narvy-cli 1.0.0__py3-none-any.whl

narvy/rules/web/local/csharp_narvy/injection.yml

@@ -0,0 +1,122 @@
+rules:
+
+# C#/.NET injection: ADO.NET SQL concatenation, request input into filesystem APIs (path traversal) and process launch (command injection).
+
+- id: narvy.csharp.sqli.command-text-concat.command-text-concat
+  message: >-
+    A SQL command text is built with `+` string concatenation and handed to
+    ADO.NET (`new SqlCommand(...)`, `SqlCommand.CommandText`, or the
+    equivalent `Npgsql`/`MySql`/`OleDb`/`Odbc`/`SQLite` command). Any tainted
+    value spliced into the SQL grammar this way is a SQL injection (CWE-89).
+    Keep the command text a fixed literal and pass values as parameters
+    (`cmd.Parameters.AddWithValue("@id", id)` with a `@id` placeholder).
+  severity: ERROR
+  languages: [csharp]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+    owasp:
+      - "A03:2021 - Injection"
+    subcategory: [vuln]
+    likelihood: HIGH
+    impact: HIGH
+    confidence: MEDIUM
+    technology: [csharp, dotnet, ado.net]
+  patterns:
+    - pattern-either:
+        - pattern: new $CMDTYPE($SQL, ...)
+        - pattern: new $CMDTYPE($SQL)
+        - pattern: $CMD.CommandText = $SQL;
+    - metavariable-regex:
+        metavariable: $CMDTYPE
+        regex: ^(SqlCommand|NpgsqlCommand|MySqlCommand|OleDbCommand|OdbcCommand|SQLiteCommand|SqliteCommand)$
+    - metavariable-pattern:
+        metavariable: $SQL
+        patterns:
+          # concatenation, but not a chain of only string literals joined by `+`
+          - pattern-regex: '\+'
+          - pattern-not-regex: '^\s*@?\$?"(?:[^"\\]|\\.)*"(\s*\+\s*@?\$?"(?:[^"\\]|\\.)*")*\s*$'
+
+- id: narvy.csharp.pathtraversal.request-input-into-file-api.request-input-into-file-api
+  message: >-
+    A value read from the HTTP request (`Request.Query`/`Form`/`Headers`/
+    `Cookies`/`RouteValues`) reaches a `System.IO` file API without being
+    reduced to a bare file name first. An attacker can supply `../` segments
+    (or an absolute path) to read or write files outside the intended
+    directory (CWE-22). Strip the path with `Path.GetFileName(...)` and
+    resolve it against a fixed base directory, rejecting anything that
+    escapes it.
+  severity: ERROR
+  languages: [csharp]
+  mode: taint
+  metadata:
+    category: security
+    cwe:
+      - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
+    owasp:
+      - "A01:2021 - Broken Access Control"
+    subcategory: [vuln]
+    likelihood: MEDIUM
+    impact: HIGH
+    confidence: MEDIUM
+    technology: [csharp, dotnet, asp.net]
+  pattern-sources:
+    - patterns:
+        - pattern-either:
+            - pattern: $REQ.Query[...]
+            - pattern: $REQ.Form[...]
+            - pattern: $REQ.Headers[...]
+            - pattern: $REQ.Cookies[...]
+            - pattern: $REQ.RouteValues[...]
+  pattern-sanitizers:
+    - pattern: Path.GetFileName(...)
+  pattern-sinks:
+    - patterns:
+        - pattern-either:
+            - pattern: File.ReadAllText(...)
+            - pattern: File.ReadAllBytes(...)
+            - pattern: File.ReadAllLines(...)
+            - pattern: File.OpenRead(...)
+            - pattern: File.OpenText(...)
+            - pattern: File.WriteAllText(...)
+            - pattern: File.WriteAllBytes(...)
+            - pattern: new StreamReader(...)
+            - pattern: new FileStream(...)
+
+- id: narvy.csharp.cmdi.process-start-untrusted.process-start-untrusted
+  message: >-
+    A value read from the HTTP request is passed to `Process.Start(...)`
+    (as the file name or the arguments). Request-controlled process
+    arguments let an attacker inject extra arguments, and a
+    request-controlled file name lets them choose the program to run - both
+    are command injection (CWE-78). Never build a process invocation from
+    request input; if an external tool must run, hardcode the executable and
+    pass a strictly validated, allow-listed argument.
+  severity: ERROR
+  languages: [csharp]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
+    owasp:
+      - "A03:2021 - Injection"
+    subcategory: [vuln]
+    likelihood: HIGH
+    impact: HIGH
+    confidence: MEDIUM
+    technology: [csharp, dotnet]
+  patterns:
+    - pattern-either:
+        - pattern: System.Diagnostics.Process.Start(..., $REQ.Query[...], ...)
+        - pattern: System.Diagnostics.Process.Start(..., $REQ.Form[...], ...)
+        - pattern: System.Diagnostics.Process.Start(..., $REQ.Headers[...], ...)
+        - pattern: System.Diagnostics.Process.Start(..., $REQ.RouteValues[...], ...)
+        - pattern: System.Diagnostics.Process.Start($REQ.Query[...], ...)
+        - pattern: System.Diagnostics.Process.Start($REQ.Form[...], ...)
+        - pattern: Process.Start(..., $REQ.Query[...], ...)
+        - pattern: Process.Start(..., $REQ.Form[...], ...)
+        - pattern: Process.Start(..., $REQ.Headers[...], ...)
+        - pattern: Process.Start(..., $REQ.RouteValues[...], ...)
+        - pattern: Process.Start($REQ.Query[...], ...)
+        - pattern: Process.Start($REQ.Form[...], ...)

