codesentry-semgrep-rules 0.1.8 → 0.1.9

package/package.json

@@ -1,6 +1,6 @@
 {
       "name": "codesentry-semgrep-rules",
-      "version": "0.1.8",
+      "version": "0.1.9",
       "license": "MIT",
       "description": "Snapshot local das regras OWASP do Semgrep para CodeSentry",
       "files": [

package/rules/owasp.yml

@@ -15192,6 +15192,47 @@ rules:
   languages:
   - yaml
   severity: WARNING
+- id: yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service
+  pattern: |
+    spec:
+      ...
+      insecureSkipTLSVerify: true
+  message: 'Service is disabling TLS certificate verification when communicating with
+    the server. This makes your HTTPS connections insecure. Remove the ''insecureSkipTLSVerify:
+    true'' key to secure communication.'
+  metadata:
+    cwe:
+    - 'CWE-319: Cleartext Transmission of Sensitive Information'
+    references:
+    - https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#apiservice-v1-apiregistration-k8s-io
+    category: security
+    technology:
+    - kubernetes
+    owasp:
+    - A03:2017 - Sensitive Data Exposure
+    - A02:2021 - Cryptographic Failures
+    - A04:2025 - Cryptographic Failures
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    confidence: MEDIUM
+    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
+    vulnerability_class:
+    - Mishandled Sensitive Information
+    source: https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service
+    shortlink: https://sg.run/zk10
+    semgrep.dev:
+      rule:
+        r_id: 10117
+        rv_id: 1263944
+        rule_id: pKUGXr
+        version_id: e1TyjnR
+        url: https://semgrep.dev/playground/r/e1TyjnR/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service
+        origin: community
+  languages:
+  - yaml
+  severity: WARNING
 - id: ruby.rails.security.audit.sqli.ruby-pg-sqli.ruby-pg-sqli
   mode: taint
   pattern-propagators:
@@ -15688,47 +15729,6 @@ rules:
           ...
         }
   severity: ERROR
-- id: yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service
-  pattern: |
-    spec:
-      ...
-      insecureSkipTLSVerify: true
-  message: 'Service is disabling TLS certificate verification when communicating with
-    the server. This makes your HTTPS connections insecure. Remove the ''insecureSkipTLSVerify:
-    true'' key to secure communication.'
-  metadata:
-    cwe:
-    - 'CWE-319: Cleartext Transmission of Sensitive Information'
-    references:
-    - https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#apiservice-v1-apiregistration-k8s-io
-    category: security
-    technology:
-    - kubernetes
-    owasp:
-    - A03:2017 - Sensitive Data Exposure
-    - A02:2021 - Cryptographic Failures
-    - A04:2025 - Cryptographic Failures
-    subcategory:
-    - vuln
-    likelihood: MEDIUM
-    impact: MEDIUM
-    confidence: MEDIUM
-    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
-    vulnerability_class:
-    - Mishandled Sensitive Information
-    source: https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service
-    shortlink: https://sg.run/zk10
-    semgrep.dev:
-      rule:
-        r_id: 10117
-        rv_id: 1263944
-        rule_id: pKUGXr
-        version_id: e1TyjnR
-        url: https://semgrep.dev/playground/r/e1TyjnR/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service
-        origin: community
-  languages:
-  - yaml
-  severity: WARNING
 - id: java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse
   metadata:
     functional-categories:
@@ -17179,81 +17179,6 @@ rules:
         - pattern: template
         - pattern: partial
         - pattern: file
-- id: python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
-  languages:
-  - python
-  severity: WARNING
-  metadata:
-    category: security
-    owasp:
-    - A01:2021 - Broken Access Control
-    - A01:2025 - Broken Access Control
-    cwe:
-    - 'CWE-276: Incorrect Default Permissions'
-    technology:
-    - python
-    references:
-    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
-    cwe2022-top25: true
-    cwe2021-top25: true
-    subcategory:
-    - vuln
-    likelihood: LOW
-    impact: MEDIUM
-    confidence: MEDIUM
-    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
-    vulnerability_class:
-    - Improper Authorization
-    source: https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
-    shortlink: https://sg.run/AXY4
-    semgrep.dev:
-      rule:
-        r_id: 13594
-        rv_id: 1263482
-        rule_id: zdUYqR
-        version_id: O9Tpxqr
