Spaces:
Sleeping
Sleeping
dhruvkachhela
feat: implement dynamic Semgrep rules sync engine, secure admin endpoint and offline rulesets
7228417 | { | |
| "rules": [ | |
| { | |
| "id": "javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression", | |
| "message": "Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input.", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" | |
| ], | |
| "owasp": [ | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "source-rule-url": "https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-eval-with-expression.js", | |
| "references": [ | |
| "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "javascript" | |
| ], | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Code Injection" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression", | |
| "shortlink": "https://sg.run/6nwK", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9315, | |
| "rv_id": 1263214, | |
| "rule_id": "yyUngo", | |
| "version_id": "WrTqKkJ", | |
| "url": "https://semgrep.dev/playground/r/WrTqKkJ/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$PROP = new URLSearchParams($WINDOW. ... .location.search).get('...')\n ...\n" | |
| }, | |
| { | |
| "pattern-inside": "$PROP = new URLSearchParams(location.search).get('...')\n ...\n" | |
| }, | |
| { | |
| "pattern-inside": "$PROP = new URLSearchParams($WINDOW. ... .location.hash.substring(1)).get('...')\n ...\n" | |
| }, | |
| { | |
| "pattern-inside": "$PROP = new URLSearchParams(location.hash.substring(1)).get('...')\n ...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$PROP" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$PROPS = new URLSearchParams($WINDOW. ... .location.search)\n ...\n" | |
| }, | |
| { | |
| "pattern-inside": "$PROPS = new URLSearchParams(location.search)\n ...\n" | |
| }, | |
| { | |
| "pattern-inside": "$PROPS = new\nURLSearchParams($WINDOW. ... .location.hash.substring(1))\n ...\n" | |
| }, | |
| { | |
| "pattern-inside": "$PROPS = new URLSearchParams(location.hash.substring(1))\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$PROPS.get('...')" | |
| }, | |
| { | |
| "focus-metavariable": "$PROPS" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "location.href" | |
| }, | |
| { | |
| "pattern": "location.hash" | |
| }, | |
| { | |
| "pattern": "location.search" | |
| }, | |
| { | |
| "pattern": "$WINDOW. ... .location.href" | |
| }, | |
| { | |
| "pattern": "$WINDOW. ... .location.hash" | |
| }, | |
| { | |
| "pattern": "$WINDOW. ... .location.search" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "eval(<... $SINK ...>)" | |
| }, | |
| { | |
| "pattern": "window.eval(<... $SINK ...>)" | |
| }, | |
| { | |
| "pattern": "new Function(<... $SINK ...>)" | |
| }, | |
| { | |
| "pattern": "new Function(<... $SINK ...>)(...)" | |
| }, | |
| { | |
| "pattern": "setTimeout(<... $SINK ...>,...)" | |
| }, | |
| { | |
| "pattern": "setInterval(<... $SINK ...>,...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$SINK" | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sanitizers": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "location.href = $FUNC(...)" | |
| }, | |
| { | |
| "pattern": "location.hash = $FUNC(...)" | |
| }, | |
| { | |
| "pattern": "location.search = $FUNC(...)" | |
| }, | |
| { | |
| "pattern": "$WINDOW. ... .location.href = $FUNC(...)" | |
| }, | |
| { | |
| "pattern": "$WINDOW. ... .location.hash = $FUNC(...)" | |
| }, | |
| { | |
| "pattern": "$WINDOW. ... .location.search = $FUNC(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run", | |
| "message": "Detected non-literal calls to Deno.run(). This could lead to a command injection vulnerability.", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" | |
| ], | |
| "owasp": [ | |
| "A01:2017 - Injection", | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "deno" | |
| ], | |
| "references": [ | |
| "https://deno.land/manual/examples/subprocess#simple-example" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "LOW", | |
| "impact": "HIGH", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Command Injection" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run", | |
| "shortlink": "https://sg.run/Nrrn", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9927, | |
| "rv_id": 1409397, | |
| "rule_id": "x8UWWg", | |
| "version_id": "PkTe7AP", | |
| "url": "https://semgrep.dev/playground/r/PkTe7AP/javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "ERROR", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "function ... (..., $ARG,...) {...}" | |
| }, | |
| { | |
| "focus-metavariable": "$ARG" | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "Deno.run({cmd: [$INPUT,...]},...)\n" | |
| }, | |
| { | |
| "pattern": "Deno.run({cmd: [\"=~/(sh|bash|ksh|csh|tcsh|zsh)/\",\"-c\",$INPUT,...]},...)\n" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern": "Deno.run({cmd: [$CMD,\"-c\",$INPUT,...]},...)\n" | |
| }, | |
| { | |
| "pattern-inside": "$CMD = \"=~/(sh|bash|ksh|csh|tcsh|zsh)/\"\n...\n" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$INPUT" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config", | |
| "message": "Prefer Argon2id where possible. Per RFC9016, section 4 IETF recommends selecting Argon2id unless you can guarantee an adversary has no direct access to the computing environment.", | |
| "metadata": { | |
| "references": [ | |
| "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html", | |
| "https://eprint.iacr.org/2016/759.pdf", | |
| "https://www.cs.tau.ac.il/~tromer/papers/cache-joc-20090619.pdf", | |
| "https://datatracker.ietf.org/doc/html/rfc9106#section-4" | |
| ], | |
| "category": "security", | |
| "cwe": [ | |
| "CWE-916: Use of Password Hash With Insufficient Computational Effort" | |
| ], | |
| "technology": [ | |
| "argon2", | |
| "cryptography" | |
| ], | |
| "owasp": [ | |
| "A02:2021 - Cryptographic Failures", | |
| "A04:2025 - Cryptographic Failures" | |
| ], | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "impact": "LOW", | |
| "likelihood": "HIGH", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Insecure Hashing Algorithm" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config", | |
| "shortlink": "https://sg.run/ALq4", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 20150, | |
| "rv_id": 1263103, | |
| "rule_id": "DbU2X8", | |
| "version_id": "qkTR7Jk", | |
| "url": "https://semgrep.dev/playground/r/qkTR7Jk/javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$ARGON = require('argon2');\n...\n" | |
| }, | |
| { | |
| "pattern": "{type: ...}\n" | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern": "$Y\n" | |
| }, | |
| { | |
| "pattern-inside": "$ARGON.hash(...,$Y)\n" | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sanitizers": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern": "{type: $ARGON.argon2id}" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret", | |
| "message": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).", | |
| "options": { | |
| "interfile": true | |
| }, | |
| "metadata": { | |
| "interfile": true, | |
| "cwe": [ | |
| "CWE-798: Use of Hard-coded Credentials" | |
| ], | |
| "references": [ | |
| "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html" | |
| ], | |
| "owasp": [ | |
| "A07:2021 - Identification and Authentication Failures", | |
| "A07:2025 - Authentication Failures" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "express", | |
| "secrets" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "audit" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "MEDIUM", | |
| "confidence": "HIGH", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Hard-coded Secrets" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret", | |
| "shortlink": "https://sg.run/Do1d", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9252, | |
| "rv_id": 1263166, | |
| "rule_id": "pKUOjy", | |
| "version_id": "pZT03Q0", | |
| "url": "https://semgrep.dev/playground/r/pZT03Q0/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$JWT = require('express-jwt');\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $JWT from 'express-jwt';\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $JWT from 'express-jwt';\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import { ..., $JWT, ... } from 'express-jwt';\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$JWT({...,secret: \"$Y\",...},...)\n" | |
| }, | |
| { | |
| "pattern": "$OPTS = \"$Y\";\n...\n$JWT({...,secret: $OPTS},...);\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$Y" | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.cors-misconfiguration.cors-misconfiguration", | |
| "message": "By letting user input control CORS parameters, there is a risk that software does not properly verify that the source of data or communication is valid. Use literal values for CORS settings.", | |
| "metadata": { | |
| "owasp": [ | |
| "A07:2021 - Identification and Authentication Failures", | |
| "A07:2025 - Authentication Failures" | |
| ], | |
| "cwe": [ | |
| "CWE-346: Origin Validation Error" | |
| ], | |
| "category": "security", | |
| "references": [ | |
| "https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS" | |
| ], | |
| "technology": [ | |
| "express" | |
| ], | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Improper Authentication" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.cors-misconfiguration.cors-misconfiguration", | |
| "shortlink": "https://sg.run/nKXO", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 13580, | |
| "rv_id": 1263162, | |
| "rule_id": "5rULJQ", | |
| "version_id": "YDTZe8Y", | |
| "url": "https://semgrep.dev/playground/r/YDTZe8Y/javascript.express.security.cors-misconfiguration.cors-misconfiguration", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES) {...}" | |
| }, | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES, $NEXT) {...}" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {...})" | |
| }, | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|head|delete|options)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| }, | |
| { | |
| "pattern": "$REQ.cookies" | |
| }, | |
| { | |
| "pattern": "$REQ.headers" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" | |
| }, | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response) => {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$REQ" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "params" | |
| }, | |
| { | |
| "pattern": "query" | |
| }, | |
| { | |
| "pattern": "cookies" | |
| }, | |
| { | |
| "pattern": "headers" | |
| }, | |
| { | |
| "pattern": "body" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$RES.set($HEADER, $X)" | |
| }, | |
| { | |
| "pattern": "$RES.header($HEADER, $X)" | |
| }, | |
| { | |
| "pattern": "$RES.setHeader($HEADER, $X)" | |
| }, | |
| { | |
| "pattern": "$RES.set({$HEADER: $X}, ...)\n" | |
| }, | |
| { | |
| "pattern": "$RES.writeHead($STATUS, {$HEADER: $X}, ...)\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$X" | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$HEADER", | |
| "regex": ".*(Access-Control-Allow-Origin|access-control-allow-origin).*" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.express-vm2-injection.express-vm2-injection", | |
| "message": "Make sure that unverified user data can not reach `vm2`.", | |
| "metadata": { | |
| "owasp": [ | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "references": [ | |
| "https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html" | |
| ], | |
| "cwe": [ | |
| "CWE-94: Improper Control of Generation of Code ('Code Injection')" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "express" | |
| ], | |
| "cwe2022-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Code Injection" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.express-vm2-injection.express-vm2-injection", | |
| "shortlink": "https://sg.run/1GWv", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 12822, | |
| "rv_id": 1263171, | |
| "rule_id": "WAUPXJ", | |
| "version_id": "9lT4bnX", | |
| "url": "https://semgrep.dev/playground/r/9lT4bnX/javascript.express.security.express-vm2-injection.express-vm2-injection", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES) {...}" | |
| }, | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES, $NEXT) {...}" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {...})" | |
| }, | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|head|delete|options)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| }, | |
| { | |
| "pattern": "$REQ.cookies" | |
| }, | |
| { | |
| "pattern": "$REQ.headers" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" | |
| }, | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response) => {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$REQ" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "params" | |
| }, | |
| { | |
| "pattern": "query" | |
| }, | |
| { | |
| "pattern": "cookies" | |
| }, | |
| { | |
| "pattern": "headers" | |
| }, | |
| { | |
| "pattern": "body" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "require('vm2')\n...\n" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$VM = new VM(...)\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$VM = new NodeVM(...)\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$VM.run(...)\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "new VM(...).run(...)\n" | |
| }, | |
| { | |
| "pattern": "new NodeVM(...).run(...)\n" | |
| }, | |
| { | |
| "pattern": "new VMScript(...)\n" | |
| }, | |
| { | |
| "pattern": "new VM(...)\n" | |
| }, | |
| { | |
| "pattern": "new NodeVM(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.express-xml2json-xxe.express-xml2json-xxe", | |
| "message": "Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities", | |
| "metadata": { | |
| "owasp": [ | |
| "A04:2017 - XML External Entities (XXE)", | |
| "A05:2021 - Security Misconfiguration", | |
| "A02:2025 - Security Misconfiguration" | |
| ], | |
| "cwe": [ | |
| "CWE-611: Improper Restriction of XML External Entity Reference" | |
| ], | |
| "asvs": { | |
| "section": "V5 Validation, Sanitization and Encoding", | |
| "control_id": "5.5.2 Insecue XML Deserialization", | |
| "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention", | |
| "version": "4" | |
| }, | |
| "category": "security", | |
| "technology": [ | |
| "express" | |
| ], | |
| "references": [ | |
| "https://www.npmjs.com/package/xml2json" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "XML Injection" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe", | |
| "shortlink": "https://sg.run/XBD4", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9264, | |
| "rv_id": 1263174, | |
| "rule_id": "x8Uneb", | |
| "version_id": "bZT534J", | |
| "url": "https://semgrep.dev/playground/r/bZT534J/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "ERROR", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES) {...}" | |
| }, | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES, $NEXT) {...}" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {...})" | |
| }, | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|head|delete|options)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| }, | |
| { | |
| "pattern": "$REQ.cookies" | |
| }, | |
| { | |
| "pattern": "$REQ.headers" | |
| }, | |
| { | |
| "pattern": "$REQ.files.$ANYTHING.data.toString('utf8')" | |
| }, | |
| { | |
| "pattern": "$REQ.files.$ANYTHING['data'].toString('utf8')" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" | |
| }, | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response) => {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$REQ" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "params" | |
| }, | |
| { | |
| "pattern": "query" | |
| }, | |
| { | |
| "pattern": "cookies" | |
| }, | |
| { | |
| "pattern": "headers" | |
| }, | |
| { | |
| "pattern": "body" | |
| }, | |
| { | |
| "pattern": "files.$ANYTHING.data.toString('utf8')" | |
| }, | |
| { | |
| "pattern": "files.$ANYTHING['data'].toString('utf8')" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "require('xml2json');\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import 'xml2json';\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$EXPAT.toJson($SINK,...)" | |
| }, | |
| { | |
| "focus-metavariable": "$SINK" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.express-phantom-injection.express-phantom-injection", | |
| "message": "If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities", | |
| "metadata": { | |
| "owasp": [ | |
| "A10:2021 - Server-Side Request Forgery (SSRF)", | |
| "A01:2025 - Broken Access Control" | |
| ], | |
| "cwe": [ | |
| "CWE-918: Server-Side Request Forgery (SSRF)" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "express" | |
| ], | |
| "references": [ | |
| "https://phantomjs.org/page-automation.html" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Server-Side Request Forgery (SSRF)" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.express-phantom-injection.express-phantom-injection", | |
| "shortlink": "https://sg.run/W8BL", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9253, | |
| "rv_id": 1263167, | |
| "rule_id": "2ZUbx3", | |
| "version_id": "2KTv26p", | |
| "url": "https://semgrep.dev/playground/r/2KTv26p/javascript.express.security.express-phantom-injection.express-phantom-injection", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "ERROR", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES) {...}" | |
| }, | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES, $NEXT) {...}" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {...})" | |
| }, | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|head|delete|options)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| }, | |
| { | |
| "pattern": "$REQ.cookies" | |
| }, | |
| { | |
| "pattern": "$REQ.headers" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" | |
| }, | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response) => {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$REQ" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "params" | |
| }, | |
| { | |
| "pattern": "query" | |
| }, | |
| { | |
| "pattern": "cookies" | |
| }, | |
| { | |
| "pattern": "headers" | |
| }, | |
| { | |
| "pattern": "body" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "require('phantom');\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import 'phantom';\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$PAGE.open($SINK,...)" | |
| }, | |
| { | |
| "pattern": "$PAGE.setContent($SINK,...)" | |
| }, | |
| { | |
| "pattern": "$PAGE.openUrl($SINK,...)" | |
| }, | |
| { | |
| "pattern": "$PAGE.evaluateJavaScript($SINK,...)" | |
| }, | |
| { | |
| "pattern": "$PAGE.property(\"content\",$SINK,...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$SINK" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.express-vm-injection.express-vm-injection", | |
| "message": "Make sure that unverified user data can not reach `$VM`.", | |
| "metadata": { | |
| "owasp": [ | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "references": [ | |
| "https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html" | |
| ], | |
| "cwe": [ | |
| "CWE-94: Improper Control of Generation of Code ('Code Injection')" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "express" | |
| ], | |
| "cwe2022-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Code Injection" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.express-vm-injection.express-vm-injection", | |
| "shortlink": "https://sg.run/jkqJ", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 12821, | |
| "rv_id": 1263170, | |
| "rule_id": "DbUKPX", | |
| "version_id": "1QTypXQ", | |
| "url": "https://semgrep.dev/playground/r/1QTypXQ/javascript.express.security.express-vm-injection.express-vm-injection", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "ERROR", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES) {...}" | |
| }, | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES, $NEXT) {...}" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {...})" | |
| }, | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|head|delete|options)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| }, | |
| { | |
| "pattern": "$REQ.cookies" | |
| }, | |
| { | |
| "pattern": "$REQ.headers" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" | |
| }, | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response) => {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$REQ" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "params" | |
| }, | |
| { | |
| "pattern": "query" | |
| }, | |
| { | |
| "pattern": "cookies" | |
| }, | |
| { | |
| "pattern": "headers" | |
| }, | |
| { | |
| "pattern": "body" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$VM = require('vm');\n...\n" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$VM.runInContext(...)\n" | |
| }, | |
| { | |
| "pattern": "$VM.runInNewContext(...)\n" | |
| }, | |
| { | |
| "pattern": "$VM.compileFunction(...)\n" | |
| }, | |
| { | |
| "pattern": "$VM.runInThisContext(...)\n" | |
| }, | |
| { | |
| "pattern": "new $VM.Script(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.express-expat-xxe.express-expat-xxe", | |
| "message": "Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities.", | |
| "options": { | |
| "interfile": true | |
| }, | |
| "metadata": { | |
| "interfile": true, | |
| "owasp": [ | |
| "A04:2017 - XML External Entities (XXE)", | |
| "A05:2021 - Security Misconfiguration", | |
| "A02:2025 - Security Misconfiguration" | |
| ], | |
| "cwe": [ | |
| "CWE-611: Improper Restriction of XML External Entity Reference" | |
| ], | |
| "asvs": { | |
| "section": "V5 Validation, Sanitization and Encoding", | |
| "control_id": "5.5.2 Insecue XML Deserialization", | |
| "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention", | |
| "version": "4" | |
| }, | |
| "references": [ | |
| "https://github.com/astro/node-expat" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "express" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "XML Injection" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.express-expat-xxe.express-expat-xxe", | |
| "shortlink": "https://sg.run/BkXx", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9251, | |
| "rv_id": 1263164, | |
| "rule_id": "zdUkJl", | |
| "version_id": "o5TbD5l", | |
| "url": "https://semgrep.dev/playground/r/o5TbD5l/javascript.express.security.express-expat-xxe.express-expat-xxe", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "ERROR", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES) {...}" | |