narvy/rules/web/local/csharp_narvy/xxe.yml

@@ -0,0 +1,48 @@
+rules:
+
+# C#/.NET XXE: an XmlDocument left with its default resolver still resolves external entities/DTDs.
+
+- id: narvy.csharp.xxe.xmldocument-default-resolver.xmldocument-default-resolver
+  message: >-
+    An `XmlDocument` parses input while keeping its default `XmlResolver`.
+    On older target frameworks that resolver follows external entities and
+    DTDs, so parsing attacker-controlled XML lets it read local files or
+    reach internal network resources (XXE / SSRF, CWE-611). Set
+    `doc.XmlResolver = null;` before loading, or parse with
+    `XmlReader` configured with `DtdProcessing.Prohibit`.
+  severity: ERROR
+  languages: [csharp]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-611: Improper Restriction of XML External Entity Reference"
+    owasp:
+      - "A05:2021 - Security Misconfiguration"
+    subcategory: [vuln]
+    likelihood: MEDIUM
+    impact: HIGH
+    confidence: MEDIUM
+    technology: [csharp, dotnet]
+  patterns:
+    - pattern-either:
+        - patterns:
+            - pattern-inside: |
+                var $DOC = new XmlDocument();
+                ...
+            - pattern-not-inside: |
+                var $DOC = new XmlDocument();
+                ...
+                $DOC.XmlResolver = null;
+                ...
+        - patterns:
+            - pattern-inside: |
+                $TY $DOC = new XmlDocument();
+                ...
+            - pattern-not-inside: |
+                $TY $DOC = new XmlDocument();
+                ...
+                $DOC.XmlResolver = null;
+                ...
+    - pattern-either:
+        - pattern: $DOC.LoadXml(...)
+        - pattern: $DOC.Load(...)

