hullproof 0.0.0-stage → 0.5.0

package/rules/semgrep/ssrf-unguarded-url.yaml

@@ -0,0 +1,137 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Rare Phronesis Limited
+# Copied from the Hullproof kit (kit/tools/hullproof/rules/ssrf-unguarded-url.yaml).
+#
+rules:
+  - id: hullproof-ssrf-request-data-to-url
+    languages: [typescript, javascript]
+    mode: taint
+    options:
+      taint_assume_safe_functions: true
+    severity: ERROR
+    message: >-
+      Request data reaches an outbound HTTP call, or the second argument form of new URL, with no guard
+      call in between. A caller can point the server at internal hosts, cloud metadata addresses or
+      redirects. Resolve the host, reject private, loopback, link local and mapped addresses, connect to
+      the address that was checked, and do not follow redirects without checking each hop. If the value
+      is only a path or a numeric id, encode it with encodeURIComponent or Number.
+    # Guard calls are recognized by name. Edit the regex in the sanitizer below to match the project's own
+    # guard function. A guard that is not on the list shows up as a finding, which is the safe failure.
+    pattern-sources:
+      - patterns:
+          - pattern-either:
+              - pattern: $R.body
+              - pattern: $R.query
+              - pattern: $R.params
+              - pattern: $R.headers
+              - pattern: $R.cookies
+              - pattern: $R.url
+              - pattern: $R.nextUrl
+              - pattern: $R.nextUrl.searchParams
+              - pattern: $R.searchParams
+          - metavariable-regex:
+              metavariable: $R
+              regex: ^(req|request|ctx|event|context|c\.req|req\.raw)$
+      - patterns:
+          - pattern-either:
+              - pattern: await $R.json()
+              - pattern: await $R.formData()
+              - pattern: await $R.text()
+              - pattern: $R.json()
+              - pattern: $R.formData()
+          - metavariable-regex:
+              metavariable: $R
+              regex: ^(req|request|ctx|c\.req|req\.raw)$
+      - patterns:
+          - pattern-either:
+              - pattern: $S.get(...)
+              - pattern: $S.getAll(...)
+          - metavariable-regex:
+              metavariable: $S
+              regex: (?s)^(?:.*\.)?(?:searchParams|params|query)$|^(?:formData|data|fd)$
+    pattern-sinks:
+      - patterns:
+          - pattern: $F($U, ...)
+          - focus-metavariable: $U
+          - metavariable-regex:
+              metavariable: $F
+              regex: ^(fetch|axios|got|ky|ofetch|\$fetch|needle|superagent|request|undici\.(fetch|request|stream)|axios\.(get|post|put|patch|delete|head|options|request)|got\.(get|post|put|patch|delete|head|stream)|ky\.(get|post|put|patch|delete|head)|https?\.(get|request)|page\.goto|\w+\.goto)$
+      - patterns:
+          - pattern: new URL($U, $BASE)
+          - focus-metavariable: $U
+    pattern-sanitizers:
+      - by-side-effect: true
+        patterns:
+          - pattern: $G($X, ...)
+          - focus-metavariable: $X
+          - metavariable-regex:
+              metavariable: $G
+              regex: (?i)(safe|ssrf|allowlist|allowedhost|ispublic|assertpublic|validateurl|validatehost|asserturl|checkurl|guard|resolveandcheck|publicurl|externalurl)
+      - pattern: encodeURIComponent(...)
+      - pattern: encodeURI(...)
+      - pattern: Number(...)
+      - pattern: parseInt(...)
+      - pattern: parseFloat(...)
+    metadata:
+      sec_ids: [SEC-API-035, SEC-API-034]
+      severity_hint: CRITICAL
+      confidence: MEDIUM
+      note: >-
+        Taint within one file. Does not follow values across files or through function parameters
+        that are not request objects. Host allowlist checks written inline (an if on the hostname) are
+        not recognized, so those show as findings to be closed by reading the check.
