gem.
+  languages:
+  - kt
+  patterns:
+  - pattern-either:
+    - pattern: |
+        val $VAR : Cipher = $CIPHER.getInstance($MODE)
+    - pattern: |
+        var $VAR : Cipher = $CIPHER.getInstance($MODE)
+    - pattern: |
+        val $VAR = $CIPHER.getInstance($MODE)
+    - pattern: |
+        var $VAR = $CIPHER.getInstance($MODE)
+  - metavariable-regex:
+      metavariable: $MODE
+      regex: .*ECB.*
+- id: kotlin.lang.security.no-null-cipher.no-null-cipher
+  pattern: NullCipher(...)
   metadata:
-    category: security
-    technology:
-    - md5
-    references:
-    - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html
-    - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords
-    - https://github.com/returntocorp/semgrep-rules/issues/1609
+    cwe:
+    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
     owasp:
     - A03:2017 - Sensitive Data Exposure
     - A02:2021 - Cryptographic Failures
     - A04:2025 - Cryptographic Failures
-    cwe:
-    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
+    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#NULL_CIPHER
+    asvs:
+      section: V6 Stored Cryptography Verification Requirements
+      control_id: 6.2.5 Insecure Algorithm
+      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
+      version: '4'
+    category: security
+    technology:
+    - kotlin
+    references:
+    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
     subcategory:
     - vuln
-    likelihood: HIGH
+    likelihood: LOW
     impact: MEDIUM
     confidence: MEDIUM
     license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
     vulnerability_class:
     - Cryptographic Issues
-    source: https://semgrep.dev/r/ruby.lang.security.md5-used-as-password.md5-used-as-password
-    shortlink: https://sg.run/GOZy
+    source: https://semgrep.dev/r/kotlin.lang.security.no-null-cipher.no-null-cipher
+    shortlink: https://sg.run/0ywb
     semgrep.dev:
       rule:
-        r_id: 14704
-        rv_id: 1263611
-        rule_id: oqU4p2
-        version_id: JdTzx0e
-        url: https://semgrep.dev/playground/r/JdTzx0e/ruby.lang.security.md5-used-as-password.md5-used-as-password
+        r_id: 14698
+        rv_id: 1263265
+        rule_id: 0oU2Yy
+        version_id: o5TbDPj
+        url: https://semgrep.dev/playground/r/o5TbDPj/kotlin.lang.security.no-null-cipher.no-null-cipher
         origin: community
-  mode: taint
-  pattern-sources:
-  - pattern: Digest::MD5
-  pattern-sinks:
-  - patterns:
-    - pattern: $FUNCTION(...);
-    - metavariable-regex:
-        metavariable: $FUNCTION
-        regex: (?i)(.*password.*)
-- id: ruby.rails.security.injection.tainted-url-host.tainted-url-host
+  message: 'NullCipher was detected. This will not encrypt anything; the cipher text
+    will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING").
+    See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for
+    more information.'
+  severity: WARNING
   languages:
-  - ruby
+  - kt
+  - scala
+- id: kotlin.lang.security.use-of-md5.use-of-md5
+  message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision
+    resistant and is therefore not suitable as a cryptographic signature. Use SHA256
+    or SHA3 instead.
+  languages:
+  - kt
   severity: WARNING
-  message: User data flows into the host portion of this manually-constructed URL.
-    This could allow an attacker to send data to their own server, potentially exposing
-    sensitive data such as cookies or authorization information sent with this request.
-    They could also probe internal servers or other resources that the server running
-    this code can access. (This is called server-side request forgery, or SSRF.) Do
-    not allow arbitrary hosts. Use the `ssrf_filter` gem and guard the url construction
-    with `SsrfFilter(...)`, or create an allowlist for approved hosts.