narvy/rules/web/local/java_narvy/auth_jwt.yml

@@ -0,0 +1,134 @@
+rules:
+
+# Java JWT auth weaknesses: hardcoded signing key, decode without verification, none-algorithm.
+
+- id: narvy.java.jwt.hardcoded-signing-key.hardcoded-signing-key
+  message: >-
+    A JWT signing/verification key is a hardcoded string literal (`jjwt`'s
+    `Keys.hmacShaKeyFor(...)`, `java-jwt`'s `Algorithm.HMAC256(...)`, or a
+    plain `.getBytes()` call on a literal). Anyone with source or
+    decompiled-binary access can forge arbitrarily privileged tokens
+    (CWE-321, CWE-798). Load the signing key from an environment variable or
+    secrets manager, generated with at least 256 bits of entropy for HMAC.
+  severity: ERROR
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-321: Use of Hard-coded Cryptographic Key"
+      - "CWE-798: Use of Hard-coded Credentials"
+    owasp:
+      - "A07:2021 - Identification and Authentication Failures"
+    subcategory: [vuln]
+    likelihood: LOW
+    impact: HIGH
+    confidence: MEDIUM
+    technology: [java]
+  patterns:
+    - pattern-either:
+        - pattern: Keys.hmacShaKeyFor("...".getBytes(...))
+        - pattern: io.jsonwebtoken.security.Keys.hmacShaKeyFor("...".getBytes(...))
+        - pattern: Algorithm.HMAC256("...")
+        - pattern: Algorithm.HMAC384("...")
+        - pattern: Algorithm.HMAC512("...")
+        - pattern: com.auth0.jwt.algorithms.Algorithm.HMAC256("...")
+
+- id: narvy.java.jwt.decode-without-verification.decode-without-verification
+  message: >-
+    `JWT.decode(...)` (auth0 java-jwt) reads and parses a token's claims
+    without verifying its signature - unlike `JWTVerifier.verify(...)`,
+    `decode` accepts a token signed with any key, or none at all. Branching
+    on claims read this way (role, user id, `exp`) is an authentication
+    bypass (CWE-347). Use a `JWTVerifier` built with the expected algorithm
+    and key, and call `verify(token)` instead of `decode(token)`.
+  severity: ERROR
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-347: Improper Verification of Cryptographic Signature"
+    owasp:
+      - "A07:2021 - Identification and Authentication Failures"
+    subcategory: [vuln]
+    likelihood: MEDIUM
+    impact: HIGH
+    confidence: HIGH
+    technology: [java]
+  patterns:
+    - pattern-either:
+        - pattern: JWT.decode($TOKEN)
+        - pattern: com.auth0.jwt.JWT.decode($TOKEN)
+
+- id: narvy.java.jwt.parser-no-signing-key.parser-no-signing-key
+  message: >-
+    A `jjwt` `Jwts.parserBuilder()` (or the deprecated `Jwts.parser()`)
+    chain calls `.build().parse(...)`/`.parseClaimsJws(...)` with no
+    `.setSigningKey(...)`/`.verifyWith(...)` configured on the builder. Some
+    jjwt versions accept an unsigned or `alg: none` token in this
+    configuration, which is a full authentication bypass (CWE-347). Always
+    set the expected signing key (and, ideally, pin the accepted algorithm)
+    on the parser builder before parsing an incoming token.
+  severity: WARNING
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-347: Improper Verification of Cryptographic Signature"
+    owasp:
+      - "A07:2021 - Identification and Authentication Failures"
+    subcategory: [audit]
+    likelihood: LOW
+    impact: HIGH
+    confidence: LOW
+    technology: [java]
+  patterns:
+    - pattern: |
+        $P = Jwts.parserBuilder();
+        ...
+        $P.build().parseClaimsJws($TOKEN);
+    - pattern-not: |
+        $P = Jwts.parserBuilder();
+        ...
+        $P.setSigningKey(...);
+        ...
+        $P.build().parseClaimsJws($TOKEN);
+    - pattern-not: |
+        $P = Jwts.parserBuilder();
+        ...
+        $P.verifyWith(...);
+        ...
+        $P.build().parseClaimsJws($TOKEN);
+
+- id: narvy.java.jwt.hardcoded-fallback-secret.hardcoded-fallback-secret
+  message: >-
+    A JWT/session-signing secret is read from configuration with a
+    hardcoded string as the fallback default (`System.getProperty("...",
+    "literal")`, `env.getProperty("...", "literal")`). If the real
+    environment variable or property is ever unset - a common deployment
+    mistake - every instance silently falls back to the same publicly
+    visible secret, which lets anyone forge valid tokens (CWE-798,
+    CWE-321). Fail closed instead: throw if the property is missing rather
+    than substituting a literal.
+  severity: ERROR
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-798: Use of Hard-coded Credentials"
+      - "CWE-321: Use of Hard-coded Cryptographic Key"
+    owasp:
+      - "A07:2021 - Identification and Authentication Failures"
+    subcategory: [vuln]
+    likelihood: LOW
+    impact: HIGH
+    confidence: LOW
+    technology: [java]
+  patterns:
+    - pattern-either:
+        - pattern: System.getProperty($KEY, "...")
+        - pattern: System.getenv($KEY, "...")
+        - pattern: $ENV.getProperty($KEY, "...")
+        - pattern: $ENV.getProperty($KEY, "...", ...)
+    - metavariable-regex:
+        metavariable: $KEY
+        regex: (?i)"[^"]*(secret|jwt|token|signing.?key|api.?key|password|passwd|credential)[^"]*"