-        url: https://semgrep.dev/playground/r/O9Tpxqr/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
-        origin: community
-  message: These permissions `$BITS` are widely permissive and grant access to more
-    people than may be necessary. A good default is `0o644` which gives read and write
-    access to yourself and read access to everyone else.
-  patterns:
-  - pattern-inside: os.$METHOD(...)
-  - metavariable-pattern:
-      metavariable: $METHOD
-      patterns:
-      - pattern-either:
-        - pattern: chmod
-        - pattern: lchmod
-        - pattern: fchmod
-  - pattern-either:
-    - patterns:
-      - pattern: os.$METHOD($FILE, $BITS, ...)
-      - metavariable-comparison:
-          metavariable: $BITS
-          comparison: $BITS >= 0o650 and $BITS < 0o100000
-    - patterns:
-      - pattern: os.$METHOD($FILE, $BITS)
-      - metavariable-comparison:
-          metavariable: $BITS
-          comparison: $BITS >= 0o100650
-    - patterns:
-      - pattern: os.$METHOD($FILE, $BITS, ...)
-      - metavariable-pattern:
-          metavariable: $BITS
-          patterns:
-          - pattern-either:
-            - pattern: <... stat.S_IWGRP ...>
-            - pattern: <... stat.S_IXGRP ...>
-            - pattern: <... stat.S_IWOTH ...>
-            - pattern: <... stat.S_IXOTH ...>
-            - pattern: <... stat.S_IRWXO ...>
-            - pattern: <... stat.S_IRWXG ...>
-    - patterns:
-      - pattern: os.$METHOD($FILE, $EXPR | $MOD, ...)
-      - metavariable-comparison:
-          metavariable: $MOD
-          comparison: $MOD == 0o111
 - id: php.doctrine.security.audit.doctrine-orm-dangerous-query.doctrine-orm-dangerous-query
   languages:
   - php
@@ -41417,3 +41342,78 @@ rules:
   - pattern-regex: \$\{\{\s*secrets\.
   - pattern-not-inside: 'jobs: ...'
   severity: WARNING
+- id: python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
+  languages:
+  - python
+  severity: WARNING
+  metadata:
+    category: security
+    owasp:
+    - A01:2021 - Broken Access Control
+    - A01:2025 - Broken Access Control
+    cwe:
+    - 'CWE-276: Incorrect Default Permissions'
+    technology:
+    - python
+    references:
+    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - vuln
+    likelihood: LOW
+    impact: MEDIUM
+    confidence: MEDIUM
+    license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license
+    vulnerability_class:
+    - Improper Authorization
+    source: https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
+    shortlink: https://sg.run/AXY4
+    semgrep.dev:
+      rule:
+        r_id: 13594
+        rv_id: 1263482
+        rule_id: zdUYqR
+        version_id: O9Tpxqr
+        url: https://semgrep.dev/playground/r/O9Tpxqr/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions
+        origin: community
+  message: These permissions `$BITS` are widely permissive and grant access to more
+    people than may be necessary. A good default is `0o644` which gives read and write
+    access to yourself and read access to everyone else.
+  patterns:
+  - pattern-inside: os.$METHOD(...)
+  - metavariable-pattern:
+      metavariable: $METHOD
+      patterns:
+      - pattern-either:
+        - pattern: chmod
+        - pattern: lchmod
+        - pattern: fchmod
+  - pattern-either:
+    - patterns:
+      - pattern: os.$METHOD($FILE, $BITS, ...)
+      - metavariable-comparison:
+          metavariable: $BITS
+          comparison: $BITS >= 0o650 and $BITS < 0o100000
+    - patterns:
+      - pattern: os.$METHOD($FILE, $BITS)
+      - metavariable-comparison:
+          metavariable: $BITS
+          comparison: $BITS >= 0o100650
+    - patterns:
+      - pattern: os.$METHOD($FILE, $BITS, ...)
+      - metavariable-pattern:
+          metavariable: $BITS
+          patterns:
+          - pattern-either:
+            - pattern: <... stat.S_IWGRP ...>
+            - pattern: <... stat.S_IXGRP ...>
+            - pattern: <... stat.S_IWOTH ...>
+            - pattern: <... stat.S_IXOTH ...>
+            - pattern: <... stat.S_IRWXO ...>
+            - pattern: <... stat.S_IRWXG ...>
+    - patterns:
+      - pattern: os.$METHOD($FILE, $EXPR | $MOD, ...)
+      - metavariable-comparison:
+          metavariable: $MOD
+          comparison: $MOD == 0o111

package/rules/ruleset.lock.json

@@ -1,4 +1,4 @@
 {
   "source": "https://semgrep.dev/c/p/owasp-top-ten",
-  "sha256": "977af4124aecaae7e8d7109515d5e12be256166d3f6403637fc754dc73ba9daf"
+  "sha256": "c682f940c04e9ddb09cb30a0219f6c9df5d8127af627bec82b6aed7bac2804f7"
 }