| }, | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES, $NEXT) {...}" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {...})" | |
| }, | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|head|delete|options)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| }, | |
| { | |
| "pattern": "$REQ.cookies" | |
| }, | |
| { | |
| "pattern": "$REQ.headers" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" | |
| }, | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response) => {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$REQ" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "params" | |
| }, | |
| { | |
| "pattern": "query" | |
| }, | |
| { | |
| "pattern": "cookies" | |
| }, | |
| { | |
| "pattern": "headers" | |
| }, | |
| { | |
| "pattern": "body" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$XML = require('node-expat')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $XML from 'node-expat'\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $XML from 'node-expat'\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$PARSER = new $XML.Parser(...);\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$PARSER.parse($QUERY)" | |
| }, | |
| { | |
| "pattern": "$PARSER.write($QUERY)" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$QUERY" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration", | |
| "message": "By letting user input control `X-Frame-Options` header, there is a risk that software does not properly verify whether or not a browser should be allowed to render a page in an `iframe`.", | |
| "metadata": { | |
| "references": [ | |
| "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options" | |
| ], | |
| "owasp": [ | |
| "A04:2021 - Insecure Design", | |
| "A06:2025 - Insecure Design" | |
| ], | |
| "cwe": [ | |
| "CWE-451: User Interface (UI) Misrepresentation of Critical Information" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "express" | |
| ], | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Other" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration", | |
| "shortlink": "https://sg.run/EvjA", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 13581, | |
| "rv_id": 1263178, | |
| "rule_id": "GdUrLy", | |
| "version_id": "xyTjz3D", | |
| "url": "https://semgrep.dev/playground/r/xyTjz3D/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES) {...}" | |
| }, | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES, $NEXT) {...}" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {...})" | |
| }, | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|head|delete|options)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| }, | |
| { | |
| "pattern": "$REQ.cookies" | |
| }, | |
| { | |
| "pattern": "$REQ.headers" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" | |
| }, | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response) => {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$REQ" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "params" | |
| }, | |
| { | |
| "pattern": "query" | |
| }, | |
| { | |
| "pattern": "cookies" | |
| }, | |
| { | |
| "pattern": "headers" | |
| }, | |
| { | |
| "pattern": "body" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$RES.set($HEADER, ...)" | |
| }, | |
| { | |
| "pattern": "$RES.header($HEADER, ...)" | |
| }, | |
| { | |
| "pattern": "$RES.setHeader($HEADER, ...)" | |
| }, | |
| { | |
| "pattern": "$RES.set({$HEADER: ...}, ...)\n" | |
| }, | |
| { | |
| "pattern": "$RES.writeHead($STATUS, {$HEADER: ...}, ...)\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$HEADER", | |
| "regex": ".*(X-Frame-Options|x-frame-options).*" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.require-request.require-request", | |
| "message": "If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server.", | |
| "options": { | |
| "interfile": true | |
| }, | |
| "metadata": { | |
| "interfile": true, | |
| "owasp": [ | |
| "A01:2021 - Broken Access Control", | |
| "A01:2025 - Broken Access Control" | |
| ], | |
| "cwe": [ | |
| "CWE-706: Use of Incorrectly-Resolved Name or Reference" | |
| ], | |
| "source-rule-url": "https://nodesecroadmap.fyi/chapter-1/threat-UIR.html", | |
| "category": "security", | |
| "technology": [ | |
| "express" | |
| ], | |
| "references": [ | |
| "https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it" | |
| ], | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Improper Authorization" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.require-request.require-request", | |
| "shortlink": "https://sg.run/jRbl", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9265, | |
| "rv_id": 1263177, | |
| "rule_id": "OrU3WK", | |
| "version_id": "w8TRo0d", | |
| "url": "https://semgrep.dev/playground/r/w8TRo0d/javascript.express.security.require-request.require-request", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "ERROR", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES) {...}" | |
| }, | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES, $NEXT) {...}" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {...})" | |
| }, | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|head|delete|options)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| }, | |
| { | |
| "pattern": "$REQ.cookies" | |
| }, | |
| { | |
| "pattern": "$REQ.headers" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" | |
| }, | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response) => {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$REQ" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "params" | |
| }, | |
| { | |
| "pattern": "query" | |
| }, | |
| { | |
| "pattern": "cookies" | |
| }, | |
| { | |
| "pattern": "headers" | |
| }, | |
| { | |
| "pattern": "body" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern": "require($SINK)" | |
| }, | |
| { | |
| "focus-metavariable": "$SINK" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.express-insecure-template-usage.express-insecure-template-usage", | |
| "message": "User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection (SSTI) vulnerability.", | |
| "options": { | |
| "interfile": true | |
| }, | |
| "metadata": { | |
| "interfile": true, | |
| "category": "security", | |
| "cwe": [ | |
| "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine" | |
| ], | |
| "owasp": [ | |
| "A03:2021 - Injection", | |
| "A01:2017 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "references": [ | |
| "https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html" | |
| ], | |
| "technology": [ | |
| "javascript", | |
| "typescript", | |
| "express", | |
| "pug", | |
| "jade", | |
| "dot", | |
| "ejs", | |
| "nunjucks", | |
| "lodash", | |
| "handlbars", | |
| "mustache", | |
| "hogan.js", | |
| "eta", | |
| "squirrelly" | |
| ], | |
| "source_rule_url": [ | |
| "https://github.com/github/codeql/blob/2ba2642c7ab29b9eedef33bcc2b8cd1d203d0c10/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/template-sinks.js" | |
| ], | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Code Injection" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage", | |
| "shortlink": "https://sg.run/b49v", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 19226, | |
| "rv_id": 1263165, | |
| "rule_id": "EwUr9k", | |
| "version_id": "zyTb2eD", | |
| "url": "https://semgrep.dev/playground/r/zyTb2eD/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-propagators": [ | |
| { | |
| "pattern": "$MODEL.$FIND($E).then((...,$S,...)=>{...})", | |
| "from": "$E", | |
| "to": "$S" | |
| } | |
| ], | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES) {...}" | |
| }, | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES, $NEXT) {...}" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {...})" | |
| }, | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|head|delete|options)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| }, | |
| { | |
| "pattern": "$REQ.cookies" | |
| }, | |
| { | |
| "pattern": "$REQ.headers" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" | |
| }, | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response) => {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$REQ" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "params" | |
| }, | |
| { | |
| "pattern": "query" | |
| }, | |
| { | |
| "pattern": "cookies" | |
| }, | |
| { | |
| "pattern": "headers" | |
| }, | |
| { | |
| "pattern": "body" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$PUG = require('pug')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $PUG from 'pug'\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$PUG = require('jade')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $PUG from 'jade'\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$PUG.compile(...)" | |
| }, | |
| { | |
| "pattern": "$PUG.compileClient(...)" | |
| }, | |
| { | |
| "pattern": "$PUG.compileClientWithDependenciesTracked(...)" | |
| }, | |
| { | |
| "pattern": "$PUG.render(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$PUG = require('dot')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $PUG from 'dot'\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$PUG.template(...)" | |
| }, | |
| { | |
| "pattern": "$PUG.compile(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$PUG = require('ejs')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $PUG from 'ejs'\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$PUG.render(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$PUG = require('nunjucks')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $PUG from 'nunjucks'\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$PUG.renderString(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$PUG = require('lodash')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $PUG from 'lodash'\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$PUG.template(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$PUG = require('mustache')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $PUG from 'mustache'\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$PUG = require('eta')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $PUG from 'eta'\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$PUG = require('squirrelly')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $PUG from 'squirrelly'\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$PUG.render(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$PUG = require('hogan.js')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $PUG from 'hogan.js'\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$PUG = require('handlebars')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $PUG from 'handlebars'\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$PUG.compile(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.express-puppeteer-injection.express-puppeteer-injection", | |
| "message": "If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities", | |
| "metadata": { | |
| "owasp": [ | |
| "A10:2021 - Server-Side Request Forgery (SSRF)", | |
| "A01:2025 - Broken Access Control" | |
| ], | |
| "cwe": [ | |
| "CWE-918: Server-Side Request Forgery (SSRF)" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "express" | |
| ], | |
| "references": [ | |
| "https://pptr.dev/api/puppeteer.page" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Server-Side Request Forgery (SSRF)" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection", | |
| "shortlink": "https://sg.run/0QJB", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9254, | |
| "rv_id": 1263168, | |
| "rule_id": "X5U8Nz", | |
| "version_id": "X0TzyJY", | |
| "url": "https://semgrep.dev/playground/r/X0TzyJY/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "ERROR", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES) {...}" | |
| }, | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES, $NEXT) {...}" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {...})" | |
| }, | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|head|delete|options)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| }, | |
| { | |
| "pattern": "$REQ.cookies" | |
| }, | |
| { | |
| "pattern": "$REQ.headers" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" | |
| }, | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response) => {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$REQ" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "params" | |
| }, | |
| { | |
| "pattern": "query" | |
| }, | |
| { | |
| "pattern": "cookies" | |
| }, | |
| { | |
| "pattern": "headers" | |
| }, | |
| { | |
| "pattern": "body" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "require('puppeteer');\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import 'puppeteer';\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$PAGE.goto($SINK,...)" | |
| }, | |
| { | |
| "pattern": "$PAGE.setContent($SINK,...)" | |
| }, | |
| { | |
| "pattern": "$PAGE.evaluate($SINK,...)" | |
| }, | |
| { | |
| "pattern": "$PAGE.evaluate($CODE,$SINK,...)" | |
| }, | |
| { | |
| "pattern": "$PAGE.evaluateHandle($SINK,...)" | |
| }, | |
| { | |
| "pattern": "$PAGE.evaluateHandle($CODE,$SINK,...)" | |
| }, | |
| { | |
| "pattern": "$PAGE.evaluateOnNewDocument($SINK,...)" | |
| }, | |
| { | |
| "pattern": "$PAGE.evaluateOnNewDocument($CODE,$SINK,...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$SINK" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.express-sandbox-injection.express-sandbox-code-injection", | |
| "message": "Make sure that unverified user data can not reach `sandbox`.", | |
| "metadata": { | |
| "owasp": [ | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "references": [ | |
| "https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html" | |
| ], | |
| "cwe": [ | |
| "CWE-94: Improper Control of Generation of Code ('Code Injection')" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "express" | |
| ], | |
| "cwe2022-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Code Injection" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection", | |
| "shortlink": "https://sg.run/KlwL", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9255, | |
| "rv_id": 1263169, | |
| "rule_id": "j2UvXB", | |
| "version_id": "jQTn59D", | |
| "url": "https://semgrep.dev/playground/r/jQTn59D/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "ERROR", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES) {...}" | |
| }, | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES, $NEXT) {...}" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {...})" | |
| }, | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|head|delete|options)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| }, | |
| { | |
| "pattern": "$REQ.cookies" | |
| }, | |
| { | |
| "pattern": "$REQ.headers" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" | |
| }, | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response) => {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$REQ" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "params" | |
| }, | |
| { | |
| "pattern": "query" | |
| }, | |
| { | |
| "pattern": "cookies" | |
| }, | |
| { | |
| "pattern": "headers" | |
| }, | |
| { | |
| "pattern": "body" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$SANDBOX = require('sandbox');\n...\n" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$S = new $SANDBOX(...);\n...\n" | |
| }, | |
| { | |
| "pattern": "$S.run(...)\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "new $SANDBOX($OPTS).run(...)\n" | |
| }, | |
| { | |
| "pattern": "new $SANDBOX().run(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization", | |
| "message": "The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and Buffer.from().", | |
| "options": { | |
| "interfile": true | |
| }, | |
| "metadata": { | |
| "interfile": true, | |
| "technology": [ | |
| "express" | |
| ], | |
| "category": "security", | |
| "cwe": [ | |
| "CWE-502: Deserialization of Untrusted Data" | |
| ], | |
| "references": [ | |
| "https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html" | |
| ], | |
| "source_rule_url": [ | |
| "https://github.com/ajinabraham/njsscan/blob/75bfbeb9c8d72999e4d527dfa2548f7f0f3cc48a/njsscan/rules/semantic_grep/eval/eval_deserialize.yaml" | |
| ], | |
| "owasp": [ | |
| "A08:2017 - Insecure Deserialization", | |
| "A08:2021 - Software and Data Integrity Failures", | |
| "A08:2025 - Software or Data Integrity Failures" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "HIGH", | |
| "confidence": "HIGH", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Insecure Deserialization " | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization", | |
| "shortlink": "https://sg.run/8W5j", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 22084, | |
| "rv_id": 1263145, | |
| "rule_id": "9AUyqj", | |
| "version_id": "gETB7nD", | |
| "url": "https://semgrep.dev/playground/r/gETB7nD/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES) {...}" | |
| }, | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES, $NEXT) {...}" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {...})" | |
| }, | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|head|delete|options)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| }, | |
| { | |
| "pattern": "$REQ.cookies" | |
| }, | |
| { | |
| "pattern": "$REQ.headers" | |
| }, | |
| { | |
| "pattern": "$REQ.files.$ANYTHING.data.toString('utf8')" | |
| }, | |
| { | |
| "pattern": "$REQ.files.$ANYTHING['data'].toString('utf8')" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" | |
| }, | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response) => {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$REQ" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "params" | |
| }, | |
| { | |
| "pattern": "query" | |
| }, | |
| { | |
| "pattern": "cookies" | |
| }, | |
| { | |
| "pattern": "headers" | |
| }, | |
| { | |
| "pattern": "body" | |
| }, | |
| { | |
| "pattern": "files.$ANYTHING.data.toString('utf8')" | |
| }, | |
| { | |
| "pattern": "files.$ANYTHING['data'].toString('utf8')" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$SER = require('$IMPORT')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $SER from '$IMPORT'\n ...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $SER from '$IMPORT'\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$IMPORT", | |
| "regex": "^(node-serialize|serialize-to-js)$" | |
| } | |
| }, | |
| { | |
| "pattern": "$SER.$FUNC(...)" | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$FUNC", | |
| "regex": "^(unserialize|deserialize)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.audit.express-ssrf.express-ssrf", | |
| "message": "The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded to follow OWASP best practices to prevent abuse. ", | |
| "metadata": { | |
| "references": [ | |
| "https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html" | |
| ], | |
| "cwe": [ | |
| "CWE-918: Server-Side Request Forgery (SSRF)" | |
| ], | |
| "technology": [ | |
| "express" | |
| ], | |
| "category": "security", | |
| "owasp": [ | |
| "A10:2021 - Server-Side Request Forgery (SSRF)", | |
| "A01:2025 - Broken Access Control" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "HIGH", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Server-Side Request Forgery (SSRF)" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.audit.express-ssrf.express-ssrf", | |
| "shortlink": "https://sg.run/0PNw", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 22554, | |
| "rv_id": 1263144, | |
| "rule_id": "eqU9l2", | |
| "version_id": "8KT5rBr", | |
| "url": "https://semgrep.dev/playground/r/8KT5rBr/javascript.express.security.audit.express-ssrf.express-ssrf", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "options": { | |
| "taint_unify_mvars": true | |
| }, | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, ...) {...}" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| }, | |
| { | |
| "pattern": "$REQ.cookies" | |
| }, | |
| { | |
| "pattern": "$REQ.headers" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "({ $REQ }: Request,...) =>\n{...}\n" | |
| }, | |
| { | |
| "pattern-inside": "({ $REQ }: $EXPRESS.Request,...) => {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$REQ" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "params" | |
| }, | |
| { | |
| "pattern": "query" | |
| }, | |
| { | |
| "pattern": "cookies" | |
| }, | |
| { | |
| "pattern": "headers" | |
| }, | |
| { | |
| "pattern": "body" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$REQUEST = require('request')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $REQUEST from 'request'\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $REQUEST from 'request'\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQUEST.$METHOD(\"$HTTP\"+$REQ. ... .$VALUE)" | |
| }, | |
| { | |
| "pattern": "$REQUEST.$METHOD(\"$HTTP\"+$REQ. ... .$VALUE + $...A)" | |
| }, | |
| { | |
| "pattern": "$REQUEST.$METHOD(`$HTTP${$REQ. ... .$VALUE}...`)" | |
| }, | |
| { | |
| "pattern": "$REQUEST.$METHOD(\"$HTTP\"+$REQ.$VALUE[...])" | |
| }, | |
| { | |
| "pattern": "$REQUEST.$METHOD(\"$HTTP\"+$REQ.$VALUE[...] + $...A)" | |
| }, | |
| { | |
| "pattern": "$REQUEST.$METHOD(`$HTTP${$REQ.$VALUE[...]}...`)" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|patch|del|head|delete)$" | |
| } | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$HTTP", | |
| "regex": "^(https?:\\/\\/|//)$" | |
| } | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ. ... .$VALUE" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$REQUEST = require('request')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $REQUEST from 'request'\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $REQUEST from 'request'\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQUEST.$METHOD($REQ. ... .$VALUE,...)" | |
| }, | |
| { | |
| "pattern": "$REQUEST.$METHOD($REQ. ... .$VALUE + $...A,...)" | |
| }, | |
| { | |
| "pattern": "$REQUEST.$METHOD(`${$REQ. ... .$VALUE}...`,...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$REQ. ... .$VALUE" | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|patch|del|head|delete)$" | |
| } | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$REQUEST = require('request')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $REQUEST from 'request'\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $REQUEST from 'request'\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQUEST.$METHOD($REQ.$VALUE['...'],...)" | |