narvy/rules/web/local/java_narvy/deserialization.yml

@@ -0,0 +1,108 @@
+rules:
+
+# Java unsafe deserialization: ObjectInputStream, Jackson polymorphic typing, JMS ObjectMessage.
+
+- id: narvy.java.deserialization.objectinputstream-readobject.objectinputstream-readobject
+  message: >-
+    `ObjectInputStream.readObject()` deserialises whatever class stream the
+    caller supplies. If the underlying stream can come from the network, a
+    file upload, or any other untrusted source, an attacker can smuggle a
+    gadget-chain payload that executes arbitrary code the moment it is
+    deserialised, before any application logic runs (CWE-502). Avoid native
+    Java serialization for untrusted input; use a data format with no code
+    execution surface (JSON/Protobuf), or wrap the stream in a
+    `ObjectInputFilter` allow-list of expected classes.
+  severity: ERROR
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-502: Deserialization of Untrusted Data"
+    owasp:
+      - "A08:2021 - Software and Data Integrity Failures"
+    subcategory: [vuln]
+    likelihood: LOW
+    impact: HIGH
+    confidence: LOW
+    technology: [java]
+  patterns:
+    - pattern-either:
+        - pattern: new ObjectInputStream($SOCK.getInputStream()).readObject()
+        - pattern: |
+            $OIS = new ObjectInputStream($SOCK.getInputStream());
+            ...
+            $OIS.readObject();
+        - pattern: |
+            $OIS = new ObjectInputStream($ANY);
+            ...
+            $OIS.readObject();
+    - pattern-not: |
+        $OIS = new ObjectInputStream($ANY);
+        $OIS.setObjectInputFilter(...);
+        ...
+        $OIS.readObject();
+
+- id: narvy.java.deserialization.jackson-enable-default-typing.jackson-enable-default-typing
+  message: >-
+    Jackson's `ObjectMapper` has polymorphic default typing enabled
+    (`enableDefaultTyping`/`activateDefaultTyping`) with no restricted
+    `PolymorphicTypeValidator`. This embeds a `@class` field in the JSON that
+    tells Jackson which concrete class to instantiate, and an attacker who
+    controls the JSON can point it at a gadget class already on the
+    classpath to achieve remote code execution (CWE-502). Remove default
+    typing, or pass a `BasicPolymorphicTypeValidator` restricted to an
+    explicit allow-list of expected base types.
+  severity: ERROR
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-502: Deserialization of Untrusted Data"
+    owasp:
+      - "A08:2021 - Software and Data Integrity Failures"
+    subcategory: [vuln]
+    likelihood: LOW
+    impact: HIGH
+    confidence: MEDIUM
+    technology: [java]
+  patterns:
+    - pattern-either:
+        # Bare/legacy calls carry no validator at all - always permissive.
+        - pattern: $MAPPER.enableDefaultTyping()
+        - pattern: $MAPPER.enableDefaultTyping($X)
+        # Only the laissez-faire validator (accepts every class) is flagged; a scoped validator is left alone.
+        - pattern: $MAPPER.activateDefaultTyping(LaissezFaireSubTypeValidator.instance)
+        - pattern: $MAPPER.activateDefaultTyping(LaissezFaireSubTypeValidator.instance, ...)
+    # Exclude Spring Security's SecurityJackson2Modules.enableDefaultTyping: it installs typing behind an allow-list (mitigated form).
+    - pattern-not: SecurityJackson2Modules.enableDefaultTyping(...)
+    - pattern-not: $P.SecurityJackson2Modules.enableDefaultTyping(...)
+
+- id: narvy.java.deserialization.jms-objectmessage-getobject.jms-objectmessage-getobject
+  message: >-
+    `ObjectMessage.getObject()` deserialises the message payload with native
+    Java serialization. A JMS broker that accepts messages from outside the
+    trust boundary (or a compromised producer) can deliver a gadget-chain
+    payload that executes on `getObject()` (CWE-502). Prefer `TextMessage`
+    with an explicit JSON/Protobuf parser, or configure the JMS provider's
+    class allow-list (e.g. ActiveMQ's `trustedPackages`) if
+    `ObjectMessage` must be kept.
+  severity: WARNING
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-502: Deserialization of Untrusted Data"
+    owasp:
+      - "A08:2021 - Software and Data Integrity Failures"
+    subcategory: [vuln]
+    likelihood: LOW
+    impact: HIGH
+    confidence: LOW
+    technology: [java]
+  patterns:
+    - pattern-either:
+        - pattern: (($T) $MSG).getObject()
+        - pattern: $MSG.getObject()
+    - pattern-inside: |
+        $MSG = ($T) $CONSUMER.receive(...);
+        ...