+  - id: hullproof-ssrf-url-built-from-base
+    languages: [typescript, javascript]
+    severity: WARNING
+    message: >-
+      A fixed base URL is joined to a value by concatenation. If the value comes from a caller, it can
+      add an at sign, dot dot segments or a query string and change the host or path that is called.
+      Encode path segments with encodeURIComponent, or build the URL with new URL and check its origin.
+    patterns:
+      - pattern-either:
+          - pattern: $F($BASE + $X, ...)
+          - pattern: $F($BASE + "/" + $X, ...)
+      - metavariable-regex:
+          metavariable: $F
+          regex: ^(fetch|axios|got|ky|ofetch|\$fetch|undici\.(fetch|request)|axios\.(get|post|put|patch|delete|request))$
+      - metavariable-regex:
+          metavariable: $BASE
+          regex: (?i)^[\w.]*(base|api|host|origin|endpoint|baseurl|root)\w*$
+      - metavariable-regex:
+          metavariable: $X
+          regex: (?s)^(?!["'`])(?!\s*(?:encodeURIComponent|encodeURI|Number|parseInt)\s*\()
+    metadata:
+      sec_ids: [SEC-API-034, SEC-API-035]
+      severity_hint: MEDIUM
+      confidence: LOW
+      note: >-
+        Concatenation only. Template literals that join a base and an id are very common and are not
+        matched here to keep noise low. A reviewer should read any outbound URL that is built from a caller value.
+  - id: hullproof-ssrf-stored-url
+    languages: [typescript, javascript]
+    severity: WARNING
+    message: >-
+      An outbound call uses a URL property from a stored record or an options object (a customer webhook
+      endpoint, a callback address, a feed address). The address was supplied by a user earlier, so it is
+      request data that was saved. Apply the same host checks at the moment of connection, not only when the
+      address was saved, and do not follow redirects without checking each hop.
+    patterns:
+      - pattern-either:
+          - pattern: $F($O.$P, ...)
+          - pattern: $F($O.$P)
+      - metavariable-regex:
+          metavariable: $F
+          regex: ^(fetch|axios|got|ky|ofetch|\$fetch|needle|superagent|undici\.(fetch|request)|axios\.(get|post|put|patch|delete|head|request)|got\.(get|post|put|patch|delete|head|stream)|https?\.(get|request))$
+      - metavariable-regex:
+          metavariable: $P
+          regex: (?i)^(url|webhookurl|callbackurl|endpoint|endpointurl|targeturl|hookurl|feedurl|href|uri)$
+      - metavariable-regex:
+          metavariable: $O
+          regex: (?s)^(?!(?:window|document|location|response|res|resp|result|self|this|process|req|request|ctx|event|body|query|params|import\.meta|import_meta|new URL)\b)
+    metadata:
+      sec_ids: [SEC-API-035, SEC-API-034]
+      severity_hint: HIGH
+      confidence: LOW
+      note: >-
+        Name based lead. It finds the common customer webhook shape that the request taint rule cannot see
+        because the value comes from a database row. Confirm whether a guard runs at connection time.

package/rules/semgrep/subprocess-injection.yaml

@@ -0,0 +1,163 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Rare Phronesis Limited
+# Copied from the Hullproof kit (kit/tools/hullproof/rules/subprocess-injection.yaml).
+#
+rules:
+  - id: hullproof-subprocess-shell-string
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      A command string that is not a constant goes to a shell. Anything in the string can add commands.
+      Call the program directly with an argument array (execFile, spawn with no shell), pass user values
+      only as separate arguments after a double dash, and never concatenate them into the command.
+    patterns:
+      - pattern-either:
+          - pattern: exec($C, ...)
+          - pattern: execSync($C, ...)
+          - pattern: execAsync($C, ...)
+          - pattern: execPromise($C, ...)
+          - pattern: execP($C, ...)
+          - pattern: execaCommand($C, ...)