| }, | |
| { | |
| "pattern": "$REQUEST.$METHOD($REQ.$VALUE['...'] + $...A,...)" | |
| }, | |
| { | |
| "pattern": "$REQUEST.$METHOD(`${$REQ.$VALUE['...']}...`,...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$REQ.$VALUE" | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|patch|del|head|delete)$" | |
| } | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$REQUEST = require('request')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $REQUEST from 'request'\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $REQUEST from 'request'\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$ASSIGN = $REQ. ... .$VALUE\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$ASSIGN = $REQ. ... .$VALUE['...']\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$ASSIGN = $REQ. ... .$VALUE + $...A\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$ASSIGN = $REQ. ... .$VALUE['...'] + $...A\n... \n" | |
| }, | |
| { | |
| "pattern-inside": "$ASSIGN = `${$REQ. ... .$VALUE}...`\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$ASSIGN = `${$REQ. ... .$VALUE['...']}...`\n... \n" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$ASSIGN = \"$HTTP\"+ $REQ. ... .$VALUE\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$ASSIGN = \"$HTTP\"+$REQ. ... .$VALUE + $...A\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$ASSIGN = \"$HTTP\"+$REQ.$VALUE[...]\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$ASSIGN = \"$HTTP\"+$REQ.$VALUE[...] + $...A\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$ASSIGN = `$HTTP${$REQ.$VALUE[...]}...`\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$HTTP", | |
| "regex": "^(https?:\\/\\/|//)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQUEST.$METHOD($ASSIGN,...)" | |
| }, | |
| { | |
| "pattern": "$REQUEST.$METHOD($ASSIGN + $...FOO,...)" | |
| }, | |
| { | |
| "pattern": "$REQUEST.$METHOD(`${$ASSIGN}...`,...)" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQUEST.$METHOD(\"$HTTP\"+$ASSIGN,...)" | |
| }, | |
| { | |
| "pattern": "$REQUEST.$METHOD(\"$HTTP\"+$ASSIGN + $...A,...)" | |
| }, | |
| { | |
| "pattern": "$REQUEST.$METHOD(`$HTTP${$ASSIGN}...`,...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$HTTP", | |
| "regex": "^(https?:\\/\\/|//)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$ASSIGN" | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|patch|del|head|delete)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.audit.express-res-sendfile.express-res-sendfile", | |
| "message": "The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing the path. This allows you to validate the path against the intended directory it should be accessing.", | |
| "metadata": { | |
| "references": [ | |
| "https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html" | |
| ], | |
| "technology": [ | |
| "express" | |
| ], | |
| "category": "security", | |
| "cwe": [ | |
| "CWE-73: External Control of File Name or Path" | |
| ], | |
| "owasp": [ | |
| "A04:2021 - Insecure Design", | |
| "A06:2025 - Insecure Design" | |
| ], | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Path Traversal" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.audit.express-res-sendfile.express-res-sendfile", | |
| "shortlink": "https://sg.run/7DJk", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 22082, | |
| "rv_id": 1263142, | |
| "rule_id": "j2UzDx", | |
| "version_id": "7ZTE3X9", | |
| "url": "https://semgrep.dev/playground/r/7ZTE3X9/javascript.express.security.audit.express-res-sendfile.express-res-sendfile", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES) {...}" | |
| }, | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES, $NEXT) {...}" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {...})" | |
| }, | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|head|delete|options)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| }, | |
| { | |
| "pattern": "$REQ.cookies" | |
| }, | |
| { | |
| "pattern": "$REQ.headers" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" | |
| }, | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response) => {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "params" | |
| }, | |
| { | |
| "pattern": "query" | |
| }, | |
| { | |
| "pattern": "cookies" | |
| }, | |
| { | |
| "pattern": "headers" | |
| }, | |
| { | |
| "pattern": "body" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... (...,$REQ: $TYPE, ...) {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$TYPE", | |
| "regex": "^(string|String)" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$RES.$METH($QUERY,...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-not-inside": "$RES.$METH($QUERY,$OPTIONS)" | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METH", | |
| "regex": "^(sendfile|sendFile)$" | |
| } | |
| }, | |
| { | |
| "focus-metavariable": "$QUERY" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing", | |
| "message": "Directory listing/indexing is enabled, which may lead to disclosure of sensitive directories and files. It is recommended to disable directory listing unless it is a public resource. If you need directory listing, ensure that sensitive files are inaccessible when querying the resource.", | |
| "options": { | |
| "interfile": true | |
| }, | |
| "metadata": { | |
| "interfile": true, | |
| "cwe": [ | |
| "CWE-548: Exposure of Information Through Directory Listing" | |
| ], | |
| "owasp": [ | |
| "A06:2017 - Security Misconfiguration", | |
| "A01:2021 - Broken Access Control", | |
| "A01:2025 - Broken Access Control" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "express" | |
| ], | |
| "references": [ | |
| "https://www.npmjs.com/package/serve-index", | |
| "https://www.acunetix.com/blog/articles/directory-listing-information-disclosure/" | |
| ], | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Mishandled Sensitive Information" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing", | |
| "shortlink": "https://sg.run/DX2G", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 22552, | |
| "rv_id": 1263129, | |
| "rule_id": "x8UqEb", | |
| "version_id": "rxTAKGb", | |
| "url": "https://semgrep.dev/playground/r/rxTAKGb/javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$APP.use(require('serve-index')(...))\n" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$SERVEINDEX = require('serve-index')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $SERVEINDEX from 'serve-index'\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $SERVEINDEX from 'serve-index'\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$VALUE = $SERVEINDEX(...)\n...\n" | |
| }, | |
| { | |
| "pattern": "$VALUE(...)\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$APP.use(..., $SERVEINDEX(...), ...)\n" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.audit.express-open-redirect.express-open-redirect", | |
| "message": "The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could redirect users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected to a third-party website.", | |
| "metadata": { | |
| "technology": [ | |
| "express" | |
| ], | |
| "references": [ | |
| "https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html" | |
| ], | |
| "cwe": [ | |
| "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')" | |
| ], | |
| "category": "security", | |
| "owasp": [ | |
| "A01:2021 - Broken Access Control", | |
| "A01:2025 - Broken Access Control" | |
| ], | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "MEDIUM", | |
| "confidence": "HIGH", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Open Redirect" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.audit.express-open-redirect.express-open-redirect", | |
| "shortlink": "https://sg.run/EpoP", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 22081, | |
| "rv_id": 1263140, | |
| "rule_id": "X5ULkq", | |
| "version_id": "nWT2L0v", | |
| "url": "https://semgrep.dev/playground/r/nWT2L0v/javascript.express.security.audit.express-open-redirect.express-open-redirect", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "options": { | |
| "taint_unify_mvars": true, | |
| "symbolic_propagation": true | |
| }, | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES) {...}" | |
| }, | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES, $NEXT) {...}" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {...})" | |
| }, | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|head|delete|options)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| }, | |
| { | |
| "pattern": "$REQ.cookies" | |
| }, | |
| { | |
| "pattern": "$REQ.headers" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" | |
| }, | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response) => {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$REQ" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "params" | |
| }, | |
| { | |
| "pattern": "query" | |
| }, | |
| { | |
| "pattern": "cookies" | |
| }, | |
| { | |
| "pattern": "headers" | |
| }, | |
| { | |
| "pattern": "body" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$RES.redirect(\"$HTTP\"+$REQ. ... .$VALUE)" | |
| }, | |
| { | |
| "pattern": "$RES.redirect(\"$HTTP\"+$REQ. ... .$VALUE + $...A)" | |
| }, | |
| { | |
| "pattern": "$RES.redirect(`$HTTP${$REQ. ... .$VALUE}...`)" | |
| }, | |
| { | |
| "pattern": "$RES.redirect(\"$HTTP\"+$REQ.$VALUE[...])" | |
| }, | |
| { | |
| "pattern": "$RES.redirect(\"$HTTP\"+$REQ.$VALUE[...] + $...A)" | |
| }, | |
| { | |
| "pattern": "$RES.redirect(`$HTTP${$REQ.$VALUE[...]}...`)" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$HTTP", | |
| "regex": "^https?:\\/\\/$" | |
| } | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ. ... .$VALUE" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$RES.redirect($REQ. ... .$VALUE)" | |
| }, | |
| { | |
| "pattern": "$RES.redirect($REQ. ... .$VALUE + $...A)" | |
| }, | |
| { | |
| "pattern": "$RES.redirect(`${$REQ. ... .$VALUE}...`)" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$REQ. ... .$VALUE" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$RES.redirect($REQ.$VALUE['...'])" | |
| }, | |
| { | |
| "pattern": "$RES.redirect($REQ.$VALUE['...'] + $...A)" | |
| }, | |
| { | |
| "pattern": "$RES.redirect(`${$REQ.$VALUE['...']}...`)" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$REQ.$VALUE" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$ASSIGN = $REQ. ... .$VALUE\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$ASSIGN = $REQ.$VALUE['...']\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$ASSIGN = $REQ. ... .$VALUE + $...A\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$ASSIGN = $REQ.$VALUE['...'] + $...A\n... \n" | |
| }, | |
| { | |
| "pattern-inside": "$ASSIGN = `${$REQ. ... .$VALUE}...`\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$ASSIGN = `${$REQ.$VALUE['...']}...`\n... \n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$RES.redirect($ASSIGN)" | |
| }, | |
| { | |
| "pattern": "$RES.redirect($ASSIGN + $...FOO)" | |
| }, | |
| { | |
| "pattern": "$RES.redirect(`${$ASSIGN}...`)" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$ASSIGN" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret", | |
| "message": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).", | |
| "options": { | |
| "interfile": true | |
| }, | |
| "metadata": { | |
| "interfile": true, | |
| "cwe": [ | |
| "CWE-798: Use of Hard-coded Credentials" | |
| ], | |
| "references": [ | |
| "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html" | |
| ], | |
| "owasp": [ | |
| "A07:2021 - Identification and Authentication Failures", | |
| "A07:2025 - Authentication Failures" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "express", | |
| "secrets" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "HIGH", | |
| "confidence": "HIGH", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Hard-coded Secrets" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret", | |
| "shortlink": "https://sg.run/LYvG", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 22083, | |
| "rv_id": 1263143, | |
| "rule_id": "10Uo39", | |
| "version_id": "LjTkgle", | |
| "url": "https://semgrep.dev/playground/r/LjTkgle/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$SESSION = require('express-session');\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $SESSION from 'express-session'\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import {..., $SESSION, ...} from 'express-session'\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $SESSION from 'express-session'\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$APP.use($SESSION({...}))" | |
| }, | |
| { | |
| "pattern": "$SECRET = $VALUE\n...\n$APP.use($SESSION($SECRET))\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "secret: '$Y'\n" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires", | |
| "message": "Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies.", | |
| "severity": "WARNING", | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-522: Insufficiently Protected Credentials" | |
| ], | |
| "owasp": [ | |
| "A02:2017 - Broken Authentication", | |
| "A04:2021 - Insecure Design", | |
| "A06:2025 - Insecure Design" | |
| ], | |
| "source-rule-url": "https://expressjs.com/en/advanced/best-practice-security.html", | |
| "category": "security", | |
| "technology": [ | |
| "express" | |
| ], | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "LOW", | |
| "confidence": "MEDIUM", | |
| "references": [ | |
| "https://owasp.org/Top10/A04_2021-Insecure_Design" | |
| ], | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cryptographic Issues" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires", | |
| "shortlink": "https://sg.run/N4eG", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9271, | |
| "rv_id": 1263135, | |
| "rule_id": "EwU2DZ", | |
| "version_id": "O9TpxRq", | |
| "url": "https://semgrep.dev/playground/r/O9TpxRq/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$SESSION = require('cookie-session');\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$SESSION = require('express-session');\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$SESSION(...)" | |
| }, | |
| { | |
| "pattern-not-inside": "$SESSION(<... {cookie:{expires:...}} ...>,...)" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = <... {cookie:{expires:...}} ...>;\n...\n$SESSION($OPTS,...);\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = ...;\n...\n$COOKIE = <... {expires:...} ...>;\n...\n$SESSION($OPTS,...);\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = ...;\n...\n$OPTS.cookie = <... {expires:...} ...>;\n...\n$SESSION($OPTS,...);\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = ...;\n...\n$COOKIE.expires = ...;\n...\n$SESSION($OPTS,...);\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = ...;\n...\n$OPTS.cookie.expires = ...;\n...\n$SESSION($OPTS,...);" | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal", | |
| "message": "Possible writing outside of the destination, make sure that the target path is nested in the intended destination", | |
| "metadata": { | |
| "owasp": [ | |
| "A05:2017 - Broken Access Control", | |
| "A01:2021 - Broken Access Control", | |
| "A01:2025 - Broken Access Control" | |
| ], | |
| "cwe": [ | |
| "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" | |
| ], | |
| "category": "security", | |
| "references": [ | |
| "https://owasp.org/www-community/attacks/Path_Traversal" | |
| ], | |
| "technology": [ | |
| "express", | |
| "node.js" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Path Traversal" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal", | |
| "shortlink": "https://sg.run/weRn", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9273, | |
| "rv_id": 1263141, | |
| "rule_id": "L1Uyb8", | |
| "version_id": "ExTExX0", | |
| "url": "https://semgrep.dev/playground/r/ExTExX0/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES) {...}" | |
| }, | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES, $NEXT) {...}" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {...})" | |
| }, | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|head|delete|options)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| }, | |
| { | |
| "pattern": "$REQ.cookies" | |
| }, | |
| { | |
| "pattern": "$REQ.headers" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" | |
| }, | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response) => {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$REQ" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "params" | |
| }, | |
| { | |
| "pattern": "query" | |
| }, | |
| { | |
| "pattern": "cookies" | |
| }, | |
| { | |
| "pattern": "headers" | |
| }, | |
| { | |
| "pattern": "body" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "focus-metavariable": "$SINK" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$PATH = require('path');\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $PATH from 'path';\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$PATH.join(...,$SINK,...)" | |
| }, | |
| { | |
| "pattern": "$PATH.resolve(...,$SINK,...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "focus-metavariable": "$SINK" | |
| }, | |
| { | |
| "pattern-inside": "import 'path';\n...\n" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "path.join(...,$SINK,...)" | |
| }, | |
| { | |
| "pattern": "path.resolve(...,$SINK,...)" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sanitizers": [ | |
| { | |
| "pattern": "$Y.replace(...)" | |
| }, | |
| { | |
| "pattern": "$Y.indexOf(...)" | |
| }, | |
| { | |
| "pattern": "function ... (...) {\n ...\n <... $Y.indexOf(...) ...>\n ...\n}\n" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern": "$FUNC(...)" | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$FUNC", | |
| "regex": "sanitize" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.audit.res-render-injection.res-render-injection", | |
| "message": "User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating pages that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index` to access other HTML pages on the file system. Where possible, do not allow users to define what should be loaded in $RES.render or use an allow list for the existing application.", | |
| "options": { | |
| "interfile": true | |
| }, | |
| "metadata": { | |
| "interfile": true, | |
| "owasp": [ | |
| "A01:2021 - Broken Access Control", | |
| "A01:2025 - Broken Access Control" | |
| ], | |
| "cwe": [ | |
| "CWE-706: Use of Incorrectly-Resolved Name or Reference" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "express" | |
| ], | |
| "references": [ | |
| "http://expressjs.com/en/4x/api.html#res.render" | |
| ], | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Improper Authorization" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.audit.res-render-injection.res-render-injection", | |
| "shortlink": "https://sg.run/eLjd", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9276, | |
| "rv_id": 1263149, | |
| "rule_id": "QrUzrq", | |
| "version_id": "PkTR3OY", | |
| "url": "https://semgrep.dev/playground/r/PkTR3OY/javascript.express.security.audit.res-render-injection.res-render-injection", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES) {...}" | |
| }, | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES, $NEXT) {...}" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {...})" | |
| }, | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|head|delete|options)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| }, | |
| { | |
| "pattern": "$REQ.cookies" | |
| }, | |
| { | |
| "pattern": "$REQ.headers" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" | |
| }, | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response) => {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$REQ" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "params" | |
| }, | |
| { | |
| "pattern": "query" | |
| }, | |
| { | |
| "pattern": "cookies" | |
| }, | |
| { | |
| "pattern": "headers" | |
| }, | |
| { | |
| "pattern": "body" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$RES.render($SINK, ...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$SINK" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.audit.express-libxml-noent.express-libxml-noent", | |
| "message": "The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure you are protected.", | |
| "options": { | |
| "interfile": true | |
| }, | |
| "metadata": { | |
| "interfile": true, | |
| "references": [ | |
| "https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html" | |
| ], | |
| "technology": [ | |
| "express" | |
| ], | |
| "category": "security", | |
| "cwe": [ | |
| "CWE-611: Improper Restriction of XML External Entity Reference" | |
| ], | |
| "owasp": [ | |
| "A04:2017 - XML External Entities (XXE)", | |
| "A05:2021 - Security Misconfiguration", | |
| "A02:2025 - Security Misconfiguration" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "HIGH", | |
| "confidence": "HIGH", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "XML Injection" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent", | |
| "shortlink": "https://sg.run/Z75x", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 22079, | |
| "rv_id": 1263138, | |
| "rule_id": "pKUNeD", | |
| "version_id": "d6TyxpX", | |
| "url": "https://semgrep.dev/playground/r/d6TyxpX/javascript.express.security.audit.express-libxml-noent.express-libxml-noent", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "ERROR", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES) {...}" | |
| }, | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES, $NEXT) {...}" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {...})" | |
| }, | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|head|delete|options)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| }, | |
| { | |
| "pattern": "$REQ.cookies" | |
| }, | |
| { | |
| "pattern": "$REQ.headers" | |
| }, | |
| { | |
| "pattern": "$REQ.files.$ANYTHING.data.toString('utf8')" | |
| }, | |
| { | |
| "pattern": "$REQ.files.$ANYTHING['data'].toString('utf8')" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" | |
| }, | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response) => {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$REQ" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "params" | |
| }, | |
| { | |
| "pattern": "query" | |
| }, | |
| { | |
| "pattern": "cookies" | |
| }, | |
| { | |
| "pattern": "headers" | |
| }, | |
| { | |
| "pattern": "body" | |
| }, | |
| { | |
| "pattern": "files.$ANYTHING.data.toString('utf8')" | |
