codesentry-semgrep-rules 0.1.11 → 0.3.0

package/README.md

@@ -28,6 +28,11 @@ para o racional completo.
 diferente dos runtimes por plataforma) — ele é sempre instalado junto,
 independente do sistema operacional.
 
+O manifesto `rules/ruleset.lock.json`, também exposto pelo pacote, registra a
+versão do pacote, origem, data de captura, SHA-256 e, quando disponível, a
+revisão upstream do snapshot. O comando `codesentry version --engines` lê
+esse manifesto localmente para permitir auditoria sem rede.
+
 ## Não é para instalação direta
 
 Se você quer usar o CodeSentry, instale o pacote principal:

package/package.json

@@ -1,6 +1,6 @@
 {
       "name": "codesentry-semgrep-rules",
-      "version": "0.1.11",
+      "version": "0.3.0",
       "license": "MIT",
       "description": "Snapshot local das regras OWASP do Semgrep para CodeSentry",
       "files": [
@@ -9,6 +9,7 @@
             "LICENSE"
       ],
       "exports": {
-            "./rules/owasp.yml": "./rules/owasp.yml"
+            "./rules/owasp.yml": "./rules/owasp.yml",
+            "./rules/ruleset.lock.json": "./rules/ruleset.lock.json"
       }
 }

package/rules/owasp.yml

@@ -17584,72 +17584,6 @@ rules:
             regex: ^(GET|HEAD|POST|POSTFORM)$
     - focus-metavariable: $URL
   severity: WARNING
-- id: go.lang.security.injection.raw-html-format.raw-html-format
-  languages:
-  - go
-  severity: WARNING
-  message: Detected user input flowing into a manually constructed HTML string. You
-    may be accidentally bypassing secure methods of rendering HTML by manually constructing
-    HTML and this could create a cross-site scripting vulnerability, which could let
-    attackers steal sensitive user data. Use the `html/template` package which will
-    safely render HTML instead, or inspect that the HTML is rendered safely.
-  metadata:
-    cwe:
-    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
-      Scripting'')'
-    owasp:
-    - A07:2017 - Cross-Site Scripting (XSS)
-    - A03:2021 - Injection
-    - A05:2025 - Injection
-    category: security
-    technology:
-    - go
-    references:
-    - https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/
-    confidence: MEDIUM
-    cwe2022-top25: true
-    cwe2021-top25: true
-    subcategory:
-    - vuln
-    likelihood: HIGH
-    impact: MEDIUM
-    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
-    vulnerability_class:
-    - Cross-Site-Scripting (XSS)
-    source: https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format
-    shortlink: https://sg.run/3r1G
-    semgrep.dev:
-      rule:
-        r_id: 14443
-        rv_id: 1262968
-        rule_id: PeUonQ
-        version_id: 1QTyp2p
-        url: https://semgrep.dev/playground/r/1QTyp2p/go.lang.security.injection.raw-html-format.raw-html-format
-        origin: community
-  mode: taint
-  pattern-sources:
-  - patterns:
-    - pattern-either:
-      - pattern: |
-          ($REQUEST : *http.Request).$ANYTHING
-      - pattern: |
-          ($REQUEST : http.Request).$ANYTHING
-    - metavariable-regex:
-        metavariable: $ANYTHING
-        regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
-  pattern-sanitizers:
-  - pattern: html.EscapeString(...)
-  pattern-sinks:
-  - patterns:
-    - pattern-either:
-      - pattern: fmt.Printf("$HTMLSTR", ...)
-      - pattern: fmt.Sprintf("$HTMLSTR", ...)
-      - pattern: fmt.Fprintf($W, "$HTMLSTR", ...)
-      - pattern: '"$HTMLSTR" + ...'
-    - metavariable-pattern:
-        metavariable: $HTMLSTR
-        language: generic
-        pattern: <$TAG ...
 - id: go.lang.security.injection.tainted-sql-string.tainted-sql-string
   languages:
   - go
@@ -41152,6 +41086,72 @@ rules:
   - pattern-regex: \$\{\{\s*secrets\.
   - pattern-not-inside: 'jobs: ...'
   severity: WARNING
+- id: go.lang.security.injection.raw-html-format.raw-html-format
+  languages:
+  - go
+  severity: WARNING
+  message: Detected user input flowing into a manually constructed HTML string. You
+    may be accidentally bypassing secure methods of rendering HTML by manually constructing
+    HTML and this could create a cross-site scripting vulnerability, which could let
+    attackers steal sensitive user data. Use the `html/template` package which will
+    safely render HTML instead, or inspect that the HTML is rendered safely.
+  metadata:
+    cwe:
+    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
+      Scripting'')'
+    owasp:
+    - A07:2017 - Cross-Site Scripting (XSS)
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    category: security
+    technology:
+    - go
+    references:
+    - https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/
+    confidence: MEDIUM
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - vuln
+    likelihood: HIGH
+    impact: MEDIUM
+    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
+    vulnerability_class:
+    - Cross-Site-Scripting (XSS)
+    source: https://semgrep.dev/r/go.lang.security.injection.raw-html-format.raw-html-format
+    shortlink: https://sg.run/3r1G
+    semgrep.dev:
+      rule:
+        r_id: 14443
+        rv_id: 1262968
+        rule_id: PeUonQ
+        version_id: 1QTyp2p
+        url: https://semgrep.dev/playground/r/1QTyp2p/go.lang.security.injection.raw-html-format.raw-html-format
+        origin: community
+  mode: taint
+  pattern-sources:
+  - patterns:
+    - pattern-either:
+      - pattern: |
+          ($REQUEST : *http.Request).$ANYTHING
+      - pattern: |
+          ($REQUEST : http.Request).$ANYTHING
+    - metavariable-regex:
+        metavariable: $ANYTHING
+        regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
+  pattern-sanitizers:
+  - pattern: html.EscapeString(...)
+  pattern-sinks:
+  - patterns:
+    - pattern-either:
+      - pattern: fmt.Printf("$HTMLSTR", ...)
+      - pattern: fmt.Sprintf("$HTMLSTR", ...)
+      - pattern: fmt.Fprintf($W, "$HTMLSTR", ...)
+      - pattern: '"$HTMLSTR" + ...'
+    - metavariable-pattern:
+        metavariable: $HTMLSTR
+        language: generic
+        pattern: <$TAG ...
 - id: ruby.rails.security.injection.raw-html-format.raw-html-format
   languages:
   - ruby

package/rules/ruleset.lock.json

@@ -1,4 +1,8 @@
 {
+  "schemaVersion": 1,
+  "packageVersion": "0.3.0",
+  "ruleset": "p/owasp-top-ten",
   "source": "https://semgrep.dev/c/p/owasp-top-ten",
-  "sha256": "530adfc98727f31ea85e1f310500a41f224b1ef47847e84966827197fca11471"
+  "sha256": "2e2e1afa06df5e84d01f63372ac82b69ddcc4cd28efd45f375a1e8c910524146",
+  "capturedAt": "2026-09-13T18:30:54.019Z"
 }