narvy/rules/web/local/java_narvy/mybatis.yml

@@ -0,0 +1,39 @@
+rules:
+
+# MyBatis mapper XML: `${...}` splices into SQL text (unlike `#{...}` which binds `?`), so tainted `${...}` is SQLi. Generic mode over mapper *.xml.
+
+- id: narvy.java.mybatis.handwritten-dollar-substitution.handwritten-dollar-substitution
+  message: >-
+    A MyBatis mapper uses `${...}` substitution in a SQL statement. MyBatis
+    inlines `${...}` into the query text verbatim (only `#{...}` becomes a
+    bound `?` placeholder), so any tainted value that reaches it is a SQL
+    injection (CWE-89). Use `#{param}` for values; a `${...}` is only
+    acceptable for a column/table identifier you have validated against a
+    fixed allow-list.
+  severity: ERROR
+  languages: [generic]
+  paths:
+    include:
+      - "*.xml"
+  metadata:
+    category: security
+    cwe:
+      - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+    owasp:
+      - "A03:2021 - Injection"
+    subcategory: [vuln]
+    likelihood: HIGH
+    impact: HIGH
+    confidence: MEDIUM
+    technology: [java, mybatis]
+  patterns:
+    - pattern-regex: '\$\{[^}]+\}'
+    # Exclude MyBatis Generator boilerplate tokens (framework-emitted, not hand-written interpolation).
+    - pattern-not-regex: '\$\{(criterion\.condition|criterion\.value|orderByClause|listItem|item\.[A-Za-z0-9_.]+)\}'
+    # Scope to MyBatis SQL statement elements, else `${...}` hits log4j2/Spring placeholders (large FP class).
+    - pattern-either:
+        - pattern-inside: "<select ...>...</select>"
+        - pattern-inside: "<insert ...>...</insert>"
+        - pattern-inside: "<update ...>...</update>"
+        - pattern-inside: "<delete ...>...</delete>"
+        - pattern-inside: "<sql ...>...</sql>"

narvy/rules/web/local/java_narvy/snakeyaml.yml

@@ -0,0 +1,34 @@
+rules:
+
+# SnakeYAML: default `new Yaml()` uses the unrestricted `Constructor`, an RCE gadget on attacker-controlled YAML.
+
+- id: narvy.java.deserialization.snakeyaml-unsafe-constructor.snakeyaml-unsafe-constructor
+  message: >-
+    A SnakeYAML `Yaml` built with the default constructor parses input with
+    the unrestricted `Constructor`, which will instantiate any Java type the
+    document names through a `!!package.Class` tag. On attacker-controlled
+    YAML this is a deserialization gadget that leads to remote code execution
+    (CWE-502). Construct the parser with `new Yaml(new SafeConstructor(new
+    LoaderOptions()))` (or a `Constructor` restricted to an explicit
+    allow-list of expected types) before calling `load`.
+  severity: ERROR
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-502: Deserialization of Untrusted Data"
+    owasp:
+      - "A08:2021 - Software and Data Integrity Failures"
+    subcategory: [vuln]
+    likelihood: MEDIUM
+    impact: HIGH
+    confidence: MEDIUM
+    technology: [java, snakeyaml]
+  patterns:
+    - pattern-inside: |
+        Yaml $Y = new Yaml();
+        ...
+    - pattern-either:
+        - pattern: $Y.load($SRC)
+        - pattern: $Y.loadAll($SRC)
+        - pattern: $Y.loadAs($SRC, ...)

