codesentry-semgrep-rules 0.1.4 → 0.1.5

package/package.json

@@ -1,6 +1,6 @@
 {
       "name": "codesentry-semgrep-rules",
-      "version": "0.1.4",
+      "version": "0.1.5",
       "license": "MIT",
       "description": "Snapshot local das regras OWASP do Semgrep para CodeSentry",
       "files": [

package/rules/owasp.yml

@@ -17254,102 +17254,6 @@ rules:
       - metavariable-comparison:
           metavariable: $MOD
           comparison: $MOD == 0o111
-- id: go.lang.security.injection.tainted-sql-string.tainted-sql-string
-  languages:
-  - go
-  message: User data flows into this manually-constructed SQL string. User data can
-    be safely inserted into SQL strings using prepared statements or an object-relational
-    mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL
-    injection, which could let an attacker steal or manipulate data from the database.
-    Instead, use prepared statements (`db.Query("SELECT * FROM t WHERE id = ?", id)`)
-    or a safe library.
-  options:
-    interfile: true
-  metadata:
-    cwe:
-    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
-      (''SQL Injection'')'
-    owasp:
-    - A01:2017 - Injection
-    - A03:2021 - Injection
-    - A05:2025 - Injection
-    references:
-    - https://golang.org/doc/database/sql-injection
-    - https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/
-    category: security
-    technology:
-    - go
-    confidence: HIGH
-    cwe2022-top25: true
-    cwe2021-top25: true
-    subcategory:
-    - vuln
-    likelihood: HIGH
-    impact: MEDIUM
-    interfile: true
-    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
-    vulnerability_class:
-    - SQL Injection
-    source: https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string
-    shortlink: https://sg.run/PbEq
-    semgrep.dev:
-      rule:
-        r_id: 14689
-        rv_id: 1409388
-        rule_id: PeUoqy
-        version_id: nWTQ5qD
-        url: https://semgrep.dev/playground/r/nWTQ5qD/go.lang.security.injection.tainted-sql-string.tainted-sql-string
-        origin: community
-  mode: taint
-  severity: ERROR
-  pattern-sources:
-  - patterns:
-    - pattern-either:
-      - pattern: |
-          ($REQUEST : *http.Request).$ANYTHING
-      - pattern: |
-          ($REQUEST : http.Request).$ANYTHING
-    - metavariable-regex:
-        metavariable: $ANYTHING
-        regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
-  pattern-sinks:
-  - patterns:
-    - pattern-either:
-      - patterns:
-        - pattern-either:
-          - pattern: |
-              "$SQLSTR" + ...
-          - patterns:
-            - pattern-inside: |
-                $VAR = "$SQLSTR";
-                ...
-            - pattern: $VAR += ...
-          - patterns:
-            - pattern-inside: |
-                var $SB strings.Builder
-                ...
-            - pattern-inside: |
-                $SB.WriteString("$SQLSTR")
-                ...
-                $SB.String(...)
-            - pattern: |
-                $SB.WriteString(...)
-        - metavariable-regex:
-            metavariable: $SQLSTR
-            regex: (?i)(select|delete|insert|create|update|alter|drop).*
-      - patterns:
-        - pattern-either:
-          - pattern: fmt.Fprintf($F, "$SQLSTR", ...)
-          - pattern: fmt.Sprintf("$SQLSTR", ...)
-          - pattern: fmt.Printf("$SQLSTR", ...)
-        - metavariable-regex:
-            metavariable: $SQLSTR
-            regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).*
-  pattern-sanitizers:
-  - pattern-either:
-    - pattern: strconv.Atoi(...)