+          - pattern: execaCommandSync($C, ...)
+          - pattern: promisify(exec)($C, ...)
+          - pattern: util.promisify(exec)($C, ...)
+          - pattern: shell.exec($C, ...)
+          - pattern: shelljs.exec($C, ...)
+          - patterns:
+              - pattern-either:
+                  - pattern: $CP.exec($C, ...)
+                  - pattern: $CP.execSync($C, ...)
+              - metavariable-regex:
+                  metavariable: $CP
+                  regex: ^(cp|child_process|childProcess|proc|node_child_process|cproc)$
+          - patterns:
+              - pattern: '$F($C, ..., {..., shell: true, ...})'
+              - metavariable-regex:
+                  metavariable: $F
+                  regex: ^(?:\w+\.)?(?:execFile|execFileSync|spawn|spawnSync|execa|execaSync)$
+      - metavariable-regex:
+          metavariable: $C
+          regex: (?s)^(?!(?:"[^"\\]*"|'[^'\\]*'|`[^`$\\]*`)$)
+    metadata:
+      sec_ids: [SEC-API-020]
+      severity_hint: CRITICAL
+      confidence: MEDIUM
+      note: >-
+        Any command that is not a plain string literal. A command built only from constants held in
+        variables is a false positive. The bare exec name is matched only as a function call, so
+        RegExp exec on a variable is not matched.
+  - id: hullproof-subprocess-shell-interpreter
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      A shell interpreter is started with a script argument that is not a constant. This is the same as
+      running a command string through a shell. Run the target program directly with an argument array.
+    patterns:
+      - pattern-either:
+          - pattern: $F($SH, [..., "-c", $S, ...], ...)
+          - pattern: $F($SH, [..., "/c", $S, ...], ...)
+          - pattern: $F($SH, [..., "/C", $S, ...], ...)
+          - pattern: $F($SH, [..., "-Command", $S, ...], ...)
+          - pattern: $F($SH, [..., "-lc", $S, ...], ...)
+      - metavariable-regex:
+          metavariable: $SH
+          regex: (?i)^["'`](?:.*[/\\])?(?:sh|bash|zsh|dash|ksh|fish|cmd|cmd\.exe|powershell|powershell\.exe|pwsh|pwsh\.exe)["'`]$
+      - metavariable-regex:
+          metavariable: $F
+          regex: ^(?:\w+\.)?(?:execFile|execFileSync|spawn|spawnSync|execa|execaSync|fork)$
+      - metavariable-regex:
+          metavariable: $S
+          regex: (?s)^(?!(?:"[^"\\]*"|'[^'\\]*'|`[^`$\\]*`)$)
+    metadata:
+      sec_ids: [SEC-API-020]
+      severity_hint: CRITICAL
+      confidence: HIGH
+  - id: hullproof-subprocess-arg-no-separator
+    languages: [typescript, javascript]
+    severity: WARNING
+    message: >-
+      A program is started with an argument that is not a constant, and the argument list has no double
+      dash separator. If the value starts with a dash the program reads it as an option (for example git
+      ls-remote with an upload pack option runs a command). Put the double dash before user values, check
+      that the value does not start with a dash, and pin the allowed options.
+    patterns:
+      - pattern-either:
+          - pattern: $F($BIN, [..., $A, ...], ...)
+      - metavariable-regex:
+          metavariable: $F
+          regex: ^(?:\w+\.)?(?:execFile|execFileSync|spawn|spawnSync|execa|execaSync)$
+      - metavariable-regex:
+          metavariable: $A
+          regex: (?s)^(?!(?:"[^"\\]*"|'[^'\\]*'|`[^`$\\]*`)$)
+      - pattern-not: $F($BIN, [..., "--", ...], ...)