| }, | |
| { | |
| "pattern": "files.$ANYTHING['data'].toString('utf8')" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$XML = require('$IMPORT')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $XML from '$IMPORT'\n ...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $XML from '$IMPORT'\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$IMPORT", | |
| "regex": "^(libxmljs|libxmljs2)$" | |
| } | |
| }, | |
| { | |
| "pattern-inside": "$XML.$FUNC($QUERY, {...,noent:true,...})" | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$FUNC", | |
| "regex": "^(parseXmlString|parseXml)$" | |
| } | |
| }, | |
| { | |
| "focus-metavariable": "$QUERY" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event", | |
| "message": "Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities", | |
| "metadata": { | |
| "owasp": [ | |
| "A04:2017 - XML External Entities (XXE)", | |
| "A05:2021 - Security Misconfiguration", | |
| "A02:2025 - Security Misconfiguration" | |
| ], | |
| "cwe": [ | |
| "CWE-611: Improper Restriction of XML External Entity Reference" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "express" | |
| ], | |
| "references": [ | |
| "https://www.npmjs.com/package/xml2json" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "HIGH", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "XML Injection" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event", | |
| "shortlink": "https://sg.run/x1AA", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9274, | |
| "rv_id": 1263146, | |
| "rule_id": "8GUjkk", | |
| "version_id": "QkTGqgo", | |
| "url": "https://semgrep.dev/playground/r/QkTGqgo/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES) {...}" | |
| }, | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES, $NEXT) {...}" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {...})" | |
| }, | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|head|delete|options)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| }, | |
| { | |
| "pattern": "$REQ.cookies" | |
| }, | |
| { | |
| "pattern": "$REQ.headers" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...}\n" | |
| }, | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response) => {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$REQ" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "params" | |
| }, | |
| { | |
| "pattern": "query" | |
| }, | |
| { | |
| "pattern": "cookies" | |
| }, | |
| { | |
| "pattern": "headers" | |
| }, | |
| { | |
| "pattern": "body" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "require('xml2json');\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import 'xml2json';\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$REQ.on('...', function(...) { ... $EXPAT.toJson($INPUT,...); ... })" | |
| }, | |
| { | |
| "focus-metavariable": "$INPUT" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked", | |
| "message": "No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider using function as the `isRevoked` option.", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-522: Insufficiently Protected Credentials" | |
| ], | |
| "owasp": [ | |
| "A02:2017 - Broken Authentication", | |
| "A04:2021 - Insecure Design", | |
| "A06:2025 - Insecure Design" | |
| ], | |
| "source-rule-url": "https://github.com/goldbergyoni/nodebestpractices/blob/master/sections/security/expirejwt.md", | |
| "asvs": { | |
| "section": "V3: Session Management Verification Requirements", | |
| "control_id": "3.5.3 Insecure Stateless Session Tokens", | |
| "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management", | |
| "version": "4" | |
| }, | |
| "category": "security", | |
| "technology": [ | |
| "express" | |
| ], | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "references": [ | |
| "https://owasp.org/Top10/A04_2021-Insecure_Design" | |
| ], | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cryptographic Issues" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked", | |
| "shortlink": "https://sg.run/kXNo", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9272, | |
| "rv_id": 1263137, | |
| "rule_id": "7KUQ9k", | |
| "version_id": "vdT06Bg", | |
| "url": "https://semgrep.dev/playground/r/vdT06Bg/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$JWT = require('express-jwt');\n...\n" | |
| }, | |
| { | |
| "pattern": "$JWT(...)" | |
| }, | |
| { | |
| "pattern-not-inside": "$JWT(<... {isRevoked:...} ...>,...)" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = <... {isRevoked:...} ...>;\n...\n$JWT($OPTS,...);" | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.audit.xss.direct-response-write.direct-response-write", | |
| "message": "Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML.", | |
| "options": { | |
| "interfile": true | |
| }, | |
| "metadata": { | |
| "interfile": true, | |
| "references": [ | |
| "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html" | |
| ], | |
| "owasp": [ | |
| "A07:2017 - Cross-Site Scripting (XSS)", | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "cwe": [ | |
| "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "express" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "vulnerability_class": [ | |
| "Cross-Site-Scripting (XSS)" | |
| ], | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "source": "https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write", | |
| "shortlink": "https://sg.run/vzGl", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9277, | |
| "rv_id": 1263150, | |
| "rule_id": "3qUPA1", | |
| "version_id": "JdTzxeg", | |
| "url": "https://semgrep.dev/playground/r/JdTzxeg/javascript.express.security.audit.xss.direct-response-write.direct-response-write", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES) {...}" | |
| }, | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES, $NEXT) {...}" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {...})" | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|head|delete|options)" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-not-inside": "function ... ($REQ, $RES) {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n}\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n})\n" | |
| }, | |
| { | |
| "pattern-not-inside": "function ... ($REQ, $RES, $NEXT) {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n}\n" | |
| }, | |
| { | |
| "pattern-not-inside": "function ... ($REQ, $RES) {\n ...\n $RES.set('$TYPE')\n}\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {\n ...\n $RES.set('$TYPE')\n})\n" | |
| }, | |
| { | |
| "pattern-not-inside": "function ... ($REQ, $RES, $NEXT) {\n ...\n $RES.set('$TYPE')\n}\n" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" | |
| }, | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response) => {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-not-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{\n ...\n $RES.$SET('Content-Type', '$TYPE')\n}\n" | |
| }, | |
| { | |
| "pattern-not-inside": "({ $REQ }: Request,$RES: Response) => {\n ...\n $RES.$SET('Content-Type', '$TYPE')\n}\n" | |
| }, | |
| { | |
| "pattern-not-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{\n ...\n $RES.set('$TYPE')\n}\n" | |
| }, | |
| { | |
| "focus-metavariable": "$REQ" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "params" | |
| }, | |
| { | |
| "pattern": "query" | |
| }, | |
| { | |
| "pattern": "body" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "function ... (..., $RES,...) {...}" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$RES.write($ARG)" | |
| }, | |
| { | |
| "pattern": "$RES.send($ARG)" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-not": "$RES. ... .set('...'). ... .send($ARG)" | |
| }, | |
| { | |
| "pattern-not": "$RES. ... .type('...'). ... .send($ARG)" | |
| }, | |
| { | |
| "pattern-not-inside": "$RES.$METHOD({ ... })" | |
| }, | |
| { | |
| "focus-metavariable": "$ARG" | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sanitizers": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from \"underscore.string\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"underscore.string\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $S from \"underscore.string\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"underscore.string\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$S.escapeHTML(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from \"dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import { ..., $S,... } from \"dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"dompurify\")\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $S from \"isomorphic-dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"isomorphic-dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"isomorphic-dompurify\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$VALUE = $S(...)\n...\n" | |
| }, | |
| { | |
| "pattern": "$VALUE.sanitize(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$VALUE = $S.sanitize\n...\n" | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S.sanitize(...)" | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from 'xss';\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from 'xss';\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"xss\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from 'sanitize-html';\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"sanitize-html\";\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"sanitize-html\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$S = new Remarkable()\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S.render(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from 'express-xss-sanitizer';\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"express-xss-sanitizer\";\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "const { ..., $S, ... } = require('express-xss-sanitizer');\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "var { ..., $S, ... } = require('express-xss-sanitizer');\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "let { ...,$S,... } = require('express-xss-sanitizer');\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"express-xss-sanitizer\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern": "$RES. ... .type('$F'). ... .send(...)" | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$F", | |
| "regex": "(?!.*text/html)" | |
| } | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$X = [...];\n...\n" | |
| }, | |
| { | |
| "pattern": "if(<... !$X.includes($SOURCE)...>) {\n ...\n return ...\n}\n...\n" | |
| }, | |
| { | |
| "pattern": "$SOURCE" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.injection.raw-html-format.raw-html-format", | |
| "message": "User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within.", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" | |
| ], | |
| "owasp": [ | |
| "A07:2017 - Cross-Site Scripting (XSS)", | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "references": [ | |
| "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "express" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cross-Site-Scripting (XSS)" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format", | |
| "shortlink": "https://sg.run/5DO3", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 14691, | |
| "rv_id": 1263175, | |
| "rule_id": "5rUL0X", | |
| "version_id": "NdTzyQv", | |
| "url": "https://semgrep.dev/playground/r/NdTzyQv/javascript.express.security.injection.raw-html-format.raw-html-format", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "label": "EXPRESS", | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES) {...}" | |
| }, | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES, $NEXT) {...}" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {...})" | |
| }, | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|head|delete|options)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| }, | |
| { | |
| "pattern": "$REQ.cookies" | |
| }, | |
| { | |
| "pattern": "$REQ.headers" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "label": "EXPRESSTS", | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" | |
| }, | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response) => {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$REQ" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "params" | |
| }, | |
| { | |
| "pattern": "query" | |
| }, | |
| { | |
| "pattern": "cookies" | |
| }, | |
| { | |
| "pattern": "headers" | |
| }, | |
| { | |
| "pattern": "body" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "label": "CLEAN", | |
| "by-side-effect": true, | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$A($SOURCE)" | |
| }, | |
| { | |
| "pattern": "$SANITIZE. ... .$A($SOURCE)" | |
| }, | |
| { | |
| "pattern": "$A. ... .$SANITIZE($SOURCE)" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$SOURCE" | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$A", | |
| "regex": "(?i)(.*valid|.*sanitiz)" | |
| } | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "requires": "(EXPRESS and not CLEAN) or (EXPRESSTS and not CLEAN)", | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "\"$HTMLSTR\" + $EXPR" | |
| }, | |
| { | |
| "pattern": "\"$HTMLSTR\".concat(...)" | |
| }, | |
| { | |
| "pattern": "util.format($HTMLSTR, ...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-pattern": { | |
| "metavariable": "$HTMLSTR", | |
| "language": "generic", | |
| "pattern": "<$TAG ..." | |
| } | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern": "`...`\n" | |
| }, | |
| { | |
| "pattern-regex": ".*<\\w+.*\n" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection", | |
| "message": "If unverified user data can reach the `compileScript` method it can result in Server-Side Request Forgery vulnerabilities", | |
| "metadata": { | |
| "owasp": [ | |
| "A10:2021 - Server-Side Request Forgery (SSRF)", | |
| "A01:2025 - Broken Access Control" | |
| ], | |
| "cwe": [ | |
| "CWE-918: Server-Side Request Forgery (SSRF)" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "chrome-remote-interface" | |
| ], | |
| "references": [ | |
| "https://github.com/cyrus-and/chrome-remote-interface" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Server-Side Request Forgery (SSRF)" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection", | |
| "shortlink": "https://sg.run/J9kj", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9246, | |
| "rv_id": 1263126, | |
| "rule_id": "qNUjnb", | |
| "version_id": "1QTypkQ", | |
| "url": "https://semgrep.dev/playground/r/1QTypkQ/javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "function ... (..., $ARG,...) {...}" | |
| }, | |
| { | |
| "focus-metavariable": "$ARG" | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "require('chrome-remote-interface');\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import 'chrome-remote-interface';\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$RUNTIME.compileScript({expression: $SINK},...)\n" | |
| }, | |
| { | |
| "pattern": "$RUNTIME.evaluate({expression: $SINK},...)\n" | |
| }, | |
| { | |
| "pattern": "$PAGE.navigate({url: $SINK},...)\n" | |
| }, | |
| { | |
| "pattern": "$RUNTIME.printToPDF({headerTemplate: $SINK},...)\n" | |
| }, | |
| { | |
| "pattern": "$RUNTIME.printToPDF({footerTemplate: $SINK},...)\n" | |
| }, | |
| { | |
| "pattern": "$PAGE.setDocumentContent({html: $SINK},...)\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$SINK" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg", | |
| "message": "Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-327: Use of a Broken or Risky Cryptographic Algorithm" | |
| ], | |
| "owasp": [ | |
| "A03:2017 - Sensitive Data Exposure", | |
| "A02:2021 - Cryptographic Failures", | |
| "A04:2025 - Cryptographic Failures" | |
| ], | |
| "source-rule-url": "https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/", | |
| "asvs": { | |
| "section": "V3: Session Management Verification Requirements", | |
| "control_id": "3.5.3 Insecue Stateless Session Tokens", | |
| "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management", | |
| "version": "4" | |
| }, | |
| "category": "security", | |
| "technology": [ | |
| "jwt" | |
| ], | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "HIGH", | |
| "confidence": "MEDIUM", | |
| "references": [ | |
| "https://owasp.org/Top10/A02_2021-Cryptographic_Failures" | |
| ], | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cryptographic Issues" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg", | |
| "shortlink": "https://sg.run/PJXv", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9301, | |
| "rv_id": 1263190, | |
| "rule_id": "0oU53g", | |
| "version_id": "QkTGqQo", | |
| "url": "https://semgrep.dev/playground/r/QkTGqQo/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "ERROR", | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$JWT = require(\"jsonwebtoken\");\n...\n" | |
| }, | |
| { | |
| "pattern": "$JWT.verify($P, $X, {algorithms:[...,'none',...]},...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret", | |
| "message": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-798: Use of Hard-coded Credentials" | |
| ], | |
| "references": [ | |
| "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html" | |
| ], | |
| "owasp": [ | |
| "A07:2021 - Identification and Authentication Failures", | |
| "A07:2025 - Authentication Failures" | |
| ], | |
| "asvs": { | |
| "section": "V3: Session Management Verification Requirements", | |
| "control_id": "3.5.2 Static API keys or secret", | |
| "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management", | |
| "version": "4" | |
| }, | |
| "category": "security", | |
| "technology": [ | |
| "jwt", | |
| "javascript", | |
| "secrets" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "MEDIUM", | |
| "confidence": "HIGH", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Hard-coded Secrets" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret", | |
| "shortlink": "https://sg.run/4xN9", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9300, | |
| "rv_id": 1263189, | |
| "rule_id": "WAUon7", | |
| "version_id": "gETB75D", | |
| "url": "https://semgrep.dev/playground/r/gETB75D/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern": "$X = '...' \n" | |
| }, | |
| { | |
| "pattern": "$X = '$Y' \n" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$JWT.sign($DATA,\"...\",...);\n" | |
| }, | |
| { | |
| "pattern-inside": "$JWT.verify($DATA,\"...\",...);\n" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$JWT = require(\"jsonwebtoken\")\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $JWT from \"jsonwebtoken\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $JWT from \"jsonwebtoken\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import {...,$JWT,...} from \"jsonwebtoken\"\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$JWT.sign($DATA,$VALUE,...);\n" | |
| }, | |
| { | |
| "pattern-inside": "$JWT.verify($DATA,$VALUE,...);\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$VALUE" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint", | |
| "message": "Use of angular.element can lead to XSS if user-input is treated as part of the HTML element within `$SINK`. It is recommended to contextually output encode user-input, before inserting into `$SINK`. If the HTML needs to be preserved it is recommended to sanitize the input using $sce.getTrustedHTML or $sanitize.", | |
| "metadata": { | |
| "confidence": "MEDIUM", | |
| "cwe": [ | |
| "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" | |
| ], | |
| "references": [ | |
| "https://docs.angularjs.org/api/ng/function/angular.element", | |
| "https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "angularjs" | |
| ], | |
| "owasp": [ | |
| "A07:2017 - Cross-Site Scripting (XSS)", | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cross-Site-Scripting (XSS)" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint", | |
| "shortlink": "https://sg.run/5AQ0", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 21503, | |
| "rv_id": 1263091, | |
| "rule_id": "GdUP71", | |
| "version_id": "44TEj8L", | |
| "url": "https://semgrep.dev/playground/r/44TEj8L/javascript.angular.security.detect-angular-element-taint.detect-angular-element-taint", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "window.location.search" | |
| }, | |
| { | |
| "pattern": "window.document.location.search" | |
| }, | |
| { | |
| "pattern": "document.location.search" | |
| }, | |
| { | |
| "pattern": "location.search" | |
| }, | |
| { | |
| "pattern": "$location.search(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$DECODE(<... location.hash ...>)" | |
| }, | |
| { | |
| "pattern": "$DECODE(<... window.location.hash ...>)" | |
| }, | |
| { | |
| "pattern": "$DECODE(<... document.location.hash ...>)" | |
| }, | |
| { | |
| "pattern": "$DECODE(<... location.href ...>)" | |
| }, | |
| { | |
| "pattern": "$DECODE(<... window.location.href ...>)" | |
| }, | |
| { | |
| "pattern": "$DECODE(<... document.location.href ...>)" | |
| }, | |
| { | |
| "pattern": "$DECODE(<... document.URL ...>)" | |
| }, | |
| { | |
| "pattern": "$DECODE(<... window.document.URL ...>)" | |
| }, | |
| { | |
| "pattern": "$DECODE(<... document.location.href ...>)" | |
| }, | |
| { | |
| "pattern": "$DECODE(<... document.location.href ...>)" | |
| }, | |
| { | |
| "pattern": "$DECODE(<... $location.absUrl() ...>)" | |
| }, | |
| { | |
| "pattern": "$DECODE(<... $location.url() ...>)" | |
| }, | |
| { | |
| "pattern": "$DECODE(<... $location.hash() ...>)" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$DECODE", | |
| "regex": "^(unescape|decodeURI|decodeURIComponent)$" | |
| } | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$http.$METHOD(...).$CONTINUE(function $FUNC($RES) {...})" | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|delete|head|jsonp|post|put|patch)" | |
| } | |
| }, | |
| { | |
| "pattern": "$RES.data" | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "angular.element(...). ... .$SINK($QUERY)\n" | |
| }, | |
| { | |
| "pattern-inside": "$ANGULAR = angular.element(...)\n...\n$ANGULAR. ... .$SINK($QUERY)\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$SINK", | |
| "regex": "^(after|append|html|prepend|replaceWith|wrap)$" | |
| } | |
| }, | |
| { | |
| "focus-metavariable": "$QUERY" | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sanitizers": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$sce.getTrustedHtml(...)" | |
| }, | |
| { | |
| "pattern": "$sanitize(...)" | |
| }, | |
| { | |