-    - pattern: |
-        ($X: bool)
 - id: php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query
   languages:
   - php
@@ -17983,34 +17887,292 @@ rules:
     confidence: MEDIUM
     subcategory:
     - vuln
-    likelihood: MEDIUM
+    likelihood: MEDIUM
+    impact: MEDIUM
+    interfile: true
+    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
+    vulnerability_class:
+    - Cryptographic Issues
+    source: https://semgrep.dev/r/go.lang.security.audit.md5-used-as-password.md5-used-as-password
+    shortlink: https://sg.run/4eOE
+    semgrep.dev:
+      rule:
+        r_id: 14688
+        rv_id: 1262938
+        rule_id: 4bU1Wj
+        version_id: nWT2L9r
+        url: https://semgrep.dev/playground/r/nWT2L9r/go.lang.security.audit.md5-used-as-password.md5-used-as-password
+        origin: community
+  mode: taint
+  pattern-sources:
+  - patterns:
+    - pattern-either:
+      - pattern: md5.New
+      - pattern: md5.Sum
+  pattern-sinks:
+  - patterns:
+    - pattern: $FUNCTION(...)
+    - metavariable-regex:
+        metavariable: $FUNCTION
+        regex: (?i)(.*password.*)
+- id: go.lang.security.injection.tainted-sql-string.tainted-sql-string
+  languages:
+  - go
+  message: User data flows into this manually-constructed SQL string. User data can
+    be safely inserted into SQL strings using prepared statements or an object-relational
+    mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL
+    injection, which could let an attacker steal or manipulate data from the database.
+    Instead, use prepared statements (`db.Query("SELECT * FROM t WHERE id = ?", id)`)
+    or a safe library.
+  options:
+    interfile: true
+  metadata:
+    cwe:
+    - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command
+      (''SQL Injection'')'
+    owasp:
+    - A01:2017 - Injection
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    references:
+    - https://golang.org/doc/database/sql-injection
+    - https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/
+    category: security
+    technology:
+    - go
+    confidence: HIGH
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - vuln
+    likelihood: HIGH
+    impact: MEDIUM
+    interfile: true
+    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
+    vulnerability_class:
+    - SQL Injection
+    source: https://semgrep.dev/r/go.lang.security.injection.tainted-sql-string.tainted-sql-string
+    shortlink: https://sg.run/PbEq
+    semgrep.dev:
+      rule:
+        r_id: 14689
+        rv_id: 1409388
+        rule_id: PeUoqy
+        version_id: nWTQ5qD
+        url: https://semgrep.dev/playground/r/nWTQ5qD/go.lang.security.injection.tainted-sql-string.tainted-sql-string
+        origin: community
+  mode: taint
+  severity: ERROR
+  pattern-sources:
+  - patterns:
+    - pattern-either:
+      - pattern: |
+          ($REQUEST : *http.Request).$ANYTHING
+      - pattern: |
+          ($REQUEST : http.Request).$ANYTHING
+    - metavariable-regex:
+        metavariable: $ANYTHING
+        regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
+  pattern-sinks:
+  - patterns:
+    - pattern-either:
+      - patterns:
+        - pattern-either:
+          - pattern: |
+              "$SQLSTR" + ...
+          - patterns:
+            - pattern-inside: |
+                $VAR = "$SQLSTR";
+                ...
+            - pattern: $VAR += ...
+          - patterns:
+            - pattern-inside: |
+                var $SB strings.Builder
+                ...
+            - pattern-inside: |
+                $SB.WriteString("$SQLSTR")
+                ...
+                $SB.String(...)
+            - pattern: |
+                $SB.WriteString(...)
+        - metavariable-regex:
+            metavariable: $SQLSTR
+            regex: (?i)(select|delete|insert|create|update|alter|drop).*
+      - patterns:
+        - pattern-either:
+          - pattern: fmt.Fprintf($F, "$SQLSTR", ...)
+          - pattern: fmt.Sprintf("$SQLSTR", ...)
+          - pattern: fmt.Printf("$SQLSTR", ...)
+        - metavariable-regex:
+            metavariable: $SQLSTR
+            regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).*
+  pattern-sanitizers:
+  - pattern-either:
+    - pattern: strconv.Atoi(...)