+      - metavariable-regex:
+          metavariable: $BIN
+          regex: (?is)^(?!["'`](?:.*[/\\])?(?:sh|bash|zsh|dash|ksh|fish|cmd|cmd\.exe|powershell|powershell\.exe|pwsh|pwsh\.exe)["'`]$)
+    metadata:
+      sec_ids: [SEC-API-020]
+      severity_hint: HIGH
+      confidence: LOW
+      note: >-
+        Every call that passes a non constant list entry without a double dash anywhere in the list.
+        Many calls pass a constant held in a variable, or a program that has no dash options. Review each.
+        Option injection is a program specific issue: git, curl, tar, ssh, rsync, ffmpeg and convert are
+        the usual targets.
+  - id: hullproof-subprocess-request-data
+    languages: [typescript, javascript]
+    mode: taint
+    severity: ERROR
+    message: >-
+      Request data reaches a subprocess call. Run a fixed program with a fixed argument list, put user
+      values after a double dash, and allowlist the values that are allowed.
+    pattern-sources:
+      - patterns:
+          - pattern-either:
+              - pattern: $R.body
+              - pattern: $R.query
+              - pattern: $R.params
+              - pattern: $R.headers
+              - pattern: $R.url
+              - pattern: $R.nextUrl.searchParams
+              - pattern: $R.searchParams
+          - metavariable-regex:
+              metavariable: $R
+              regex: ^(req|request|ctx|event|context|c\.req|req\.raw)$
+      - patterns:
+          - pattern-either:
+              - pattern: await $R.json()
+              - pattern: await $R.formData()
+              - pattern: await $R.text()
+          - metavariable-regex:
+              metavariable: $R
+              regex: ^(req|request|ctx|c\.req|req\.raw)$
+      - patterns:
+          - pattern-either:
+              - pattern: $S.get(...)
+              - pattern: $S.getAll(...)
+          - metavariable-regex:
+              metavariable: $S
+              regex: ^(searchParams|formData|params|query|\w+\.searchParams|data|fd)$
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: $F($C, ...)
+              - pattern: $F($C2, [...], ...)
+          - focus-metavariable: $C
+          - metavariable-regex:
+              metavariable: $F
+              regex: ^(?:\w+\.)?(?:exec|execSync|execFile|execFileSync|spawn|spawnSync|execa|execaSync|execaCommand|fork)$
+      - patterns:
+          - pattern: $F($BIN, [..., $A, ...], ...)
+          - focus-metavariable: $A
+          - metavariable-regex:
+              metavariable: $F
+              regex: ^(?:\w+\.)?(?:exec|execSync|execFile|execFileSync|spawn|spawnSync|execa|execaSync|fork)$
+    pattern-sanitizers:
+      - pattern: Number(...)
+      - pattern: parseInt(...)
+      - pattern: parseFloat(...)
+    metadata:
+      sec_ids: [SEC-API-020]
+      severity_hint: CRITICAL
+      confidence: HIGH
+      note: Taint within one file. The parameter names of the request object are matched by name (req, request, ctx, event).

package/rules/semgrep/taint-go.yaml

@@ -0,0 +1,333 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Rare Phronesis Limited
+# Written for the Hullproof Engine from the CWE definitions named in each rule. Not copied or derived from any Semgrep
+# registry rule. Fixtures: test/fixtures/rules/taint-go.go, run by test/rules.test.ts with semgrep --test.
+#
+# Sources are request data in net/http (an *http.Request), gorilla/mux and chi route variables, Gin (*gin.Context) and
+# Echo (echo.Context). Taint flows through string building, fmt.Sprintf, assignment and calls by default. A project
+# guard is recognised when its name says what it checks.
+rules:
+  - id: hullproof-taint-go-sql-injection
+    languages: [go]
+    mode: taint
+    severity: ERROR
+    message: >-
+      Request data reaches the text of a SQL query (CWE-89). Pass values as query arguments with placeholders
+      (db.Query("... WHERE id = $1", id)) and keep the query text constant; with GORM, use Where with ? placeholders.