   metadata:
-    cwe:
-    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
-      Scripting'')'
     owasp:
-    - A07:2017 - Cross-Site Scripting (XSS)
-    - A03:2021 - Injection
-    - A05:2025 - Injection
+    - A03:2017 - Sensitive Data Exposure
+    - A02:2021 - Cryptographic Failures
+    - A04:2025 - Cryptographic Failures
+    cwe:
+    - 'CWE-328: Use of Weak Hash'
+    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_MD5
     category: security
     technology:
-    - rails
+    - kotlin
     references:
-    - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
-    - https://github.com/arkadiyt/ssrf_filter
-    cwe2022-top25: true
-    cwe2021-top25: true
+    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
+    subcategory:
+    - vuln
+    likelihood: LOW
+    impact: MEDIUM
+    confidence: MEDIUM
+    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
+    vulnerability_class:
+    - Insecure Hashing Algorithm
+    source: https://semgrep.dev/r/kotlin.lang.security.use-of-md5.use-of-md5
+    shortlink: https://sg.run/4eQx
+    semgrep.dev:
+      rule:
+        r_id: 14700
+        rv_id: 1263267
+        rule_id: qNUXPj
+        version_id: pZT03Jd
+        url: https://semgrep.dev/playground/r/pZT03Jd/kotlin.lang.security.use-of-md5.use-of-md5
+        origin: community
+  pattern-either:
+  - pattern: |
+      java.security.MessageDigest.getInstance("MD5")
+  - pattern: |
+      org.apache.commons.codec.digest.DigestUtils.getMd5Digest()
+- id: python.flask.security.injection.tainted-sql-string.tainted-sql-string
+  message: Detected user input used to manually construct a SQL string. This is usually
+    bad practice because manual construction could accidentally result in a SQL injection.
+    An attacker could use a SQL injection to steal or modify contents of the database.
+    Instead, use a parameterized query which is available by default in most database
+    engines. Alternatively, consider using an object-relational mapper (ORM) such
+    as SQLAlchemy which will protect your queries.
+  metadata:
+    cwe:
+    - 'CWE-704: Incorrect Type Conversion or Cast'
+    owasp:
+    - A01:2017 - Injection
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    references:
+    - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql
+    - https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm
+    - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column
+    category: security
+    technology:
+    - sqlalchemy
+    - flask
+    subcategory:
+    - vuln
+    impact: MEDIUM
+    likelihood: MEDIUM
+    confidence: MEDIUM
+    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
+    vulnerability_class:
+    - Improper Validation
+    source: https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string
+    shortlink: https://sg.run/JxZj
+    semgrep.dev:
+      rule:
+        r_id: 14702
+        rv_id: 1409402
+        rule_id: YGUDKQ
+        version_id: A8TEvb4
+        url: https://semgrep.dev/playground/r/A8TEvb4/python.flask.security.injection.tainted-sql-string.tainted-sql-string
+        origin: community
+  severity: ERROR
+  languages:
+  - python
+  mode: taint
+  pattern-sources:
+  - patterns:
+    - pattern-either:
+      - pattern: flask.request.$ANYTHING
+      - patterns:
+        - pattern-inside: |
+            @$APP.route(...)
+            def $FUNC(..., $ROUTEVAR, ...):
+              ...
+        - pattern: $ROUTEVAR
+  pattern-sinks:
+  - patterns:
+    - pattern-either:
+      - pattern: |
+          "$SQLSTR" + ...
+      - pattern: |
+          "$SQLSTR" % ...
+      - pattern: |
+          "$SQLSTR".format(...)
+      - pattern: |
+          f"$SQLSTR{...}..."
+    - metavariable-regex:
+        metavariable: $SQLSTR
+        regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*
+- id: python.lang.security.audit.md5-used-as-password.md5-used-as-password
+  severity: WARNING
+  message: It looks like MD5 is used as a password hash. MD5 is not considered a secure
+    password hash because it can be cracked by an attacker in a short amount of time.
+    Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`.