+    - pattern: |
+        ($X: bool)
+- id: java.lang.security.audit.md5-used-as-password.md5-used-as-password
+  languages:
+  - java
+  severity: WARNING
+  message: It looks like MD5 is used as a password hash. MD5 is not considered a secure
+    password hash because it can be cracked by an attacker in a short amount of time.
+    Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use
+    `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1")`
+    or, if using Spring, `org.springframework.security.crypto.bcrypt`.
+  metadata:
+    category: security
+    technology:
+    - java
+    - md5
+    references:
+    - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html
+    - https://github.com/returntocorp/semgrep-rules/issues/1609
+    - https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory
+    - https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.html
+    owasp:
+    - A03:2017 - Sensitive Data Exposure
+    - A02:2021 - Cryptographic Failures
+    - A04:2025 - Cryptographic Failures
+    cwe:
+    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
+    subcategory:
+    - vuln
+    likelihood: HIGH
+    impact: MEDIUM
+    confidence: MEDIUM
+    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
+    vulnerability_class:
+    - Cryptographic Issues
+    source: https://semgrep.dev/r/java.lang.security.audit.md5-used-as-password.md5-used-as-password
+    shortlink: https://sg.run/JxEQ
+    semgrep.dev:
+      rule:
+        r_id: 14690
+        rv_id: 1263029
+        rule_id: JDULAW
+        version_id: bZT53QB
+        url: https://semgrep.dev/playground/r/bZT53QB/java.lang.security.audit.md5-used-as-password.md5-used-as-password
+        origin: community
+  mode: taint
+  pattern-sources:
+  - patterns:
+    - pattern-inside: |
+        $TYPE $MD = MessageDigest.getInstance("MD5");
+        ...
+    - pattern: $MD.digest(...);
+  pattern-sinks:
+  - patterns:
+    - pattern: $MODEL.$METHOD(...);
+    - metavariable-regex:
+        metavariable: $METHOD
+        regex: (?i)(.*password.*)
+- id: javascript.express.security.injection.raw-html-format.raw-html-format
+  message: User data flows into the host portion of this manually-constructed HTML.
+    This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from
+    user-provided input. Consider using a sanitization library such as DOMPurify to
+    sanitize the HTML within.
+  metadata:
+    cwe:
+    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
+      Scripting'')'
+    owasp:
+    - A07:2017 - Cross-Site Scripting (XSS)
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    references:
+    - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
+    category: security
+    technology:
+    - express
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - vuln
+    likelihood: HIGH
     impact: MEDIUM
-    interfile: true
+    confidence: MEDIUM
     license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
     vulnerability_class:
-    - Cryptographic Issues
-    source: https://semgrep.dev/r/go.lang.security.audit.md5-used-as-password.md5-used-as-password
-    shortlink: https://sg.run/4eOE
+    - Cross-Site-Scripting (XSS)
+    source: https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format
+    shortlink: https://sg.run/5DO3
     semgrep.dev:
       rule:
-        r_id: 14688
-        rv_id: 1262938
-        rule_id: 4bU1Wj
-        version_id: nWT2L9r
-        url: https://semgrep.dev/playground/r/nWT2L9r/go.lang.security.audit.md5-used-as-password.md5-used-as-password
+        r_id: 14691
+        rv_id: 1263175
+        rule_id: 5rUL0X
+        version_id: NdTzyQv
+        url: https://semgrep.dev/playground/r/NdTzyQv/javascript.express.security.injection.raw-html-format.raw-html-format
         origin: community
+  languages:
+  - javascript
+  - typescript
+  severity: WARNING
   mode: taint
   pattern-sources:
-  - patterns:
+  - label: EXPRESS
+    patterns:
     - pattern-either:
-      - pattern: md5.New
-      - pattern: md5.Sum
-  pattern-sinks:
-  - patterns:
-    - pattern: $FUNCTION(...)