+    metadata:
+      cwe: "CWE-89: Improper Neutralization of Special Elements used in an SQL Command"
+      sec_ids: [SEC-API-017]
+    pattern-sources:
+      - patterns:
+          - pattern: '($R : *http.Request).$M(...)'
+          - metavariable-regex:
+              metavariable: $M
+              regex: ^(FormValue|PostFormValue|Cookie|Cookies|FormFile|MultipartReader|Referer|UserAgent)$
+      - patterns:
+          - pattern: '($R : *http.Request).$F'
+          - metavariable-regex:
+              metavariable: $F
+              regex: ^(URL|Form|PostForm|MultipartForm|Header|Body|RequestURI|Host)$
+      - pattern: mux.Vars(...)
+      - pattern: chi.URLParam(...)
+      - patterns:
+          - pattern-either:
+              - pattern: '($C : *gin.Context).$G(...)'
+              - pattern: '($C : echo.Context).$G(...)'
+          - metavariable-regex:
+              metavariable: $G
+              regex: ^(Query|DefaultQuery|QueryArray|QueryMap|GetQuery|Param|Params|PostForm|DefaultPostForm|PostFormArray|GetPostForm|GetHeader|Cookie|FormValue|QueryParam|QueryParams|FormParams|GetRawData|FormFile|ShouldBind|ShouldBindJSON|ShouldBindQuery|Bind|BindJSON)$
+    pattern-sanitizers:
+      - pattern-either:
+          - pattern: strconv.Atoi(...)
+          - pattern: strconv.ParseInt(...)
+          - pattern: strconv.ParseUint(...)
+          - pattern: strconv.ParseFloat(...)
+          - pattern: strconv.ParseBool(...)
+          - pattern: uuid.Parse(...)
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - patterns:
+                  - pattern: $DB.$M($Q, ...)
+                  - metavariable-regex:
+                      metavariable: $M
+                      regex: ^(Query|QueryRow|Exec|Prepare|Queryx|QueryRowx|MustExec|NamedExec|NamedQuery|Raw|Where|Order|Having|Joins)$
+              - patterns:
+                  - pattern: $DB.$M($DEST, $Q, ...)
+                  - metavariable-regex:
+                      metavariable: $M
+                      regex: ^(Get|Select)$
+              - patterns:
+                  - pattern: $DB.$M($CTX, $Q, ...)
+                  - metavariable-regex:
+                      metavariable: $M
+                      regex: ^(QueryContext|QueryRowContext|ExecContext|PrepareContext|QueryxContext|QueryRowxContext|GetContext|SelectContext)$
+          - pattern-not: '($C : *gin.Context).$M(...)'
+          - pattern-not: '($C : echo.Context).$M(...)'
+          - pattern-not: http.$M(...)
+          - pattern-not: '($CL : *http.Client).$M(...)'
+          - focus-metavariable: $Q
+
+  - id: hullproof-taint-go-xss
+    languages: [go]
+    mode: taint
+    severity: ERROR
+    message: >-
+      Request data is written into an HTML response without encoding (CWE-79). Render it with html/template, which
+      escapes by context, or encode it with html.EscapeString before writing it; never wrap request data in
+      template.HTML.
+    metadata:
+      cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation"
+      sec_ids: [SEC-WEB-031]
+    pattern-sources:
+      - patterns:
+          - pattern: '($R : *http.Request).$M(...)'
+          - metavariable-regex:
+              metavariable: $M
+              regex: ^(FormValue|PostFormValue|Cookie|Cookies|FormFile|MultipartReader|Referer|UserAgent)$
+      - patterns:
+          - pattern: '($R : *http.Request).$F'
+          - metavariable-regex:
+              metavariable: $F
+              regex: ^(URL|Form|PostForm|MultipartForm|Header|Body|RequestURI|Host)$
+      - pattern: mux.Vars(...)
+      - pattern: chi.URLParam(...)