| "pattern": "DOMPurify.sanitize(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method", | |
| "message": "The use of $sce.trustAs can be dangerous if unsanitized user input flows through this API.", | |
| "metadata": { | |
| "references": [ | |
| "https://docs.angularjs.org/api/ng/service/$sce", | |
| "https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf" | |
| ], | |
| "category": "security", | |
| "cwe": [ | |
| "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" | |
| ], | |
| "technology": [ | |
| "angular" | |
| ], | |
| "owasp": [ | |
| "A07:2017 - Cross-Site Scripting (XSS)", | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "LOW", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cross-Site-Scripting (XSS)" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method", | |
| "shortlink": "https://sg.run/OPW2", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9231, | |
| "rv_id": 1263098, | |
| "rule_id": "gxU1QX", | |
| "version_id": "BjTkZv0", | |
| "url": "https://semgrep.dev/playground/r/BjTkZv0/javascript.angular.security.detect-angular-trust-as-method.detect-angular-trust-as-method", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "app.controller(..., function($scope,$sce) {\n...\n});\n" | |
| }, | |
| { | |
| "pattern": "$scope.$X" | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "pattern": "$sce.trustAs(...)" | |
| }, | |
| { | |
| "pattern": "$sce.trustAsHtml(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled", | |
| "message": "$sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could provide additional attack surface for XSS vulnerabilities.", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" | |
| ], | |
| "references": [ | |
| "https://docs.angularjs.org/api/ng/service/$sce", | |
| "https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "angular" | |
| ], | |
| "owasp": [ | |
| "A07:2017 - Cross-Site Scripting (XSS)", | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "MEDIUM", | |
| "confidence": "HIGH", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cross-Site-Scripting (XSS)" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled", | |
| "shortlink": "https://sg.run/N4DG", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9227, | |
| "rv_id": 1263094, | |
| "rule_id": "EwU20Z", | |
| "version_id": "5PTo1EW", | |
| "url": "https://semgrep.dev/playground/r/5PTo1EW/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "ERROR", | |
| "pattern": "$sceProvider.enabled(false);\n" | |
| }, | |
| { | |
| "id": "javascript.aws-lambda.security.mysql-sqli.mysql-sqli", | |
| "message": "Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`", | |
| "metadata": { | |
| "references": [ | |
| "https://www.npmjs.com/package/mysql2" | |
| ], | |
| "category": "security", | |
| "owasp": [ | |
| "A01:2017 - Injection", | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "cwe": [ | |
| "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" | |
| ], | |
| "technology": [ | |
| "aws-lambda", | |
| "mysql", | |
| "mysql2" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "HIGH", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "SQL Injection" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.aws-lambda.security.mysql-sqli.mysql-sqli", | |
| "shortlink": "https://sg.run/A502", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 18250, | |
| "rv_id": 1263107, | |
| "rule_id": "NbUBJ2", | |
| "version_id": "5PTo1En", | |
| "url": "https://semgrep.dev/playground/r/5PTo1En/javascript.aws-lambda.security.mysql-sqli.mysql-sqli", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "exports.handler = function ($EVENT, ...) {\n ...\n}\n" | |
| }, | |
| { | |
| "pattern-inside": "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" | |
| }, | |
| { | |
| "pattern-inside": "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$EVENT" | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "focus-metavariable": "$QUERY" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$POOL.query($QUERY, ...)" | |
| }, | |
| { | |
| "pattern": "$POOL.execute($QUERY, ...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "require('mysql')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "require('mysql2')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "require('mysql2/promise')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import 'mysql'\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import 'mysql2'\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import 'mysql2/promise'\n...\n" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli", | |
| "message": "Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `sequelize.query('SELECT * FROM projects WHERE status = ?', { replacements: ['active'], type: QueryTypes.SELECT });`", | |
| "metadata": { | |
| "references": [ | |
| "https://sequelize.org/master/manual/raw-queries.html" | |
| ], | |
| "category": "security", | |
| "owasp": [ | |
| "A01:2017 - Injection", | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "cwe": [ | |
| "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" | |
| ], | |
| "technology": [ | |
| "aws-lambda", | |
| "sequelize" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "HIGH", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "SQL Injection" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli", | |
| "shortlink": "https://sg.run/DAlP", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 18252, | |
| "rv_id": 1263109, | |
| "rule_id": "wdUA5o", | |
| "version_id": "RGT0LrD", | |
| "url": "https://semgrep.dev/playground/r/RGT0LrD/javascript.aws-lambda.security.sequelize-sqli.sequelize-sqli", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "exports.handler = function ($EVENT, ...) {\n ...\n}\n" | |
| }, | |
| { | |
| "pattern-inside": "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" | |
| }, | |
| { | |
| "pattern-inside": "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$EVENT" | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "focus-metavariable": "$QUERY" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$DB.query($QUERY, ...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "require('sequelize')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import 'sequelize'\n...\n" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.aws-lambda.security.pg-sqli.pg-sqli", | |
| "message": "Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `connection.query('SELECT $1 from table', [userinput])`", | |
| "metadata": { | |
| "references": [ | |
| "https://node-postgres.com/features/queries" | |
| ], | |
| "category": "security", | |
| "owasp": [ | |
| "A01:2017 - Injection", | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "cwe": [ | |
| "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" | |
| ], | |
| "technology": [ | |
| "aws-lambda", | |
| "postgres", | |
| "pg" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "HIGH", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "SQL Injection" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.aws-lambda.security.pg-sqli.pg-sqli", | |
| "shortlink": "https://sg.run/BGKA", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 18251, | |
| "rv_id": 1263108, | |
| "rule_id": "kxU25P", | |
| "version_id": "GxTkeJL", | |
| "url": "https://semgrep.dev/playground/r/GxTkeJL/javascript.aws-lambda.security.pg-sqli.pg-sqli", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "exports.handler = function ($EVENT, ...) {\n ...\n}\n" | |
| }, | |
| { | |
| "pattern-inside": "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" | |
| }, | |
| { | |
| "pattern-inside": "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$EVENT" | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "focus-metavariable": "$QUERY" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$DB.query($QUERY, ...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "require('pg')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import 'pg'\n...\n" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.aws-lambda.security.tainted-html-response.tainted-html-response", | |
| "message": "Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data.", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" | |
| ], | |
| "owasp": [ | |
| "A07:2017 - Cross-Site Scripting (XSS)", | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "aws-lambda" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "references": [ | |
| "https://owasp.org/Top10/A03_2021-Injection" | |
| ], | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cross-Site-Scripting (XSS)" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-response.tainted-html-response", | |
| "shortlink": "https://sg.run/0Gvj", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 18254, | |
| "rv_id": 1263111, | |
| "rule_id": "OrUJBY", | |
| "version_id": "BjTkZ8D", | |
| "url": "https://semgrep.dev/playground/r/BjTkZ8D/javascript.aws-lambda.security.tainted-html-response.tainted-html-response", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "exports.handler = function ($EVENT, ...) {\n ...\n}\n" | |
| }, | |
| { | |
| "pattern-inside": "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" | |
| }, | |
| { | |
| "pattern-inside": "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$EVENT" | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "focus-metavariable": "$BODY" | |
| }, | |
| { | |
| "pattern-inside": "{..., headers: {..., 'Content-Type': 'text/html', ...}, body: $BODY, ... }\n" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.aws-lambda.security.knex-sqli.knex-sqli", | |
| "message": "Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `knex.raw('SELECT $1 from table', [userinput])`", | |
| "metadata": { | |
| "references": [ | |
| "https://knexjs.org/#Builder-fromRaw", | |
| "https://knexjs.org/#Builder-whereRaw" | |
| ], | |
| "category": "security", | |
| "owasp": [ | |
| "A01:2017 - Injection", | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "cwe": [ | |
| "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" | |
| ], | |
| "technology": [ | |
| "aws-lambda", | |
| "knex" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "HIGH", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "SQL Injection" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.aws-lambda.security.knex-sqli.knex-sqli", | |
| "shortlink": "https://sg.run/RgWq", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 18249, | |
| "rv_id": 1263106, | |
| "rule_id": "bwUBlj", | |
| "version_id": "JdTzxKg", | |
| "url": "https://semgrep.dev/playground/r/JdTzxKg/javascript.aws-lambda.security.knex-sqli.knex-sqli", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "exports.handler = function ($EVENT, ...) {\n ...\n}\n" | |
| }, | |
| { | |
| "pattern-inside": "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" | |
| }, | |
| { | |
| "pattern-inside": "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$EVENT" | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "focus-metavariable": "$QUERY" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$KNEX.fromRaw($QUERY, ...)" | |
| }, | |
| { | |
| "pattern": "$KNEX.whereRaw($QUERY, ...)" | |
| }, | |
| { | |
| "pattern": "$KNEX.raw($QUERY, ...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "require('knex')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import 'knex'\n...\n" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object", | |
| "message": "Detected DynamoDB query params that are tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client.", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-943: Improper Neutralization of Special Elements in Data Query Logic" | |
| ], | |
| "owasp": [ | |
| "A01:2017 - Injection" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "javascript", | |
| "aws-lambda", | |
| "dynamodb" | |
| ], | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "HIGH", | |
| "confidence": "MEDIUM", | |
| "references": [ | |
| "https://owasp.org/Top10/A03_2021-Injection" | |
| ], | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Improper Validation" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object", | |
| "shortlink": "https://sg.run/X1e4", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 21320, | |
| "rv_id": 945766, | |
| "rule_id": "0oU1xk", | |
| "version_id": "GxTP7gN", | |
| "url": "https://semgrep.dev/playground/r/GxTP7gN/javascript.aws-lambda.security.dynamodb-request-object.dynamodb-request-object", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "ERROR", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern": "$EVENT" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "exports.handler = function ($EVENT, ...) {\n ...\n}\n" | |
| }, | |
| { | |
| "pattern-inside": "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" | |
| }, | |
| { | |
| "pattern-inside": "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "focus-metavariable": "$SINK" | |
| }, | |
| { | |
| "pattern": "$DC.$METHOD($SINK, ...)\n" | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "(query|send|scan|delete|put|transactWrite|update|batchExecuteStatement|executeStatement|executeTransaction|transactWriteItems)" | |
| } | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$DC = new $AWS.DocumentClient(...);\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$DC = new $AWS.DynamoDB(...);\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$DC = new DynamoDBClient(...);\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$DC = DynamoDBDocumentClient.from(...);\n...\n" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sanitizers": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern": "{...}\n" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.aws-lambda.security.detect-child-process.detect-child-process", | |
| "message": "Allowing spawning arbitrary programs or running shell processes with arbitrary arguments may end up in a command injection vulnerability. Try to avoid non-literal values for the command string. If it is not possible, then do not let running arbitrary commands, use a white list for inputs.", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" | |
| ], | |
| "owasp": [ | |
| "A01:2017 - Injection", | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "javascript", | |
| "aws-lambda" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "HIGH", | |
| "confidence": "MEDIUM", | |
| "references": [ | |
| "https://owasp.org/Top10/A03_2021-Injection" | |
| ], | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Command Injection" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.aws-lambda.security.detect-child-process.detect-child-process", | |
| "shortlink": "https://sg.run/Ggoq", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 18248, | |
| "rv_id": 1263105, | |
| "rule_id": "r6UDNQ", | |
| "version_id": "YDTZe4o", | |
| "url": "https://semgrep.dev/playground/r/YDTZe4o/javascript.aws-lambda.security.detect-child-process.detect-child-process", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "ERROR", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern": "$EVENT" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "exports.handler = function ($EVENT, ...) {\n ...\n}\n" | |
| }, | |
| { | |
| "pattern-inside": "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" | |
| }, | |
| { | |
| "pattern-inside": "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "focus-metavariable": "$CMD" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "exec($CMD,...)" | |
| }, | |
| { | |
| "pattern": "execSync($CMD,...)" | |
| }, | |
| { | |
| "pattern": "spawn($CMD,...)" | |
| }, | |
| { | |
| "pattern": "spawnSync($CMD,...)" | |
| }, | |
| { | |
| "pattern": "$CP.exec($CMD,...)" | |
| }, | |
| { | |
| "pattern": "$CP.execSync($CMD,...)" | |
| }, | |
| { | |
| "pattern": "$CP.spawn($CMD,...)" | |
| }, | |
| { | |
| "pattern": "$CP.spawnSync($CMD,...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "require('child_process')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import 'child_process'\n...\n" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection", | |
| "message": "The `vm` module enables compiling and running code within V8 Virtual Machine contexts. The `vm` module is not a security mechanism. Do not use it to run untrusted code. If code passed to `vm` functions is controlled by user input it could result in command injection. Do not let user input in `vm` functions.", | |
| "metadata": { | |
| "owasp": [ | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "cwe": [ | |
| "CWE-94: Improper Control of Generation of Code ('Code Injection')" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "javascript", | |
| "aws-lambda" | |
| ], | |
| "cwe2022-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "references": [ | |
| "https://owasp.org/Top10/A03_2021-Injection" | |
| ], | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Code Injection" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection", | |
| "shortlink": "https://sg.run/q9w7", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 18256, | |
| "rv_id": 1263114, | |
| "rule_id": "v8UOdZ", | |
| "version_id": "0bTKz9J", | |
| "url": "https://semgrep.dev/playground/r/0bTKz9J/javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "ERROR", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern": "$EVENT" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "exports.handler = function ($EVENT, ...) {\n ...\n}\n" | |
| }, | |
| { | |
| "pattern-inside": "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" | |
| }, | |
| { | |
| "pattern-inside": "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "require('vm');\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import 'vm'\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$VM.runInContext($X,...)" | |
| }, | |
| { | |
| "pattern": "$VM.runInNewContext($X,...)" | |
| }, | |
| { | |
| "pattern": "$VM.runInThisContext($X,...)" | |
| }, | |
| { | |
| "pattern": "$VM.compileFunction($X,...)" | |
| }, | |
| { | |
| "pattern": "new $VM.Script($X,...)" | |
| }, | |
| { | |
| "pattern": "new $VM.SourceTextModule($X,...)" | |
| }, | |
| { | |
| "pattern": "runInContext($X,...)" | |
| }, | |
| { | |
| "pattern": "runInNewContext($X,...)" | |
| }, | |
| { | |
| "pattern": "runInThisContext($X,...)" | |
| }, | |
| { | |
| "pattern": "compileFunction($X,...)" | |
| }, | |
| { | |
| "pattern": "new Script($X,...)" | |
| }, | |
| { | |
| "pattern": "new SourceTextModule($X,...)" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.aws-lambda.security.tainted-html-string.tainted-html-string", | |
| "message": "Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead.", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" | |
| ], | |
| "owasp": [ | |
| "A07:2017 - Cross-Site Scripting (XSS)", | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "aws-lambda" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "references": [ | |
| "https://owasp.org/Top10/A03_2021-Injection" | |
| ], | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cross-Site-Scripting (XSS)" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.aws-lambda.security.tainted-html-string.tainted-html-string", | |
| "shortlink": "https://sg.run/Lgqr", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 18483, | |
| "rv_id": 1263112, | |
| "rule_id": "PeUxwW", | |
| "version_id": "DkTRbvp", | |
| "url": "https://semgrep.dev/playground/r/DkTRbvp/javascript.aws-lambda.security.tainted-html-string.tainted-html-string", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "exports.handler = function ($EVENT, ...) {\n ...\n}\n" | |
| }, | |
| { | |
| "pattern-inside": "function $FUNC ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" | |
| }, | |
| { | |
| "pattern-inside": "$FUNC = function ($EVENT, ...) {...}\n...\nexports.handler = $FUNC\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$EVENT" | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "\"$HTMLSTR\" + $EXPR\n" | |
| }, | |
| { | |
| "pattern": "\"$HTMLSTR\".concat(...)\n" | |
| }, | |
| { | |
| "pattern": "$UTIL.format($HTMLSTR, ...)" | |
| }, | |
| { | |
| "pattern": "format($HTMLSTR, ...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-pattern": { | |
| "metavariable": "$HTMLSTR", | |
| "language": "generic", | |
| "pattern": "<$TAG ..." | |
| } | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern": "`...${...}...`\n" | |
| }, | |
| { | |
| "pattern-regex": ".*<\\w+.*\n" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-not-inside": "console.$LOG(...)\n" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.jose.security.jwt-none-alg.jwt-none-alg", | |
| "message": "Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-327: Use of a Broken or Risky Cryptographic Algorithm" | |
| ], | |
| "owasp": [ | |
| "A03:2017 - Sensitive Data Exposure", | |
| "A02:2021 - Cryptographic Failures", | |
| "A04:2025 - Cryptographic Failures" | |
| ], | |
| "source-rule-url": "https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/", | |
| "asvs": { | |
| "section": "V3: Session Management Verification Requirements", | |
| "control_id": "3.5.3 Insecue Stateless Session Tokens", | |
| "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management", | |
| "version": "4" | |
| }, | |
| "category": "security", | |
| "technology": [ | |
| "jose", | |
| "jwt" | |
| ], | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "MEDIUM", | |
| "confidence": "HIGH", | |
| "references": [ | |
| "https://owasp.org/Top10/A02_2021-Cryptographic_Failures" | |
| ], | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cryptographic Issues" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg", | |
| "shortlink": "https://sg.run/AvRL", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9294, | |
| "rv_id": 1263183, | |
| "rule_id": "5rUOGN", | |
| "version_id": "ZRTKAyb", | |
| "url": "https://semgrep.dev/playground/r/ZRTKAyb/javascript.jose.security.jwt-none-alg.jwt-none-alg", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "ERROR", | |
| "pattern-either": [ | |
| { | |
| "pattern": "var $JOSE = require(\"jose\");\n...\nvar { JWK, JWT } = $JOSE;\n...\nvar $T = JWT.verify($P, JWK.None,...);\n" | |
| }, | |
| { | |
| "pattern": "var $JOSE = require(\"jose\");\n...\nvar { JWK, JWT } = $JOSE;\n...\n$T = JWT.verify($P, JWK.None,...);\n" | |
| }, | |
| { | |
| "pattern": "var $JOSE = require(\"jose\");\n...\nvar { JWK, JWT } = $JOSE;\n...\nJWT.verify($P, JWK.None,...);\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret", | |