+      - pattern-inside: function ... ($REQ, $RES) {...}
+      - pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
+      - patterns:
+        - pattern-either:
+          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
+          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
+        - metavariable-regex:
+            metavariable: $METHOD
+            regex: ^(get|post|put|head|delete|options)$
+    - pattern-either:
+      - pattern: $REQ.query
+      - pattern: $REQ.body
+      - pattern: $REQ.params
+      - pattern: $REQ.cookies
+      - pattern: $REQ.headers
+  - label: EXPRESSTS
+    patterns:
+    - pattern-either:
+      - pattern-inside: |
+          ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
+          {...}
+      - pattern-inside: |
+          ({ $REQ }: Request,$RES: Response) => {...}
+    - focus-metavariable: $REQ
+    - pattern-either:
+      - pattern: params
+      - pattern: query
+      - pattern: cookies
+      - pattern: headers
+      - pattern: body
+  - label: CLEAN
+    by-side-effect: true
+    patterns:
+    - pattern-either:
+      - pattern: $A($SOURCE)
+      - pattern: $SANITIZE. ... .$A($SOURCE)
+      - pattern: $A. ... .$SANITIZE($SOURCE)
+    - focus-metavariable: $SOURCE
     - metavariable-regex:
-        metavariable: $FUNCTION
-        regex: (?i)(.*password.*)
+        metavariable: $A
+        regex: (?i)(.*valid|.*sanitiz)
+  pattern-sinks:
+  - requires: (EXPRESS and not CLEAN) or (EXPRESSTS and not CLEAN)
+    patterns:
+    - pattern-either:
+      - patterns:
+        - pattern-either:
+          - pattern: '"$HTMLSTR" + $EXPR'
+          - pattern: '"$HTMLSTR".concat(...)'
+          - pattern: util.format($HTMLSTR, ...)
+        - metavariable-pattern:
+            metavariable: $HTMLSTR
+            language: generic
+            pattern: <$TAG ...
+      - patterns:
+        - pattern: |
+            `...`
+        - pattern-regex: |
+            .*<\w+.*
 - id: json.aws.security.wildcard-assume-role.wildcard-assume-role
   patterns:
   - pattern-inside: |
@@ -39750,168 +39912,6 @@ rules:
   - pattern-regex: \$\{\{\s*secrets\.
   - pattern-not-inside: 'jobs: ...'
   severity: WARNING
-- id: java.lang.security.audit.md5-used-as-password.md5-used-as-password
-  languages:
-  - java
-  severity: WARNING
-  message: It looks like MD5 is used as a password hash. MD5 is not considered a secure
-    password hash because it can be cracked by an attacker in a short amount of time.
-    Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use
-    `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1")`
-    or, if using Spring, `org.springframework.security.crypto.bcrypt`.
-  metadata:
-    category: security
-    technology:
-    - java
-    - md5
-    references:
-    - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html
-    - https://github.com/returntocorp/semgrep-rules/issues/1609
-    - https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory
-    - https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.html
-    owasp:
-    - A03:2017 - Sensitive Data Exposure
-    - A02:2021 - Cryptographic Failures
-    - A04:2025 - Cryptographic Failures
-    cwe:
-    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
-    subcategory:
-    - vuln
-    likelihood: HIGH
-    impact: MEDIUM
-    confidence: MEDIUM
-    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
-    vulnerability_class:
-    - Cryptographic Issues
-    source: https://semgrep.dev/r/java.lang.security.audit.md5-used-as-password.md5-used-as-password
-    shortlink: https://sg.run/JxEQ
-    semgrep.dev:
-      rule:
-        r_id: 14690
-        rv_id: 1263029
-        rule_id: JDULAW
-        version_id: bZT53QB
-        url: https://semgrep.dev/playground/r/bZT53QB/java.lang.security.audit.md5-used-as-password.md5-used-as-password
-        origin: community
-  mode: taint
-  pattern-sources:
-  - patterns:
-    - pattern-inside: |
-        $TYPE $MD = MessageDigest.getInstance("MD5");
-        ...