+  languages:
+  - python
+  metadata:
+    cwe:
+    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
+    owasp:
+    - A03:2017 - Sensitive Data Exposure
+    - A02:2021 - Cryptographic Failures
+    - A04:2025 - Cryptographic Failures
+    references:
+    - https://tools.ietf.org/html/rfc6151
+    - https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision
+    - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
+    - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords
+    - https://github.com/returntocorp/semgrep-rules/issues/1609
+    - https://docs.python.org/3/library/hashlib.html#hashlib.scrypt
+    category: security
+    technology:
+    - pycryptodome
+    - hashlib
+    - md5
+    subcategory:
+    - vuln
+    likelihood: HIGH
+    impact: LOW
+    confidence: MEDIUM
+    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
+    vulnerability_class:
+    - Cryptographic Issues
+    source: https://semgrep.dev/r/python.lang.security.audit.md5-used-as-password.md5-used-as-password
+    shortlink: https://sg.run/5DwD
+    semgrep.dev:
+      rule:
+        r_id: 14703
+        rv_id: 1263504
+        rule_id: 6JU1w1
+        version_id: WrTqKDz
+        url: https://semgrep.dev/playground/r/WrTqKDz/python.lang.security.audit.md5-used-as-password.md5-used-as-password
+        origin: community
+  mode: taint
+  pattern-sources:
+  - patterns:
+    - pattern-either:
+      - pattern: hashlib.md5
+      - pattern: hashlib.new(..., name="MD5", ...)
+      - pattern: Cryptodome.Hash.MD5
+      - pattern: Crypto.Hash.MD5
+      - pattern: cryptography.hazmat.primitives.hashes.MD5
+  pattern-sinks:
+  - patterns:
+    - pattern: $FUNCTION(...)
+    - metavariable-regex:
+        metavariable: $FUNCTION
+        regex: (?i)(.*password.*)
+- id: ruby.lang.security.md5-used-as-password.md5-used-as-password
+  languages:
+  - ruby
+  severity: WARNING
+  message: It looks like MD5 is used as a password hash. MD5 is not considered a secure
+    password hash because it can be cracked by an attacker in a short amount of time.
+    Instead, use a suitable password hashing function such as bcrypt. You can use
+    the `bcrypt` gem.
+  metadata:
+    category: security
+    technology:
+    - md5
+    references:
+    - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html
+    - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords
+    - https://github.com/returntocorp/semgrep-rules/issues/1609
+    owasp:
+    - A03:2017 - Sensitive Data Exposure
+    - A02:2021 - Cryptographic Failures
+    - A04:2025 - Cryptographic Failures
+    cwe:
+    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
+    subcategory:
+    - vuln
+    likelihood: HIGH
+    impact: MEDIUM
+    confidence: MEDIUM
+    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
+    vulnerability_class:
+    - Cryptographic Issues
+    source: https://semgrep.dev/r/ruby.lang.security.md5-used-as-password.md5-used-as-password
+    shortlink: https://sg.run/GOZy
+    semgrep.dev:
+      rule:
+        r_id: 14704
+        rv_id: 1263611
+        rule_id: oqU4p2
+        version_id: JdTzx0e
+        url: https://semgrep.dev/playground/r/JdTzx0e/ruby.lang.security.md5-used-as-password.md5-used-as-password
+        origin: community
+  mode: taint
+  pattern-sources:
+  - pattern: Digest::MD5
+  pattern-sinks:
+  - patterns:
+    - pattern: $FUNCTION(...);
+    - metavariable-regex:
+        metavariable: $FUNCTION
+        regex: (?i)(.*password.*)
+- id: ruby.rails.security.injection.tainted-url-host.tainted-url-host
+  languages:
+  - ruby
+  severity: WARNING
+  message: User data flows into the host portion of this manually-constructed URL.
+    This could allow an attacker to send data to their own server, potentially exposing
+    sensitive data such as cookies or authorization information sent with this request.
+    They could also probe internal servers or other resources that the server running
+    this code can access. (This is called server-side request forgery, or SSRF.) Do
+    not allow arbitrary hosts. Use the `ssrf_filter` gem and guard the url construction
+    with `SsrfFilter(...)`, or create an allowlist for approved hosts.
+  metadata:
+    cwe:
+    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
+      Scripting'')'
+    owasp:
+    - A07:2017 - Cross-Site Scripting (XSS)
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    category: security
+    technology:
+    - rails
+    references:
+    - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
+    - https://github.com/arkadiyt/ssrf_filter
+    cwe2022-top25: true
+    cwe2021-top25: true
     subcategory:
     - vuln
     likelihood: MEDIUM
@@ -41152,30 +41285,20 @@ rules:
   - pattern-regex: \$\{\{\s*secrets\.