| "message": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).", | |
| "metadata": { | |
| "interfile": true, | |
| "cwe": [ | |
| "CWE-798: Use of Hard-coded Credentials" | |
| ], | |
| "references": [ | |
| "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html" | |
| ], | |
| "owasp": [ | |
| "A07:2021 - Identification and Authentication Failures", | |
| "A07:2025 - Authentication Failures" | |
| ], | |
| "asvs": { | |
| "section": "V3: Session Management Verification Requirements", | |
| "control_id": "3.5.2 Static API keys or secret", | |
| "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management", | |
| "version": "4" | |
| }, | |
| "category": "security", | |
| "technology": [ | |
| "jose", | |
| "jwt", | |
| "secrets" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "MEDIUM", | |
| "confidence": "HIGH", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Hard-coded Secrets" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret", | |
| "shortlink": "https://sg.run/Ro1g", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9293, | |
| "rv_id": 1263182, | |
| "rule_id": "JDUyRl", | |
| "version_id": "d6TyxbX", | |
| "url": "https://semgrep.dev/playground/r/d6TyxbX/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$JOSE = require(\"jose\");\n...\n" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "var {JWT} = $JOSE;\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "var {JWK, JWT} = $JOSE;\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "const {JWT} = $JOSE;\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "const {JWK, JWT} = $JOSE;\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "let {JWT} = $JOSE;\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "let {JWK, JWT} = $JOSE;\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "JWT.verify($P, \"...\", ...);\n" | |
| }, | |
| { | |
| "pattern": "JWT.sign($P, \"...\", ...);\n" | |
| }, | |
| { | |
| "pattern": "JWT.verify($P, JWK.asKey(\"...\"), ...); \n" | |
| }, | |
| { | |
| "pattern": "$JWT.sign($P, JWK.asKey(\"...\"), ...);\n" | |
| } | |
| ] | |
| } | |
| ], | |
| "options": { | |
| "symbolic_propagation": true, | |
| "interfile": true | |
| } | |
| }, | |
| { | |
| "id": "javascript.lang.security.audit.code-string-concat.code-string-concat", | |
| "message": "Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can lead to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever possible.", | |
| "options": { | |
| "interfile": true | |
| }, | |
| "metadata": { | |
| "interfile": true, | |
| "confidence": "HIGH", | |
| "owasp": [ | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "cwe": [ | |
| "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" | |
| ], | |
| "references": [ | |
| "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval", | |
| "https://nodejs.org/api/child_process.html#child_processexeccommand-options-callback", | |
| "https://www.stackhawk.com/blog/nodejs-command-injection-examples-and-prevention/", | |
| "https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_server_side_js_injection.html" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "node.js", | |
| "Express", | |
| "Next.js" | |
| ], | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Code Injection" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.lang.security.audit.code-string-concat.code-string-concat", | |
| "shortlink": "https://sg.run/96Yk", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 13023, | |
| "rv_id": 1263192, | |
| "rule_id": "DbUKEz", | |
| "version_id": "44TEjYX", | |
| "url": "https://semgrep.dev/playground/r/44TEjYX/javascript.lang.security.audit.code-string-concat.code-string-concat", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "ERROR", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES) {...}" | |
| }, | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES, $NEXT) {...}" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {...})" | |
| }, | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|head|delete|options)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| }, | |
| { | |
| "pattern": "$REQ.cookies" | |
| }, | |
| { | |
| "pattern": "$REQ.headers" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import { ...,$IMPORT,... } from 'next/router'\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $IMPORT from 'next/router';\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$ROUTER = $IMPORT()\n...\n" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "const { ...,$PROPS,... } = $ROUTER.query\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "var { ...,$PROPS,... } = $ROUTER.query\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "let { ...,$PROPS,... } = $ROUTER.query\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$PROPS" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$ROUTER = $IMPORT()\n...\n" | |
| }, | |
| { | |
| "pattern": "$ROUTER.query.$VALUE \n" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern": "$IMPORT().query.$VALUE" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern": "eval(...)\n" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli", | |
| "message": "Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. An example of parameterized queries like so: `knex.raw('SELECT $1 from table', [userinput])` can help prevent SQLi.", | |
| "metadata": { | |
| "confidence": "MEDIUM", | |
| "references": [ | |
| "https://knexjs.org/#Builder-fromRaw", | |
| "https://knexjs.org/#Builder-whereRaw", | |
| "https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html" | |
| ], | |
| "category": "security", | |
| "owasp": [ | |
| "A01:2017 - Injection", | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "cwe": [ | |
| "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" | |
| ], | |
| "technology": [ | |
| "express", | |
| "nodejs", | |
| "knex" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "SQL Injection" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli", | |
| "shortlink": "https://sg.run/l9eE", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 18257, | |
| "rv_id": 1263205, | |
| "rule_id": "d8UKLD", | |
| "version_id": "l4TJRey", | |
| "url": "https://semgrep.dev/playground/r/l4TJRey/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES) {...}" | |
| }, | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES, $NEXT) {...}" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {...})" | |
| }, | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|head|delete|options)" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| }, | |
| { | |
| "pattern": "$REQ.cookies" | |
| }, | |
| { | |
| "pattern": "$REQ.headers" | |
| }, | |
| { | |
| "pattern": "$REQ.files.$ANYTHING.data.toString('utf8')" | |
| }, | |
| { | |
| "pattern": "$REQ.files.$ANYTHING['data'].toString('utf8')" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" | |
| }, | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response) => {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$REQ" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "params" | |
| }, | |
| { | |
| "pattern": "query" | |
| }, | |
| { | |
| "pattern": "cookies" | |
| }, | |
| { | |
| "pattern": "headers" | |
| }, | |
| { | |
| "pattern": "body" | |
| }, | |
| { | |
| "pattern": "files.$ANYTHING.data.toString('utf8')" | |
| }, | |
| { | |
| "pattern": "files.$ANYTHING['data'].toString('utf8')" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "focus-metavariable": "$QUERY" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$KNEX.fromRaw($QUERY, ...)" | |
| }, | |
| { | |
| "pattern-inside": "$KNEX.whereRaw($QUERY, ...)" | |
| }, | |
| { | |
| "pattern-inside": "$KNEX.raw($QUERY, ...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "require('knex')\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import 'knex'\n...\n" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sanitizers": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern": "parseInt(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.browser.security.open-redirect.js-open-redirect", | |
| "message": "The application accepts potentially user-controlled input `$PROP` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input before allowing it to control the redirection.", | |
| "options": { | |
| "interfile": true | |
| }, | |
| "metadata": { | |
| "interfile": true, | |
| "cwe": [ | |
| "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')" | |
| ], | |
| "owasp": [ | |
| "A01:2021 - Broken Access Control", | |
| "A01:2025 - Broken Access Control" | |
| ], | |
| "asvs": { | |
| "section": "V5 Validation, Sanitization and Encoding", | |
| "control_id": "5.5.1 Insecue Redirect", | |
| "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation", | |
| "version": "4" | |
| }, | |
| "category": "security", | |
| "confidence": "HIGH", | |
| "references": [ | |
| "https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html" | |
| ], | |
| "technology": [ | |
| "browser" | |
| ], | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Open Redirect" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.browser.security.open-redirect.js-open-redirect", | |
| "shortlink": "https://sg.run/3xRe", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9243, | |
| "rv_id": 1263122, | |
| "rule_id": "WAUopl", | |
| "version_id": "pZT03x0", | |
| "url": "https://semgrep.dev/playground/r/pZT03x0/javascript.browser.security.open-redirect.js-open-redirect", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "new URLSearchParams($WINDOW. ... .location.search).get('...')\n" | |
| }, | |
| { | |
| "pattern": "new URLSearchParams(location.search).get('...')\n" | |
| }, | |
| { | |
| "pattern": "new URLSearchParams($WINDOW. ... .location.hash.substring(1)).get('...')\n" | |
| }, | |
| { | |
| "pattern": "new URLSearchParams(location.hash.substring(1)).get('...')\n" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$PROPS = new URLSearchParams($WINDOW. ... .location.search)\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$PROPS = new URLSearchParams(location.search)\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$PROPS = new URLSearchParams($WINDOW. ... .location.hash.substring(1))\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$PROPS = new URLSearchParams(location.hash.substring(1))\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$PROPS.get('...')" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$PROPS = new URL($WINDOW. ... .location.href)\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$PROPS = new URL(location.href)\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$PROPS.searchParams.get('...')" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "new URL($WINDOW. ... .location.href).searchParams.get('...')\n" | |
| }, | |
| { | |
| "pattern": "new URL(location.href).searchParams.get('...')\n" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "location.href = $SINK" | |
| }, | |
| { | |
| "pattern": "$THIS. ... .location.href = $SINK" | |
| }, | |
| { | |
| "pattern": "location.replace($SINK)" | |
| }, | |
| { | |
| "pattern": "$THIS. ... .location.replace($SINK)" | |
| }, | |
| { | |
| "pattern": "location = $SINK" | |
| }, | |
| { | |
| "pattern": "$WINDOW. ... .location = $SINK" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$SINK" | |
| }, | |
| { | |
| "metavariable-pattern": { | |
| "patterns": [ | |
| { | |
| "pattern-not": "\"...\" + $VALUE\n" | |
| }, | |
| { | |
| "pattern-not": "`...${$VALUE}`\n" | |
| } | |
| ], | |
| "metavariable": "$SINK" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.browser.security.raw-html-concat.raw-html-concat", | |
| "message": "User controlled data in a HTML string may result in XSS", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" | |
| ], | |
| "owasp": [ | |
| "A07:2017 - Cross-Site Scripting (XSS)", | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "references": [ | |
| "https://owasp.org/www-community/attacks/xss/" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "browser" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cross-Site-Scripting (XSS)" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.browser.security.raw-html-concat.raw-html-concat", | |
| "shortlink": "https://sg.run/4xAx", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9244, | |
| "rv_id": 1263123, | |
| "rule_id": "0oU5b5", | |
| "version_id": "2KTv2wp", | |
| "url": "https://semgrep.dev/playground/r/2KTv2wp/javascript.browser.security.raw-html-concat.raw-html-concat", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "location.href" | |
| }, | |
| { | |
| "pattern": "location.hash" | |
| }, | |
| { | |
| "pattern": "location.search" | |
| }, | |
| { | |
| "pattern": "$WINDOW. ... .location.href" | |
| }, | |
| { | |
| "pattern": "$WINDOW. ... .location.hash" | |
| }, | |
| { | |
| "pattern": "$WINDOW. ... .location.search" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern": "$STRING + $EXPR" | |
| }, | |
| { | |
| "pattern-not": "$STRING + \"...\"" | |
| }, | |
| { | |
| "metavariable-pattern": { | |
| "patterns": [ | |
| { | |
| "pattern": "<$TAG ..." | |
| }, | |
| { | |
| "pattern-not": "<$TAG ...>...</$TAG>..." | |
| } | |
| ], | |
| "metavariable": "$STRING", | |
| "language": "generic" | |
| } | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern": "$EXPR + $STRING" | |
| }, | |
| { | |
| "pattern-not": "\"...\" + $STRING" | |
| }, | |
| { | |
| "metavariable-pattern": { | |
| "patterns": [ | |
| { | |
| "pattern": "... </$TAG" | |
| } | |
| ], | |
| "metavariable": "$STRING", | |
| "language": "generic" | |
| } | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern": "[..., $STRING, ...].join(...)" | |
| }, | |
| { | |
| "metavariable-pattern": { | |
| "patterns": [ | |
| { | |
| "pattern": "<$TAG ..." | |
| } | |
| ], | |
| "metavariable": "$STRING", | |
| "language": "generic" | |
| } | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern": "[..., $STRING, ...].join(...)" | |
| }, | |
| { | |
| "metavariable-pattern": { | |
| "patterns": [ | |
| { | |
| "pattern": "... </$TAG" | |
| } | |
| ], | |
| "metavariable": "$STRING", | |
| "language": "generic" | |
| } | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern": "$VAR += $STRING" | |
| }, | |
| { | |
| "metavariable-pattern": { | |
| "patterns": [ | |
| { | |
| "pattern": "<$TAG ..." | |
| } | |
| ], | |
| "metavariable": "$STRING", | |
| "language": "generic" | |
| } | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern": "$VAR += $STRING" | |
| }, | |
| { | |
| "metavariable-pattern": { | |
| "patterns": [ | |
| { | |
| "pattern": "... </$TAG" | |
| } | |
| ], | |
| "metavariable": "$STRING", | |
| "language": "generic" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sanitizers": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from \"underscore.string\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"underscore.string\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $S from \"underscore.string\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"underscore.string\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$S.escapeHTML(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from \"dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import { ..., $S,... } from \"dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"dompurify\")\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $S from \"isomorphic-dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"isomorphic-dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"isomorphic-dompurify\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$VALUE = $S(...)\n...\n" | |
| }, | |
| { | |
| "pattern": "$VALUE.sanitize(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$VALUE = $S.sanitize\n...\n" | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S.sanitize(...)" | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from 'xss';\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from 'xss';\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"xss\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from 'sanitize-html';\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"sanitize-html\";\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"sanitize-html\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$S = new Remarkable()\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S.render(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration", | |
| "message": "The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message.", | |
| "metadata": { | |
| "owasp": [ | |
| "A08:2021 - Software and Data Integrity Failures", | |
| "A08:2025 - Software or Data Integrity Failures" | |
| ], | |
| "cwe": [ | |
| "CWE-345: Insufficient Verification of Data Authenticity" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "browser" | |
| ], | |
| "subcategory": [ | |
| "audit" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "references": [ | |
| "https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures" | |
| ], | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Improper Authentication" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration", | |
| "shortlink": "https://sg.run/PJ4p", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9245, | |
| "rv_id": 1263125, | |
| "rule_id": "KxUbq4", | |
| "version_id": "jQTn5ND", | |
| "url": "https://semgrep.dev/playground/r/jQTn5ND/javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "pattern": "$OBJECT.postMessage(...,'*',...)" | |
| }, | |
| { | |
| "id": "javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection", | |
| "message": "Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements.", | |
| "options": { | |
| "interfile": true | |
| }, | |
| "metadata": { | |
| "interfile": true, | |
| "references": [ | |
| "https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "express" | |
| ], | |
| "cwe": [ | |
| "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" | |
| ], | |
| "owasp": [ | |
| "A01:2017 - Injection", | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "HIGH", | |
| "confidence": "HIGH", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "SQL Injection" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection", | |
| "shortlink": "https://sg.run/gjoe", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 22085, | |
| "rv_id": 1263241, | |
| "rule_id": "yyU0GX", | |
| "version_id": "nWT2Llx", | |
| "url": "https://semgrep.dev/playground/r/nWT2Llx/javascript.sequelize.security.audit.sequelize-injection-express.express-sequelize-injection", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "ERROR", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES) {...}" | |
| }, | |
| { | |
| "pattern-inside": "function ... ($REQ, $RES, $NEXT) {...}" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES) {...})" | |
| }, | |
| { | |
| "pattern-inside": "$APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$METHOD", | |
| "regex": "^(get|post|put|head|delete|options)$" | |
| } | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$REQ.query" | |
| }, | |
| { | |
| "pattern": "$REQ.body" | |
| }, | |
| { | |
| "pattern": "$REQ.params" | |
| }, | |
| { | |
| "pattern": "$REQ.cookies" | |
| }, | |
| { | |
| "pattern": "$REQ.headers" | |
| }, | |
| { | |
| "pattern": "$REQ.files.$ANYTHING.data.toString('utf8')" | |
| }, | |
| { | |
| "pattern": "$REQ.files.$ANYTHING['data'].toString('utf8')" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>\n{...}\n" | |
| }, | |
| { | |
| "pattern-inside": "({ $REQ }: Request,$RES: Response) => {...}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$REQ" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "params" | |
| }, | |
| { | |
| "pattern": "query" | |
| }, | |
| { | |
| "pattern": "cookies" | |
| }, | |
| { | |
| "pattern": "headers" | |
| }, | |
| { | |
| "pattern": "body" | |
| }, | |
| { | |
| "pattern": "files.$ANYTHING.data.toString('utf8')" | |
| }, | |
| { | |
| "pattern": "files.$ANYTHING['data'].toString('utf8')" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "sequelize.query($QUERY,...)" | |
| }, | |
| { | |
| "pattern": "$DB.sequelize.query($QUERY,...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$QUERY" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sanitizers": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "parseInt(...)" | |
| }, | |
| { | |
| "pattern": "$FUNC. ... .hash(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret", | |
| "message": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-798: Use of Hard-coded Credentials" | |
| ], | |
| "references": [ | |
| "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html" | |
| ], | |
| "owasp": [ | |
| "A07:2021 - Identification and Authentication Failures", | |
| "A07:2025 - Authentication Failures" | |
| ], | |
| "asvs": { | |
| "section": "V3: Session Management Verification Requirements", | |
| "control_id": "3.5.2 Static API keys or secret", | |
| "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management", | |
| "version": "4" | |
| }, | |
| "category": "security", | |
| "technology": [ | |
| "jwt", | |
| "nodejs", | |
| "secrets" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "MEDIUM", | |
| "confidence": "HIGH", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Hard-coded Secrets" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret", | |
| "shortlink": "https://sg.run/vz70", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9333, | |
| "rv_id": 1263225, | |
| "rule_id": "QrUzq6", | |
| "version_id": "X0TzyoE", | |
| "url": "https://semgrep.dev/playground/r/X0TzyoE/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "by-side-effect": true, | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "{..., clientSecret: \"...\", ...}\n" | |
| }, | |
| { | |
| "pattern": "{..., secretOrKey: \"...\", ...}\n" | |
| }, | |
| { | |
| "pattern": "{..., consumerSecret: \"...\", ...}\n" | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$OBJ = {}\n...\n" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$OBJ.clientSecret = \"...\"\n" | |
| }, | |
| { | |
| "pattern": "$OBJ.secretOrKey = \"...\"\n" | |
| }, | |
| { | |
| "pattern": "$OBJ.consumerSecret = \"...\"\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$OBJ" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$SECRET = '...'\n...\n" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "{..., clientSecret: $SECRET, ...}\n" | |
| }, | |
| { | |
| "pattern": "{..., secretOrKey: $SECRET, ...}\n" | |
| }, | |
| { | |