+      - patterns:
+          - pattern-either:
+              - pattern: '($C : *gin.Context).$G(...)'
+              - pattern: '($C : echo.Context).$G(...)'
+          - metavariable-regex:
+              metavariable: $G
+              regex: ^(Query|DefaultQuery|QueryArray|QueryMap|GetQuery|Param|Params|PostForm|DefaultPostForm|PostFormArray|GetPostForm|GetHeader|Cookie|FormValue|QueryParam|QueryParams|FormParams|GetRawData|FormFile|ShouldBind|ShouldBindJSON|ShouldBindQuery|Bind|BindJSON)$
+    pattern-sanitizers:
+      - pattern-either:
+          - pattern: strconv.Atoi(...)
+          - pattern: strconv.ParseInt(...)
+          - pattern: strconv.ParseUint(...)
+          - pattern: strconv.ParseFloat(...)
+          - pattern: strconv.ParseBool(...)
+          - pattern: uuid.Parse(...)
+
+      - pattern-either:
+          - pattern: html.EscapeString(...)
+          - pattern: template.HTMLEscapeString(...)
+          - pattern: template.JSEscapeString(...)
+          - pattern: url.QueryEscape(...)
+          - pattern: url.PathEscape(...)
+          - pattern: json.Marshal(...)
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: '($W : http.ResponseWriter).Write($X)'
+              - pattern: 'fmt.Fprintf(($W : http.ResponseWriter), ..., $X, ...)'
+              - pattern: 'fmt.Fprint(($W : http.ResponseWriter), ..., $X, ...)'
+              - pattern: 'fmt.Fprintln(($W : http.ResponseWriter), ..., $X, ...)'
+              - pattern: 'io.WriteString(($W : http.ResponseWriter), $X)'
+              - pattern: template.HTML($X)
+              - pattern: template.JS($X)
+              - pattern: template.HTMLAttr($X)
+              - pattern: '($C : *gin.Context).Writer.WriteString($X)'
+              - pattern: '($C : echo.Context).HTML($CODE, $X)'
+              - patterns:
+                  - pattern: '($C : *gin.Context).Data($CODE, $CT, $X)'
+                  - metavariable-regex:
+                      metavariable: $CT
+                      regex: (?i).*html.*
+          - focus-metavariable: $X
+
+  - id: hullproof-taint-go-command-injection
+    languages: [go]
+    mode: taint
+    severity: ERROR
+    message: >-
+      Request data reaches an operating system command or chooses the program that runs (CWE-78). Run a fixed program
+      with exec.Command and separate arguments, never through sh -c, and map the request value to a fixed set of
+      options.
+    metadata:
+      cwe: "CWE-78: Improper Neutralization of Special Elements used in an OS Command"
+      sec_ids: [SEC-API-020]
+    pattern-sources:
+      - patterns:
+          - pattern: '($R : *http.Request).$M(...)'
+          - metavariable-regex:
+              metavariable: $M
+              regex: ^(FormValue|PostFormValue|Cookie|Cookies|FormFile|MultipartReader|Referer|UserAgent)$
+      - patterns:
+          - pattern: '($R : *http.Request).$F'
+          - metavariable-regex:
+              metavariable: $F
+              regex: ^(URL|Form|PostForm|MultipartForm|Header|Body|RequestURI|Host)$
+      - pattern: mux.Vars(...)
+      - pattern: chi.URLParam(...)
+      - patterns:
+          - pattern-either:
+              - pattern: '($C : *gin.Context).$G(...)'
+              - pattern: '($C : echo.Context).$G(...)'
+          - metavariable-regex:
+              metavariable: $G
+              regex: ^(Query|DefaultQuery|QueryArray|QueryMap|GetQuery|Param|Params|PostForm|DefaultPostForm|PostFormArray|GetPostForm|GetHeader|Cookie|FormValue|QueryParam|QueryParams|FormParams|GetRawData|FormFile|ShouldBind|ShouldBindJSON|ShouldBindQuery|Bind|BindJSON)$
+    pattern-sanitizers:
+      - pattern-either:
+          - pattern: strconv.Atoi(...)