narvy/rules/web/local/java_narvy/spring_authz.yml

@@ -0,0 +1,32 @@
+rules:
+
+# Spring Security authorization: a filter chain that permits every request.
+
+- id: narvy.java.spring.permit-all-requests.permit-all-requests
+  message: >-
+    This Spring Security filter chain authorizes EVERY request
+    (`anyRequest().permitAll()`), so no endpoint behind it requires
+    authentication. If any protected resource is served by this chain, it is
+    now publicly reachable (CWE-862, Missing Authorization). Scope
+    `permitAll()` to the handful of genuinely public paths with
+    `requestMatchers(...)` and finish the chain with
+    `anyRequest().authenticated()` so anything you did not explicitly open
+    stays protected.
+  severity: ERROR
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-862: Missing Authorization"
+    owasp:
+      - "A01:2021 - Broken Access Control"
+    subcategory: [vuln]
+    likelihood: MEDIUM
+    impact: HIGH
+    confidence: MEDIUM
+    technology: [java, spring]
+  patterns:
+    - pattern-either:
+        - pattern: $A.anyRequest().permitAll()
+        - pattern: $A.antMatchers("/**").permitAll()
+        - pattern: $A.requestMatchers("/**").permitAll()

narvy/rules/web/local/java_narvy/spring_config.yml

@@ -0,0 +1,67 @@
+rules:
+
+# Spring Boot config hardening (application.properties/.yml): actuator endpoints exposed, H2 web console on.
+# Generic mode over *.properties/*.yml.
+
+- id: narvy.java.spring.actuator-exposed-all.actuator-exposed-all
+  message: >-
+    `management.endpoints.web.exposure.include` is set to `*`, which exposes
+    EVERY actuator endpoint over HTTP - including `/actuator/env`,
+    `/actuator/heapdump`, `/actuator/threaddump` and, when Spring Boot Admin
+    or the loggers endpoint is present, remote configuration changes. These
+    leak environment variables, secrets and internal state, and several are
+    write-capable (CWE-200, CWE-16). Expose only the endpoints you actually
+    need (typically `health,info`) and secure the management port/context
+    behind authentication.
+  severity: WARNING
+  languages: [generic]
+  paths:
+    include:
+      - "*.properties"
+      - "*.yml"
+      - "*.yaml"
+      - "*.conf"
+  metadata:
+    category: security
+    cwe:
+      - "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
+    owasp:
+      - "A05:2021 - Security Misconfiguration"
+    subcategory: [audit]
+    likelihood: MEDIUM
+    impact: MEDIUM
+    confidence: HIGH
+    technology: [java, spring, spring-boot]
+  patterns:
+    - pattern-regex: 'management\.endpoints\.web\.exposure\.include\s*[:=]\s*["'']?\*'
+
+- id: narvy.java.spring.h2-console-enabled.h2-console-enabled
+  message: >-
+    The H2 database web console is enabled (`spring.h2.console.enabled=true`).
+    The console is an unauthenticated servlet by default that runs arbitrary
+    SQL - and, through H2's `CREATE ALIAS ... AS` / `RUNSCRIPT` features, can
+    reach arbitrary Java code, making an exposed console a remote-code-
+    execution path (CWE-489, CWE-16). Never enable it outside local
+    development; if it must be on in a shared environment, restrict its
+    path to localhost and put it behind authentication.
+  severity: WARNING
+  languages: [generic]
+  paths:
+    include:
+      - "*.properties"
+      - "*.yml"
+      - "*.yaml"
+      - "*.conf"
+  metadata:
+    category: security
+    cwe:
+      - "CWE-489: Active Debug Code"
+    owasp:
+      - "A05:2021 - Security Misconfiguration"
+    subcategory: [audit]
+    likelihood: MEDIUM
+    impact: HIGH
+    confidence: HIGH
+    technology: [java, spring, spring-boot, h2]
+  patterns:
+    - pattern-regex: 'spring\.h2\.console\.enabled\s*[:=]\s*true'