| "pattern": "{..., consumerSecret: $SECRET, ...}\n" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$SECRET = '...'\n...\n" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$VALUE = {..., clientSecret: $SECRET, ...}\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$VALUE = {..., secretOrKey: $SECRET, ...}\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$VALUE = {..., consumerSecret: $SECRET, ...}\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$VALUE" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$F = require(\"$I\").Strategy\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$F = require(\"$I\")\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import { $STRAT as $F } from '$I'\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $F from '$I'\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$I", | |
| "regex": "(passport-.*)" | |
| } | |
| }, | |
| { | |
| "pattern-inside": "new $F($VALUE,...)\n" | |
| }, | |
| { | |
| "focus-metavariable": "$VALUE" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust", | |
| "message": "Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the appropriate prevention mechanism e.g. input validation or sanitization depending on the context.", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" | |
| ], | |
| "references": [ | |
| "https://angular.io/api/platform-browser/DomSanitizer", | |
| "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html" | |
| ], | |
| "owasp": [ | |
| "A07:2017 - Cross-Site Scripting (XSS)", | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "confidence": "MEDIUM", | |
| "category": "security", | |
| "technology": [ | |
| "angular", | |
| "browser" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "LOW", | |
| "impact": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cross-Site-Scripting (XSS)" | |
| ], | |
| "source": "https://semgrep.dev/r/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust", | |
| "shortlink": "https://sg.run/KWxP", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9755, | |
| "rv_id": 1263902, | |
| "rule_id": "oqUzgA", | |
| "version_id": "5PTo1zk", | |
| "url": "https://semgrep.dev/playground/r/5PTo1zk/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "typescript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ...({..., $X: string, ...}) { ... }\n" | |
| }, | |
| { | |
| "pattern-inside": "function ...(..., $X: string, ...) { ... }\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$X" | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$X.$TRUST($Y)" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$Y" | |
| }, | |
| { | |
| "pattern-not": "$X.$TRUST(`...`)\n" | |
| }, | |
| { | |
| "pattern-not": "$X.$TRUST(\"...\")\n" | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$TRUST", | |
| "regex": "(bypassSecurityTrustHtml|bypassSecurityTrustStyle|bypassSecurityTrustScript|bypassSecurityTrustUrl|bypassSecurityTrustResourceUrl)" | |
| } | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sanitizers": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from \"underscore.string\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"underscore.string\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $S from \"underscore.string\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"underscore.string\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$S.escapeHTML(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from \"dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import { ..., $S,... } from \"dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"dompurify\")\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $S from \"isomorphic-dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"isomorphic-dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"isomorphic-dompurify\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$VALUE = $S(...)\n...\n" | |
| }, | |
| { | |
| "pattern": "$VALUE.sanitize(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$VALUE = $S.sanitize\n...\n" | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S.sanitize(...)" | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from 'xss';\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from 'xss';\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"xss\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from 'sanitize-html';\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"sanitize-html\";\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"sanitize-html\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern": "sanitizer.sanitize(...)" | |
| }, | |
| { | |
| "pattern-not": "sanitizer.sanitize(SecurityContext.NONE, ...);" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public", | |
| "message": "CodeBuild Project $X is set to have a public URL. This will make the build results, logs, artifacts publically accessible, including builds prior to the project being public. Ensure this is acceptable for the project.", | |
| "metadata": { | |
| "category": "security", | |
| "cwe": [ | |
| "CWE-306: Missing Authentication for Critical Function" | |
| ], | |
| "technology": [ | |
| "AWS-CDK" | |
| ], | |
| "references": [ | |
| "https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html" | |
| ], | |
| "owasp": [ | |
| "A07:2021 - Identification and Authentication Failures", | |
| "A07:2025 - Authentication Failures" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Improper Authentication" | |
| ], | |
| "source": "https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public", | |
| "shortlink": "https://sg.run/nK7G", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 15280, | |
| "rv_id": 1263907, | |
| "rule_id": "x8UxXZ", | |
| "version_id": "DkTRbj1", | |
| "url": "https://semgrep.dev/playground/r/DkTRbj1/typescript.aws-cdk.security.awscdk-codebuild-project-public.awscdk-codebuild-project-public", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "ts" | |
| ], | |
| "severity": "WARNING", | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "import {Project} from '@aws-cdk/aws-codebuild'\n...\n" | |
| }, | |
| { | |
| "pattern": "const $X = new Project(..., {..., badge: true, ...})\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "import * as $Y from '@aws-cdk/aws-codebuild'\n...\n" | |
| }, | |
| { | |
| "pattern": "const $X = new $Y.Project(..., {..., badge: true, ...})\n" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod", | |
| "message": "Using the GrantPublicAccess method on bucket contruct $X will make the objects in the bucket world accessible. Verify if this is intentional.", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-306: Missing Authentication for Critical Function" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "AWS-CDK" | |
| ], | |
| "references": [ | |
| "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-overview.html" | |
| ], | |
| "owasp": [ | |
| "A07:2021 - Identification and Authentication Failures", | |
| "A07:2025 - Authentication Failures" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "HIGH", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Improper Authentication" | |
| ], | |
| "source": "https://semgrep.dev/r/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod", | |
| "shortlink": "https://sg.run/Z4p7", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 15279, | |
| "rv_id": 1263906, | |
| "rule_id": "wdUjZK", | |
| "version_id": "BjTkZA7", | |
| "url": "https://semgrep.dev/playground/r/BjTkZA7/typescript.aws-cdk.security.awscdk-bucket-grantpublicaccessmethod.awscdk-bucket-grantpublicaccessmethod", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "ts" | |
| ], | |
| "severity": "WARNING", | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "import {Bucket} from '@aws-cdk/aws-s3'\n...\n" | |
| }, | |
| { | |
| "pattern": "const $X = new Bucket(...)\n...\n$X.grantPublicAccess(...)\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "import * as $Y from '@aws-cdk/aws-s3'\n...\n" | |
| }, | |
| { | |
| "pattern": "const $X = new $Y.Bucket(...)\n...\n$X.grantPublicAccess(...)\n" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl", | |
| "message": "Bucket $X is not set to enforce encryption-in-transit, if not explictly setting this on the bucket policy - the property \"enforceSSL\" should be set to true", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-319: Cleartext Transmission of Sensitive Information" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "AWS-CDK" | |
| ], | |
| "references": [ | |
| "https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html" | |
| ], | |
| "owasp": [ | |
| "A03:2017 - Sensitive Data Exposure", | |
| "A02:2021 - Cryptographic Failures", | |
| "A04:2025 - Cryptographic Failures" | |
| ], | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Mishandled Sensitive Information" | |
| ], | |
| "source": "https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl", | |
| "shortlink": "https://sg.run/vqBX", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 15277, | |
| "rv_id": 1263904, | |
| "rule_id": "NbUN8B", | |
| "version_id": "RGT0Llg", | |
| "url": "https://semgrep.dev/playground/r/RGT0Llg/typescript.aws-cdk.security.audit.awscdk-bucket-enforcessl.aws-cdk-bucket-enforcessl", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "ts" | |
| ], | |
| "severity": "ERROR", | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "import {Bucket} from '@aws-cdk/aws-s3';\n...\n" | |
| }, | |
| { | |
| "pattern": "const $X = new Bucket(...)" | |
| }, | |
| { | |
| "pattern-not": "const $X = new Bucket(..., {enforceSSL: true}, ...)\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "import * as $Y from '@aws-cdk/aws-s3';\n...\n" | |
| }, | |
| { | |
| "pattern": "const $X = new $Y.Bucket(...)" | |
| }, | |
| { | |
| "pattern-not": "const $X = new $Y.Bucket(..., {..., enforceSSL: true, ...})\n" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption", | |
| "message": "Add \"encryption: $Y.BucketEncryption.KMS_MANAGED\" or \"encryption: $Y.BucketEncryption.S3_MANAGED\" to the bucket props for Bucket construct $X", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-311: Missing Encryption of Sensitive Data" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "AWS-CDK" | |
| ], | |
| "references": [ | |
| "https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html" | |
| ], | |
| "owasp": [ | |
| "A03:2017 - Sensitive Data Exposure", | |
| "A04:2021 - Insecure Design", | |
| "A06:2025 - Insecure Design" | |
| ], | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "LOW", | |
| "impact": "HIGH", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cryptographic Issues" | |
| ], | |
| "source": "https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption", | |
| "shortlink": "https://sg.run/eowX", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 15276, | |
| "rv_id": 1263903, | |
| "rule_id": "bwU8qz", | |
| "version_id": "GxTkeRx", | |
| "url": "https://semgrep.dev/playground/r/GxTkeRx/typescript.aws-cdk.security.audit.awscdk-bucket-encryption.awscdk-bucket-encryption", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "typescript" | |
| ], | |
| "severity": "ERROR", | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "import {Bucket} from '@aws-cdk/aws-s3'\n...\n" | |
| }, | |
| { | |
| "pattern": "const $X = new Bucket(...)" | |
| }, | |
| { | |
| "pattern-not": "const $X = new Bucket(..., {..., encryption: BucketEncryption.KMS_MANAGED, ...})\n" | |
| }, | |
| { | |
| "pattern-not": "const $X = new Bucket(..., {..., encryption: BucketEncryption.KMS, ...})\n" | |
| }, | |
| { | |
| "pattern-not": "const $X = new Bucket(..., {..., encryption: BucketEncryption.S3_MANAGED, ...})\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "import * as $Y from '@aws-cdk/aws-s3'\n...\n" | |
| }, | |
| { | |
| "pattern": "const $X = new $Y.Bucket(...)" | |
| }, | |
| { | |
| "pattern-not": "const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.KMS_MANAGED, ...})\n" | |
| }, | |
| { | |
| "pattern-not": "const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.KMS, ...})\n" | |
| }, | |
| { | |
| "pattern-not": "const $X = new $Y.Bucket(..., {..., encryption: $Y.BucketEncryption.S3_MANAGED, ...})\n" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue", | |
| "message": "Queue $X is missing encryption at rest. Add \"encryption: $Y.QueueEncryption.KMS\" or \"encryption: $Y.QueueEncryption.KMS_MANAGED\" to the queue props to enable encryption at rest for the queue.", | |
| "metadata": { | |
| "category": "security", | |
| "cwe": [ | |
| "CWE-311: Missing Encryption of Sensitive Data" | |
| ], | |
| "technology": [ | |
| "AWS-CDK" | |
| ], | |
| "references": [ | |
| "https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-data-protection.html" | |
| ], | |
| "owasp": [ | |
| "A03:2017 - Sensitive Data Exposure", | |
| "A04:2021 - Insecure Design", | |
| "A06:2025 - Insecure Design" | |
| ], | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "LOW", | |
| "impact": "HIGH", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cryptographic Issues" | |
| ], | |
| "source": "https://semgrep.dev/r/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue", | |
| "shortlink": "https://sg.run/d23P", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 15278, | |
| "rv_id": 1263905, | |
| "rule_id": "kxUwqO", | |
| "version_id": "A8Tgd2W", | |
| "url": "https://semgrep.dev/playground/r/A8Tgd2W/typescript.aws-cdk.security.audit.awscdk-sqs-unencryptedqueue.awscdk-sqs-unencryptedqueue", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "ts" | |
| ], | |
| "severity": "WARNING", | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "import {Queue} from '@aws-cdk/aws-sqs'\n...\n" | |
| }, | |
| { | |
| "pattern": "const $X = new Queue(...)" | |
| }, | |
| { | |
| "pattern-not": "const $X = new Queue(..., {..., encryption: QueueEncryption.KMS_MANAGED, ...})\n" | |
| }, | |
| { | |
| "pattern-not": "const $X = new Queue(..., {..., encryption: QueueEncryption.KMS, ...})\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "import * as $Y from '@aws-cdk/aws-sqs'\n...\n" | |
| }, | |
| { | |
| "pattern": "const $X = new $Y.Queue(...)" | |
| }, | |
| { | |
| "pattern-not": "const $X = new $Y.Queue(..., {..., encryption: $Y.QueueEncryption.KMS_MANAGED, ...})\n" | |
| }, | |
| { | |
| "pattern-not": "const $X = new $Y.Queue(..., {..., encryption: $Y.QueueEncryption.KMS, ...})\n" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "typescript.react.security.react-insecure-request.react-insecure-request", | |
| "message": "Unencrypted request over HTTP detected.", | |
| "metadata": { | |
| "vulnerability": "Insecure Transport", | |
| "owasp": [ | |
| "A03:2017 - Sensitive Data Exposure", | |
| "A02:2021 - Cryptographic Failures", | |
| "A04:2025 - Cryptographic Failures" | |
| ], | |
| "cwe": [ | |
| "CWE-319: Cleartext Transmission of Sensitive Information" | |
| ], | |
| "references": [ | |
| "https://www.npmjs.com/package/axios" | |
| ], | |
| "category": "security", | |
| "technology": [ | |
| "react" | |
| ], | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "LOW", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Mishandled Sensitive Information" | |
| ], | |
| "source": "https://semgrep.dev/r/typescript.react.security.react-insecure-request.react-insecure-request", | |
| "shortlink": "https://sg.run/1n0b", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9766, | |
| "rv_id": 1263918, | |
| "rule_id": "NbUA3O", | |
| "version_id": "A8Tgd2p", | |
| "url": "https://semgrep.dev/playground/r/A8Tgd2p/typescript.react.security.react-insecure-request.react-insecure-request", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "typescript", | |
| "javascript" | |
| ], | |
| "severity": "ERROR", | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $AXIOS from 'axios';\n...\n$AXIOS.$METHOD(...)\n" | |
| }, | |
| { | |
| "pattern-inside": "$AXIOS = require('axios');\n...\n$AXIOS.$METHOD(...)\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$AXIOS.$VERB(\"$URL\",...)" | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$VERB", | |
| "regex": "^(get|post|delete|head|patch|put|options)" | |
| } | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $AXIOS from 'axios';\n...\n$AXIOS(...)\n" | |
| }, | |
| { | |
| "pattern-inside": "$AXIOS = require('axios');\n...\n$AXIOS(...)\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$AXIOS({url: \"$URL\"}, ...)" | |
| }, | |
| { | |
| "pattern": "$OPTS = {url: \"$URL\"}\n...\n$AXIOS($OPTS, ...)\n" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "fetch(\"$URL\", ...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$URL", | |
| "regex": "^([Hh][Tt][Tt][Pp]:\\/\\/(?!localhost).*)" | |
| } | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml", | |
| "message": "Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" | |
| ], | |
| "owasp": [ | |
| "A07:2017 - Cross-Site Scripting (XSS)", | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "references": [ | |
| "https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html" | |
| ], | |
| "category": "security", | |
| "confidence": "MEDIUM", | |
| "technology": [ | |
| "react" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cross-Site-Scripting (XSS)" | |
| ], | |
| "source": "https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml", | |
| "shortlink": "https://sg.run/rAx6", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9769, | |
| "rv_id": 1263912, | |
| "rule_id": "x8UWvK", | |
| "version_id": "l4TJR0v", | |
| "url": "https://semgrep.dev/playground/r/l4TJR0v/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "typescript", | |
| "javascript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ...({..., $X, ...}) { ... }\n" | |
| }, | |
| { | |
| "pattern-inside": "function ...(..., $X, ...) { ... }\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$X" | |
| }, | |
| { | |
| "pattern-not-inside": "$F. ... .$SANITIZEUNC(...)\n" | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "focus-metavariable": "$X" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "{...,dangerouslySetInnerHTML: {__html: $X},...}\n" | |
| }, | |
| { | |
| "pattern": "<$Y ... dangerouslySetInnerHTML={{__html: $X}} />\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-not": "<$Y ... dangerouslySetInnerHTML={{__html: \"...\"}} />\n" | |
| }, | |
| { | |
| "pattern-not": "{...,dangerouslySetInnerHTML:{__html: \"...\"},...}\n" | |
| }, | |
| { | |
| "metavariable-pattern": { | |
| "patterns": [ | |
| { | |
| "pattern-not": "{...}\n" | |
| } | |
| ], | |
| "metavariable": "$X" | |
| } | |
| }, | |
| { | |
| "pattern-not": "<... {__html: \"...\"} ...>\n" | |
| }, | |
| { | |
| "pattern-not": "<... {__html: `...`} ...>\n" | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sanitizers": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from \"underscore.string\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"underscore.string\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $S from \"underscore.string\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"underscore.string\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$S.escapeHTML(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from \"dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import { ..., $S,... } from \"dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"dompurify\")\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $S from \"isomorphic-dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"isomorphic-dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"isomorphic-dompurify\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$VALUE = $S(...)\n...\n" | |
| }, | |
| { | |
| "pattern": "$VALUE.sanitize(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$VALUE = $S.sanitize\n...\n" | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S.sanitize(...)" | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from 'xss';\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from 'xss';\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"xss\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from 'sanitize-html';\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"sanitize-html\";\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"sanitize-html\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$S = new Remarkable()\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S.render(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method", | |
| "message": "Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" | |
| ], | |
| "owasp": [ | |
| "A07:2017 - Cross-Site Scripting (XSS)", | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "references": [ | |
| "https://developer.mozilla.org/en-US/docs/Web/API/Document/writeln", | |
| "https://developer.mozilla.org/en-US/docs/Web/API/Document/write", | |
| "https://developer.mozilla.org/en-US/docs/Web/API/Element/insertAdjacentHTML" | |
| ], | |
| "category": "security", | |
| "confidence": "MEDIUM", | |
| "technology": [ | |
| "react" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cross-Site-Scripting (XSS)" | |
| ], | |
| "source": "https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method", | |
| "shortlink": "https://sg.run/E5x8", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9781, | |
| "rv_id": 1263916, | |
| "rule_id": "QrU68w", | |
| "version_id": "GxTkeRl", | |
| "url": "https://semgrep.dev/playground/r/GxTkeRl/typescript.react.security.audit.react-unsanitized-method.react-unsanitized-method", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "typescript", | |
| "javascript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ...({..., $X, ...}) { ... }\n" | |
| }, | |
| { | |
| "pattern-inside": "function ...(..., $X, ...) { ... }\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$X" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$X.$Y" | |
| }, | |
| { | |
| "pattern": "$X[...]" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "this.window.document. ... .$HTML('...',$SINK) \n" | |
| }, | |
| { | |
| "pattern": "window.document. ... .$HTML('...',$SINK) \n" | |
| }, | |
| { | |
| "pattern": "document.$HTML($SINK) \n" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$HTML", | |
| "regex": "(writeln|write)" | |
| } | |
| }, | |
| { | |
| "focus-metavariable": "$SINK" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$PROP. ... .$HTML('...',$SINK) \n" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$HTML", | |
| "regex": "(insertAdjacentHTML)" | |
| } | |
| }, | |
| { | |