+          - pattern: strconv.ParseInt(...)
+          - pattern: strconv.ParseUint(...)
+          - pattern: strconv.ParseFloat(...)
+          - pattern: strconv.ParseBool(...)
+          - pattern: uuid.Parse(...)
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: exec.Command($X, ...)
+              - pattern: exec.CommandContext($CTX, $X, ...)
+              - pattern: exec.Command($SH, "-c", $X, ...)
+              - pattern: exec.CommandContext($CTX, $SH, "-c", $X, ...)
+              - pattern: syscall.Exec($X, ...)
+          - focus-metavariable: $X
+
+  - id: hullproof-taint-go-path-traversal
+    languages: [go]
+    mode: taint
+    severity: WARNING
+    message: >-
+      Request data becomes part of a file path the server opens, writes, lists, deletes or serves (CWE-22).
+      filepath.Clean alone does not stop a relative path from leaving the folder. Reduce the name with filepath.Base,
+      or join it to a fixed root and check the result still has that root as its prefix before using it.
+    metadata:
+      cwe: "CWE-22: Improper Limitation of a Pathname to a Restricted Directory"
+      sec_ids: []
+    pattern-sources:
+      - patterns:
+          - pattern: '($R : *http.Request).$M(...)'
+          - metavariable-regex:
+              metavariable: $M
+              regex: ^(FormValue|PostFormValue|Cookie|Cookies|FormFile|MultipartReader|Referer|UserAgent)$
+      - patterns:
+          - pattern: '($R : *http.Request).$F'
+          - metavariable-regex:
+              metavariable: $F
+              regex: ^(URL|Form|PostForm|MultipartForm|Header|Body|RequestURI|Host)$
+      - pattern: mux.Vars(...)
+      - pattern: chi.URLParam(...)
+      - patterns:
+          - pattern-either:
+              - pattern: '($C : *gin.Context).$G(...)'
+              - pattern: '($C : echo.Context).$G(...)'
+          - metavariable-regex:
+              metavariable: $G
+              regex: ^(Query|DefaultQuery|QueryArray|QueryMap|GetQuery|Param|Params|PostForm|DefaultPostForm|PostFormArray|GetPostForm|GetHeader|Cookie|FormValue|QueryParam|QueryParams|FormParams|GetRawData|FormFile|ShouldBind|ShouldBindJSON|ShouldBindQuery|Bind|BindJSON)$
+    pattern-sanitizers:
+      - pattern-either:
+          - pattern: strconv.Atoi(...)
+          - pattern: strconv.ParseInt(...)
+          - pattern: strconv.ParseUint(...)
+          - pattern: strconv.ParseFloat(...)
+          - pattern: strconv.ParseBool(...)
+          - pattern: uuid.Parse(...)
+
+      - pattern-either:
+          - pattern: filepath.Base(...)
+          - pattern: path.Base(...)
+
+      - by-side-effect: true
+        patterns:
+          - pattern: $GUARD($X, ...)
+          - metavariable-regex:
+              metavariable: $GUARD
+              regex: (?i)^(.*\.)?\w*(safe|allow|valid|guard|check|verify|within|inside|contain)\w*$
+          - focus-metavariable: $X
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - patterns:
+                  - pattern: os.$F($X, ...)
+                  - metavariable-regex:
+                      metavariable: $F
+                      regex: ^(Open|OpenFile|Create|ReadFile|WriteFile|Remove|RemoveAll|Mkdir|MkdirAll|ReadDir|Stat|Lstat|Rename|Chmod|Truncate)$
+              - pattern: os.Rename($S, $X)
+              - pattern: ioutil.ReadFile($X)
+              - pattern: ioutil.WriteFile($X, ...)