   - pattern-not-inside: 'jobs: ...'
   severity: WARNING
-- id: ruby.rails.security.injection.raw-html-format.raw-html-format
-  languages:
-  - ruby
-  severity: WARNING
-  message: Detected user input flowing into a manually constructed HTML string. You
-    may be accidentally bypassing secure methods of rendering HTML by manually constructing
-    HTML and this could create a cross-site scripting vulnerability, which could let
-    attackers steal sensitive user data. Use the `render template` and make template
-    files which will safely render HTML instead, or inspect that the HTML is absolutely
-    rendered safely with a function like `sanitize`.
+- id: ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path
   metadata:
-    cwe:
-    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
-      Scripting'')'
     owasp:
-    - A07:2017 - Cross-Site Scripting (XSS)
-    - A03:2021 - Injection
-    - A05:2025 - Injection
+    - A05:2017 - Broken Access Control
+    - A01:2021 - Broken Access Control
+    - A01:2025 - Broken Access Control
+    cwe:
+    - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
+      Traversal'')'
+    references:
+    - https://brakemanscanner.org/docs/warning_types/dynamic_render_paths/
     category: security
     technology:
     - rails
-    references:
-    - https://www.netsparker.com/blog/web-security/preventing-xss-ruby-on-rails-web-applications/
-    - https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html
     cwe2022-top25: true
     cwe2021-top25: true
     subcategory:
@@ -41185,235 +41308,112 @@ rules:
     confidence: MEDIUM
     license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
     vulnerability_class:
-    - Cross-Site-Scripting (XSS)
-    source: https://semgrep.dev/r/ruby.rails.security.injection.raw-html-format.raw-html-format
-    shortlink: https://sg.run/b2JQ
+    - Path Traversal
+    source: https://semgrep.dev/r/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path
+    shortlink: https://sg.run/GO2n
     semgrep.dev:
       rule:
-        r_id: 14470
-        rv_id: 1409408
-        rule_id: kxUwZX
-        version_id: qkTvgYY
-        url: https://semgrep.dev/playground/r/qkTvgYY/ruby.rails.security.injection.raw-html-format.raw-html-format
+        r_id: 13592
+        rv_id: 1263635
+        rule_id: 6JU1bL
+        version_id: bZT53p0
+        url: https://semgrep.dev/playground/r/bZT53p0/ruby.rails.security.audit.xss.avoid-render-dynamic-path.avoid-render-dynamic-path
         origin: community
-  mode: taint
-  pattern-sanitizers:
-  - pattern-either:
-    - pattern: sanitize(...)
-    - pattern: strip_tags(...)
-  pattern-sources:
-  - patterns:
-    - pattern-either:
-      - pattern: params
-      - pattern: request
-  pattern-sinks:
-  - patterns:
-    - pattern-either:
-      - patterns:
-        - pattern: |
-            $HTMLSTR
-        - pattern-regex: <\w+.*
-      - patterns:
-        - pattern-either:
-          - pattern: Kernel::sprintf("$HTMLSTR", ...)
-          - pattern: |
-              "$HTMLSTR" + $EXPR
-          - pattern: |
-              "$HTMLSTR" % $EXPR
-        - metavariable-pattern:
-            metavariable: $HTMLSTR
-            language: generic
-            pattern: <$TAG ...
-- id: bash.curl.security.curl-eval.curl-eval
-  severity: WARNING
+  message: Avoid rendering user input. It may be possible for a malicious user to
+    input a path that lets them access a template they shouldn't. To prevent this,
+    check dynamic template paths against a predefined allowlist to make sure it's
+    an allowed template.
   languages:
-  - bash
-  message: Data is being eval'd from a `curl` command. An attacker with control of
-    the server in the `curl` command could inject malicious code into the `eval`,
-    resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If
-    you must do this, consider checking the SHA sum of the content returned by the
-    server to verify its integrity.