-    - pattern: $MD.digest(...);
-  pattern-sinks:
-  - patterns:
-    - pattern: $MODEL.$METHOD(...);
-    - metavariable-regex:
-        metavariable: $METHOD
-        regex: (?i)(.*password.*)
-- id: javascript.express.security.injection.raw-html-format.raw-html-format
-  message: User data flows into the host portion of this manually-constructed HTML.
-    This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from
-    user-provided input. Consider using a sanitization library such as DOMPurify to
-    sanitize the HTML within.
-  metadata:
-    cwe:
-    - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site
-      Scripting'')'
-    owasp:
-    - A07:2017 - Cross-Site Scripting (XSS)
-    - A03:2021 - Injection
-    - A05:2025 - Injection
-    references:
-    - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
-    category: security
-    technology:
-    - express
-    cwe2022-top25: true
-    cwe2021-top25: true
-    subcategory:
-    - vuln
-    likelihood: HIGH
-    impact: MEDIUM
-    confidence: MEDIUM
-    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
-    vulnerability_class:
-    - Cross-Site-Scripting (XSS)
-    source: https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format
-    shortlink: https://sg.run/5DO3
-    semgrep.dev:
-      rule:
-        r_id: 14691
-        rv_id: 1263175
-        rule_id: 5rUL0X
-        version_id: NdTzyQv
-        url: https://semgrep.dev/playground/r/NdTzyQv/javascript.express.security.injection.raw-html-format.raw-html-format
-        origin: community
-  languages:
-  - javascript
-  - typescript
-  severity: WARNING
-  mode: taint
-  pattern-sources:
-  - label: EXPRESS
-    patterns:
-    - pattern-either:
-      - pattern-inside: function ... ($REQ, $RES) {...}
-      - pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
-      - patterns:
-        - pattern-either:
-          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
-          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
-        - metavariable-regex:
-            metavariable: $METHOD
-            regex: ^(get|post|put|head|delete|options)$
-    - pattern-either:
-      - pattern: $REQ.query
-      - pattern: $REQ.body
-      - pattern: $REQ.params
-      - pattern: $REQ.cookies
-      - pattern: $REQ.headers
-  - label: EXPRESSTS
-    patterns:
-    - pattern-either:
-      - pattern-inside: |
-          ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
-          {...}
-      - pattern-inside: |
-          ({ $REQ }: Request,$RES: Response) => {...}
-    - focus-metavariable: $REQ
-    - pattern-either:
-      - pattern: params
-      - pattern: query
-      - pattern: cookies
-      - pattern: headers
-      - pattern: body
-  - label: CLEAN
-    by-side-effect: true
-    patterns:
-    - pattern-either:
-      - pattern: $A($SOURCE)
-      - pattern: $SANITIZE. ... .$A($SOURCE)
-      - pattern: $A. ... .$SANITIZE($SOURCE)
-    - focus-metavariable: $SOURCE
-    - metavariable-regex:
-        metavariable: $A
-        regex: (?i)(.*valid|.*sanitiz)
-  pattern-sinks:
-  - requires: (EXPRESS and not CLEAN) or (EXPRESSTS and not CLEAN)
-    patterns:
-    - pattern-either:
-      - patterns:
-        - pattern-either:
-          - pattern: '"$HTMLSTR" + $EXPR'
-          - pattern: '"$HTMLSTR".concat(...)'
-          - pattern: util.format($HTMLSTR, ...)
-        - metavariable-pattern:
-            metavariable: $HTMLSTR
-            language: generic
-            pattern: <$TAG ...
-      - patterns:
-        - pattern: |
-            `...`
-        - pattern-regex: |
-            .*<\w+.*
 - id: kotlin.lang.security.ecb-cipher.ecb-cipher
   metadata:
     cwe:

package/rules/ruleset.lock.json

@@ -1,4 +1,4 @@
 {
   "source": "https://semgrep.dev/c/p/owasp-top-ten",
-  "sha256": "4edd262b86fee3840cde879037d52a87299cbb47df55e3e0c049eddd13831024"
+  "sha256": "a2b1a268912f8a3ce3626837f4ee3988653b3be696dadb3710155e8230063552"
 }