+              - pattern: ioutil.ReadDir($X)
+              - pattern: http.ServeFile($W, $R, $X)
+              - pattern: '($C : *gin.Context).File($X)'
+              - pattern: '($C : *gin.Context).FileAttachment($X, ...)'
+              - pattern: '($C : echo.Context).File($X)'
+              - pattern: '($C : echo.Context).Attachment($X, ...)'
+          - focus-metavariable: $X
+
+  - id: hullproof-taint-go-ssrf
+    languages: [go]
+    mode: taint
+    severity: ERROR
+    message: >-
+      Request data chooses the address of an outbound request the server makes (CWE-918). Allow only http and https,
+      resolve the host, refuse private, loopback, link local and metadata addresses, dial the checked address and
+      check every redirect. A value that only fills a path or query under a fixed host is not matched.
+    metadata:
+      cwe: "CWE-918: Server-Side Request Forgery (SSRF)"
+      sec_ids: [SEC-API-035]
+    pattern-sources:
+      - patterns:
+          - pattern: '($R : *http.Request).$M(...)'
+          - metavariable-regex:
+              metavariable: $M
+              regex: ^(FormValue|PostFormValue|Cookie|Cookies|FormFile|MultipartReader|Referer|UserAgent)$
+      - patterns:
+          - pattern: '($R : *http.Request).$F'
+          - metavariable-regex:
+              metavariable: $F
+              regex: ^(URL|Form|PostForm|MultipartForm|Header|Body|RequestURI|Host)$
+      - pattern: mux.Vars(...)
+      - pattern: chi.URLParam(...)
+      - patterns:
+          - pattern-either:
+              - pattern: '($C : *gin.Context).$G(...)'
+              - pattern: '($C : echo.Context).$G(...)'
+          - metavariable-regex:
+              metavariable: $G
+              regex: ^(Query|DefaultQuery|QueryArray|QueryMap|GetQuery|Param|Params|PostForm|DefaultPostForm|PostFormArray|GetPostForm|GetHeader|Cookie|FormValue|QueryParam|QueryParams|FormParams|GetRawData|FormFile|ShouldBind|ShouldBindJSON|ShouldBindQuery|Bind|BindJSON)$
+    pattern-sanitizers:
+      - pattern-either:
+          - pattern: strconv.Atoi(...)
+          - pattern: strconv.ParseInt(...)
+          - pattern: strconv.ParseUint(...)
+          - pattern: strconv.ParseFloat(...)
+          - pattern: strconv.ParseBool(...)
+          - pattern: uuid.Parse(...)
+
+      - pattern-either:
+          - pattern: url.QueryEscape(...)
+          - pattern: url.PathEscape(...)
+      - patterns:
+          - pattern: '"$URL" + $Y'
+          - metavariable-regex:
+              metavariable: $URL
+              regex: ^https?://[^/]+/
+      - patterns:
+          - pattern: fmt.Sprintf("$URL", ...)
+          - metavariable-regex:
+              metavariable: $URL
+              regex: ^https?://[^/%]+/
+
+      - by-side-effect: true
+        patterns:
+          - pattern: $GUARD($X, ...)
+          - metavariable-regex:
+              metavariable: $GUARD
+              regex: (?i)^(.*\.)?\w*(safe|allow|valid|guard|check|verify)\w*$
+          - focus-metavariable: $X
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: http.Get($X)
+              - pattern: http.Head($X)
+              - pattern: http.Post($X, ...)
+              - pattern: http.PostForm($X, ...)
+              - pattern: http.NewRequest($M, $X, ...)
+              - pattern: http.NewRequestWithContext($CTX, $M, $X, ...)
+              - pattern: '($CL : *http.Client).Get($X)'
+              - pattern: '($CL : *http.Client).Head($X)'
+              - pattern: '($CL : *http.Client).Post($X, ...)'
+              - pattern: net.Dial($N, $X)
+              - pattern: net.DialTimeout($N, $X, ...)
+          - focus-metavariable: $X