-  metadata:
-    owasp:
-    - A03:2021 - Injection
-    - A05:2025 - Injection
-    cwe:
-    - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
-      (''Eval Injection'')'
-    category: security
-    technology:
-    - bash
-    - curl
-    confidence: MEDIUM
-    references:
-    - https://owasp.org/Top10/A03_2021-Injection
-    subcategory:
-    - vuln
-    likelihood: MEDIUM
-    impact: MEDIUM
-    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
-    vulnerability_class:
-    - Code Injection
-    source: https://semgrep.dev/r/bash.curl.security.curl-eval.curl-eval
-    shortlink: https://sg.run/0yqJ
-    semgrep.dev:
-      rule:
-        r_id: 14554
-        rv_id: 1262601
-        rule_id: KxU7Rq
-        version_id: JdTzxL2
-        url: https://semgrep.dev/playground/r/JdTzxL2/bash.curl.security.curl-eval.curl-eval
-        origin: community
+  - ruby
+  severity: WARNING
   mode: taint
   pattern-sources:
-  - pattern: |
-      $(curl ...)
-  - pattern: |
-      `curl ...`
+  - pattern: params
+  - pattern: cookies
+  - pattern: request.env
   pattern-sinks:
-  - pattern: eval ...
-- id: python.flask.security.injection.tainted-url-host.tainted-url-host
+  - patterns:
+    - pattern-inside: render($X => $INPUT, ...)
+    - pattern: $INPUT
+    - metavariable-pattern:
+        metavariable: $X
+        pattern-either:
+        - pattern: action
+        - pattern: template
+        - pattern: partial
+        - pattern: file
+- id: python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
   languages:
   - python
-  message: User data flows into the host portion of this manually-constructed URL.
-    This could allow an attacker to send data to their own server, potentially exposing
-    sensitive data such as cookies or authorization information sent with this request.
-    They could also probe internal servers or other resources that the server running
-    this code can access. (This is called server-side request forgery, or SSRF.) Do
-    not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or
-    hardcode the correct host.
+  severity: WARNING
   metadata:
-    cwe:
-    - 'CWE-918: Server-Side Request Forgery (SSRF)'
+    category: security
     owasp:
-    - A10:2021 - Server-Side Request Forgery (SSRF)
+    - A01:2021 - Broken Access Control
     - A01:2025 - Broken Access Control
-    references:
-    - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
-    category: security
+    cwe:
+    - 'CWE-276: Incorrect Default Permissions'
     technology:
-    - flask
+    - python
+    references:
+    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
     cwe2022-top25: true
     cwe2021-top25: true
     subcategory:
     - vuln
+    likelihood: LOW
     impact: MEDIUM
-    likelihood: MEDIUM
-    confidence: MEDIUM
-    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
-    vulnerability_class:
-    - Server-Side Request Forgery (SSRF)
-    source: https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host
-    shortlink: https://sg.run/RXpK
-    semgrep.dev:
-      rule:
-        r_id: 14649
-        rv_id: 1409403
-        rule_id: ReU3Wb
-        version_id: BjTy42w
-        url: https://semgrep.dev/playground/r/BjTy42w/python.flask.security.injection.tainted-url-host.tainted-url-host
-        origin: community
-  mode: taint
-  pattern-sinks:
-  - patterns:
-    - pattern-either:
-      - patterns:
-        - pattern: '"$URLSTR" % ...'
-        - metavariable-pattern:
-            metavariable: $URLSTR
-            language: generic
-            patterns:
-            - pattern-either:
-              - pattern: $SCHEME://%s
-              - pattern: $SCHEME://%r
-      - patterns:
-        - pattern: '"$URLSTR".format(...)'
-        - metavariable-pattern:
-            metavariable: $URLSTR
-            language: generic
-            pattern: $SCHEME:// { ... }
-      - patterns:
-        - pattern: '"$URLSTR" + ...'
-        - metavariable-regex:
-            metavariable: $URLSTR
-            regex: .*://$
-      - patterns:
-        - pattern: f"$URLSTR{...}..."
-        - metavariable-regex:
-            metavariable: $URLSTR
-            regex: .*://$
-      - patterns:
-        - pattern-inside: |
-            $URL = "$URLSTR"
-            ...
-        - pattern: $URL += ...
-        - metavariable-regex:
-            metavariable: $URLSTR
-            regex: .*://$
-  pattern-sources:
-  - patterns:
-    - pattern-either:
-      - pattern: flask.request.$ANYTHING
-      - patterns:
-        - pattern-inside: |
-            @$APP.route(...)
-            def $FUNC(..., $ROUTEVAR, ...):
-              ...
-        - pattern: $ROUTEVAR
-  severity: WARNING
-- id: go.lang.security.audit.md5-used-as-password.md5-used-as-password
-  languages:
-  - go
-  severity: WARNING
-  message: It looks like MD5 is used as a password hash. MD5 is not considered a secure
-    password hash because it can be cracked by an attacker in a short amount of time.
-    Use a suitable password hashing function such as bcrypt. You can use the `golang.org/x/crypto/bcrypt`
-    package.
-  options:
-    interfile: true
-  metadata:
-    category: security
-    technology:
-    - md5
-    references:
-    - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html
-    - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords
-    - https://github.com/returntocorp/semgrep-rules/issues/1609
-    - https://pkg.go.dev/golang.org/x/crypto/bcrypt
-    owasp:
-    - A03:2017 - Sensitive Data Exposure
-    - A02:2021 - Cryptographic Failures
-    - A04:2025 - Cryptographic Failures
-    cwe:
-    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
     confidence: MEDIUM
-    subcategory:
-    - vuln
-    likelihood: MEDIUM
-    impact: MEDIUM
-    interfile: true
     license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
     vulnerability_class:
-    - Cryptographic Issues
-    source: https://semgrep.dev/r/go.lang.security.audit.md5-used-as-password.md5-used-as-password
-    shortlink: https://sg.run/4eOE
+    - Improper Authorization
+    source: https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
+    shortlink: https://sg.run/AXY4
     semgrep.dev:
       rule:
-        r_id: 14688
-        rv_id: 1262938
-        rule_id: 4bU1Wj
-        version_id: nWT2L9r
-        url: https://semgrep.dev/playground/r/nWT2L9r/go.lang.security.audit.md5-used-as-password.md5-used-as-password
+        r_id: 13594
+        rv_id: 1263482
+        rule_id: zdUYqR
+        version_id: O9Tpxqr
+        url: https://semgrep.dev/playground/r/O9Tpxqr/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
         origin: community
-  mode: taint
-  pattern-sources:
-  - patterns:
-    - pattern-either:
-      - pattern: md5.New
-      - pattern: md5.Sum
-  pattern-sinks:
-  - patterns:
-    - pattern: $FUNCTION(...)
-    - metavariable-regex:
-        metavariable: $FUNCTION
-        regex: (?i)(.*password.*)
+  message: These permissions `$BITS` are widely permissive and grant access to more
+    people than may be necessary. A good default is `0o644` which gives read and write
+    access to yourself and read access to everyone else.
+  patterns:
+  - pattern-inside: os.$METHOD(...)
+  - metavariable-pattern:
+      metavariable: $METHOD
+      patterns:
+      - pattern-either:
+        - pattern: chmod
+        - pattern: lchmod
+        - pattern: fchmod
+  - pattern-either:
+    - patterns:
+      - pattern: os.$METHOD($FILE, $BITS, ...)
+      - metavariable-comparison:
+          metavariable: $BITS
+          comparison: $BITS >= 0o650 and $BITS < 0o100000
+    - patterns:
+      - pattern: os.$METHOD($FILE, $BITS)
+      - metavariable-comparison:
+          metavariable: $BITS
+          comparison: $BITS >= 0o100650
+    - patterns:
+      - pattern: os.$METHOD($FILE, $BITS, ...)
+      - metavariable-pattern:
+          metavariable: $BITS
+          patterns:
+          - pattern-either:
+            - pattern: <... stat.S_IWGRP ...>
+            - pattern: <... stat.S_IXGRP ...>
+            - pattern: <... stat.S_IWOTH ...>
+            - pattern: <... stat.S_IXOTH ...>
+            - pattern: <... stat.S_IRWXO ...>
+            - pattern: <... stat.S_IRWXG ...>
+    - patterns:
+      - pattern: os.$METHOD($FILE, $EXPR | $MOD, ...)
+      - metavariable-comparison:
+          metavariable: $MOD
+          comparison: $MOD == 0o111