| "focus-metavariable": "$SINK" | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sanitizers": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from \"underscore.string\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"underscore.string\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $S from \"underscore.string\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"underscore.string\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$S.escapeHTML(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from \"dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import { ..., $S,... } from \"dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"dompurify\")\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $S from \"isomorphic-dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"isomorphic-dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"isomorphic-dompurify\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$VALUE = $S(...)\n...\n" | |
| }, | |
| { | |
| "pattern": "$VALUE.sanitize(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$VALUE = $S.sanitize\n...\n" | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S.sanitize(...)" | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from 'xss';\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from 'xss';\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"xss\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from 'sanitize-html';\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"sanitize-html\";\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"sanitize-html\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$S = new Remarkable()\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S.render(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property", | |
| "message": "Detection of $HTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use $HTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" | |
| ], | |
| "owasp": [ | |
| "A07:2017 - Cross-Site Scripting (XSS)", | |
| "A03:2021 - Injection", | |
| "A05:2025 - Injection" | |
| ], | |
| "references": [ | |
| "https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html" | |
| ], | |
| "category": "security", | |
| "confidence": "MEDIUM", | |
| "technology": [ | |
| "react" | |
| ], | |
| "cwe2022-top25": true, | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cross-Site-Scripting (XSS)" | |
| ], | |
| "source": "https://semgrep.dev/r/typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property", | |
| "shortlink": "https://sg.run/70Zv", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9782, | |
| "rv_id": 1263917, | |
| "rule_id": "3qUBl4", | |
| "version_id": "RGT0Lln", | |
| "url": "https://semgrep.dev/playground/r/RGT0Lln/typescript.react.security.audit.react-unsanitized-property.react-unsanitized-property", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "typescript", | |
| "javascript" | |
| ], | |
| "severity": "WARNING", | |
| "mode": "taint", | |
| "pattern-sources": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "function ...({..., $X, ...}) { ... }\n" | |
| }, | |
| { | |
| "pattern-inside": "function ...(..., $X, ...) { ... }\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "focus-metavariable": "$X" | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$X.$Y" | |
| }, | |
| { | |
| "pattern": "$X[...]" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sinks": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$BODY = $REACT.useRef(...)\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$BODY = useRef(...)\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$BODY = findDOMNode(...)\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$BODY = createRef(...)\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$BODY = $REACT.findDOMNode(...)\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$BODY = $REACT.createRef(...)\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$BODY. ... .$HTML = $SINK \n" | |
| }, | |
| { | |
| "pattern": "$BODY.$HTML = $SINK \n" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$HTML", | |
| "regex": "(innerHTML|outerHTML)" | |
| } | |
| }, | |
| { | |
| "focus-metavariable": "$SINK" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "ReactDOM.findDOMNode(...).$HTML = $SINK" | |
| } | |
| ] | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$HTML", | |
| "regex": "(innerHTML|outerHTML)" | |
| } | |
| }, | |
| { | |
| "focus-metavariable": "$SINK" | |
| } | |
| ] | |
| } | |
| ], | |
| "pattern-sanitizers": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from \"underscore.string\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"underscore.string\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $S from \"underscore.string\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"underscore.string\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$S.escapeHTML(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from \"dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import { ..., $S,... } from \"dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"dompurify\")\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import $S from \"isomorphic-dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"isomorphic-dompurify\"\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"isomorphic-dompurify\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-either": [ | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$VALUE = $S(...)\n...\n" | |
| }, | |
| { | |
| "pattern": "$VALUE.sanitize(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$VALUE = $S.sanitize\n...\n" | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S.sanitize(...)" | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from 'xss';\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from 'xss';\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"xss\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "import $S from 'sanitize-html';\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "import * as $S from \"sanitize-html\";\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$S = require(\"sanitize-html\")\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S(...)" | |
| } | |
| ] | |
| }, | |
| { | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$S = new Remarkable()\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$S.render(...)" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path", | |
| "message": "Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request.", | |
| "severity": "WARNING", | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-522: Insufficiently Protected Credentials" | |
| ], | |
| "owasp": [ | |
| "A02:2017 - Broken Authentication", | |
| "A04:2021 - Insecure Design", | |
| "A06:2025 - Insecure Design" | |
| ], | |
| "source-rule-url": "https://expressjs.com/en/advanced/best-practice-security.html", | |
| "category": "security", | |
| "technology": [ | |
| "express" | |
| ], | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "LOW", | |
| "confidence": "MEDIUM", | |
| "references": [ | |
| "https://owasp.org/Top10/A04_2021-Insecure_Design" | |
| ], | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cryptographic Issues" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path", | |
| "shortlink": "https://sg.run/b7pd", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9270, | |
| "rv_id": 1263134, | |
| "rule_id": "nJUz4X", | |
| "version_id": "xyTjzQD", | |
| "url": "https://semgrep.dev/playground/r/xyTjzQD/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$SESSION = require('cookie-session');\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$SESSION = require('express-session');\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$SESSION(...)" | |
| }, | |
| { | |
| "pattern-not-inside": "$SESSION(<... {cookie:{path:...}} ...>,...)" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = <... {cookie:{path:...}} ...>;\n...\n$SESSION($OPTS,...);\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = ...;\n...\n$COOKIE = <... {path:...} ...>;\n...\n$SESSION($OPTS,...);\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = ...;\n...\n$OPTS.cookie = <... {path:...} ...>;\n...\n$SESSION($OPTS,...);\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = ...;\n...\n$COOKIE.path = ...;\n...\n$SESSION($OPTS,...);\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = ...;\n...\n$OPTS.cookie.path = ...;\n...\n$SESSION($OPTS,...);\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly", | |
| "message": "Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not client JavaScript, helping to protect against cross-site scripting attacks.", | |
| "severity": "WARNING", | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-522: Insufficiently Protected Credentials" | |
| ], | |
| "owasp": [ | |
| "A02:2017 - Broken Authentication", | |
| "A04:2021 - Insecure Design", | |
| "A06:2025 - Insecure Design" | |
| ], | |
| "source-rule-url": "https://expressjs.com/en/advanced/best-practice-security.html", | |
| "category": "security", | |
| "technology": [ | |
| "express" | |
| ], | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "LOW", | |
| "confidence": "MEDIUM", | |
| "references": [ | |
| "https://owasp.org/Top10/A04_2021-Insecure_Design" | |
| ], | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cryptographic Issues" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly", | |
| "shortlink": "https://sg.run/ydBO", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9268, | |
| "rv_id": 1263132, | |
| "rule_id": "d8UjGo", | |
| "version_id": "kbTzGev", | |
| "url": "https://semgrep.dev/playground/r/kbTzGev/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$SESSION = require('cookie-session');\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$SESSION = require('express-session');\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$SESSION(...)" | |
| }, | |
| { | |
| "pattern-not-inside": "$SESSION(<... {cookie:{httpOnly:true}} ...>,...)" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = <... {cookie:{httpOnly:true}} ...>;\n...\n$SESSION($OPTS,...);\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = ...;\n...\n$COOKIE = <... {httpOnly:true} ...>;\n...\n$SESSION($OPTS,...);\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = ...;\n...\n$OPTS.cookie = <... {httpOnly:true} ...>;\n...\n$SESSION($OPTS,...);\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = ...;\n...\n$COOKIE.httpOnly = true;\n...\n$SESSION($OPTS,...);\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = ...;\n...\n$OPTS.cookie.httpOnly = true;\n...\n$SESSION($OPTS,...);\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain", | |
| "message": "Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested. If they match, then check the path attribute next.", | |
| "severity": "WARNING", | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-522: Insufficiently Protected Credentials" | |
| ], | |
| "owasp": [ | |
| "A02:2017 - Broken Authentication", | |
| "A04:2021 - Insecure Design", | |
| "A06:2025 - Insecure Design" | |
| ], | |
| "source-rule-url": "https://expressjs.com/en/advanced/best-practice-security.html", | |
| "category": "security", | |
| "technology": [ | |
| "express" | |
| ], | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "LOW", | |
| "confidence": "MEDIUM", | |
| "references": [ | |
| "https://owasp.org/Top10/A04_2021-Insecure_Design" | |
| ], | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cryptographic Issues" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain", | |
| "shortlink": "https://sg.run/rd41", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9269, | |
| "rv_id": 1263133, | |
| "rule_id": "ZqU5Pn", | |
| "version_id": "w8TRoyd", | |
| "url": "https://semgrep.dev/playground/r/w8TRoyd/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$SESSION = require('cookie-session');\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$SESSION = require('express-session');\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$SESSION(...)" | |
| }, | |
| { | |
| "pattern-not-inside": "$SESSION(<... {cookie:{domain:...}} ...>,...)" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = <... {cookie:{domain:...}} ...>;\n...\n$SESSION($OPTS,...);\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = ...;\n...\n$COOKIE = <... {domain:...} ...>;\n...\n$SESSION($OPTS,...);\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = ...;\n...\n$OPTS.cookie = <... {domain:...} ...>;\n...\n$SESSION($OPTS,...);\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = ...;\n...\n$COOKIE.domain = ...;\n...\n$SESSION($OPTS,...);\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = ...;\n...\n$OPTS.cookie.domain = ...;\n...\n$SESSION($OPTS,...);\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure", | |
| "message": "Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS.", | |
| "severity": "WARNING", | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-522: Insufficiently Protected Credentials" | |
| ], | |
| "owasp": [ | |
| "A02:2017 - Broken Authentication", | |
| "A04:2021 - Insecure Design", | |
| "A06:2025 - Insecure Design" | |
| ], | |
| "source-rule-url": "https://expressjs.com/en/advanced/best-practice-security.html", | |
| "category": "security", | |
| "technology": [ | |
| "express" | |
| ], | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "LOW", | |
| "confidence": "MEDIUM", | |
| "references": [ | |
| "https://owasp.org/Top10/A04_2021-Insecure_Design" | |
| ], | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cryptographic Issues" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure", | |
| "shortlink": "https://sg.run/9oKz", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9267, | |
| "rv_id": 1263131, | |
| "rule_id": "v8Unzw", | |
| "version_id": "NdTzyrv", | |
| "url": "https://semgrep.dev/playground/r/NdTzyrv/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$SESSION = require('cookie-session');\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$SESSION = require('express-session');\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$SESSION(...)" | |
| }, | |
| { | |
| "pattern-not-inside": "$SESSION(<... {cookie:{secure:true}} ...>,...)" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = <... {cookie:{secure:true}} ...>;\n...\n$SESSION($OPTS,...);\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = ...;\n...\n$COOKIE = <... {secure:true} ...>;\n...\n$SESSION($OPTS,...);\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = ...;\n...\n$OPTS.cookie = <... {secure:true} ...>;\n...\n$SESSION($OPTS,...);\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = ...;\n...\n$COOKIE.secure = true;\n...\n$SESSION($OPTS,...);\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = ...;\n...\n$OPTS.cookie.secure = true;\n...\n$SESSION($OPTS,...);\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name", | |
| "message": "Don\u2019t use the default session cookie name Using the default session cookie name can open your app to attacks. The security issue posed is similar to X-Powered-By: a potential attacker can use it to fingerprint the server and target attacks accordingly.", | |
| "severity": "WARNING", | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-522: Insufficiently Protected Credentials" | |
| ], | |
| "owasp": [ | |
| "A02:2017 - Broken Authentication", | |
| "A04:2021 - Insecure Design", | |
| "A06:2025 - Insecure Design" | |
| ], | |
| "source-rule-url": "https://expressjs.com/en/advanced/best-practice-security.html", | |
| "category": "security", | |
| "technology": [ | |
| "express" | |
| ], | |
| "cwe2021-top25": true, | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "LOW", | |
| "confidence": "MEDIUM", | |
| "references": [ | |
| "https://owasp.org/Top10/A04_2021-Insecure_Design" | |
| ], | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cryptographic Issues" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name", | |
| "shortlink": "https://sg.run/1Z5x", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9266, | |
| "rv_id": 1263130, | |
| "rule_id": "eqU8k2", | |
| "version_id": "bZT536J", | |
| "url": "https://semgrep.dev/playground/r/bZT536J/javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern-inside": "$SESSION = require('cookie-session');\n...\n" | |
| }, | |
| { | |
| "pattern-inside": "$SESSION = require('express-session');\n...\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern": "$SESSION(...)" | |
| }, | |
| { | |
| "pattern-not-inside": "$SESSION(<... {name:...} ...>,...)" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = <... {name:...} ...>;\n...\n$SESSION($OPTS,...);\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$OPTS = ...;\n...\n$OPTS.name = ...;\n...\n$SESSION($OPTS,...);\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.node-crypto.security.aead-no-final.aead-no-final", | |
| "message": "The 'final' call of a Decipher object checks the authentication tag in a mode for authenticated encryption. Failing to call 'final' will invalidate all integrity guarantees of the released ciphertext.", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-310: CWE CATEGORY: Cryptographic Issues" | |
| ], | |
| "owasp": [ | |
| "A02:2021 - Cryptographic Failures", | |
| "A04:2025 - Cryptographic Failures" | |
| ], | |
| "category": "security", | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "technology": [ | |
| "node-crypto" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "MEDIUM", | |
| "confidence": "HIGH", | |
| "references": [ | |
| "https://nodejs.org/api/crypto.html#deciphersetauthtagbuffer-encoding", | |
| "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/" | |
| ], | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cryptographic Issues" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.node-crypto.security.aead-no-final.aead-no-final", | |
| "shortlink": "https://sg.run/r6EEA", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 146569, | |
| "rv_id": 1263222, | |
| "rule_id": "2ZUz884", | |
| "version_id": "zyTb2X0", | |
| "url": "https://semgrep.dev/playground/r/zyTb2X0/javascript.node-crypto.security.aead-no-final.aead-no-final", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "ERROR", | |
| "patterns": [ | |
| { | |
| "pattern": "$DECIPHER = $CRYPTO.createDecipheriv('$ALGO', ...)\n...\n$DECIPHER.update(...)\n" | |
| }, | |
| { | |
| "pattern-not-inside": "$DECIPHER = $CRYPTO.createDecipheriv('$ALGO', ...)\n...\n$DECIPHER.final(...)\n" | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$ALGO", | |
| "regex": ".*(-gcm|-ccm|-ocb|chacha20-poly1305)$" | |
| } | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv", | |
| "message": "The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used more than once. Other modes are still affected in their strength, though they're not completely broken. Use 'createCipheriv' or 'createDecipheriv' instead.", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-1204: Generation of Weak Initialization Vector (IV)" | |
| ], | |
| "category": "security", | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "technology": [ | |
| "node-crypto" | |
| ], | |
| "likelihood": "HIGH", | |
| "impact": "MEDIUM", | |
| "confidence": "HIGH", | |
| "references": [ | |
| "https://nodejs.org/api/crypto.html#cryptocreatecipheralgorithm-password-options", | |
| "https://nodejs.org/api/crypto.html#cryptocreatedecipheralgorithm-password-options" | |
| ], | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Other" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv", | |
| "shortlink": "https://sg.run/bw33r", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 146570, | |
| "rv_id": 945898, | |
| "rule_id": "X5UQRR7", | |
| "version_id": "ZRT3510", | |
| "url": "https://semgrep.dev/playground/r/ZRT3510/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "ERROR", | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "$CRYPTO.createCipher(...)\n" | |
| }, | |
| { | |
| "pattern": "$CRYPTO.createDecipher(...)\n" | |
| } | |
| ] | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length", | |
| "message": "The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be tricked into verifying a shorter-than-expected authentication tag. This can be abused by an attacker to spoof ciphertexts or recover the implicit authentication key of GCM, allowing arbitrary forgeries.", | |
| "metadata": { | |
| "cwe": [ | |
| "CWE-310: CWE CATEGORY: Cryptographic Issues" | |
| ], | |
| "owasp": [ | |
| "A02:2021 - Cryptographic Failures", | |
| "A04:2025 - Cryptographic Failures" | |
| ], | |
| "category": "security", | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "technology": [ | |
| "node-crypto" | |
| ], | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "references": [ | |
| "https://www.securesystems.de/blog/forging_ciphertexts_under_Galois_Counter_Mode_for_the_Node_js_crypto_module/", | |
| "https://nodejs.org/api/crypto.html#cryptocreatedecipherivalgorithm-key-iv-options", | |
| "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/" | |
| ], | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cryptographic Issues" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length", | |
| "shortlink": "https://sg.run/NbGG1", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 146571, | |
| "rv_id": 1263223, | |
| "rule_id": "j2UgPP3", | |
| "version_id": "pZT03qd", | |
| "url": "https://semgrep.dev/playground/r/pZT03qd/javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "severity": "ERROR", | |
| "patterns": [ | |
| { | |
| "pattern": "$CRYPTO.createDecipheriv('$ALGO', $KEY, $IV)\n" | |
| }, | |
| { | |
| "metavariable-regex": { | |
| "metavariable": "$ALGO", | |
| "regex": ".*(-gcm)$" | |
| } | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash", | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "window.intercomSettings = {..., email: $EMAIL, ...};\n" | |
| }, | |
| { | |
| "pattern": "window.intercomSettings = {..., user_id: $USER_ID, ...};\n" | |
| }, | |
| { | |
| "pattern": "Intercom('boot', {..., email: $EMAIL, ...});\n" | |
| }, | |
| { | |
| "pattern": "Intercom('boot', {..., user_id: $USER_ID, ...});\n" | |
| }, | |
| { | |
| "pattern": "$VAR = {..., email: $EMAIL, ...};\n...\nIntercom('boot', $VAR);\n" | |
| }, | |
| { | |
| "pattern": "$VAR = {..., user_id: $EMAIL, ...};\n...\nIntercom('boot', $VAR);\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "pattern-not": "window.intercomSettings = {..., user_hash: $USER_HASH, ...};\n" | |
| }, | |
| { | |
| "pattern-not": "Intercom('boot', {..., user_hash: $USER_HASH, ...});\n" | |
| }, | |
| { | |
| "pattern-not": "$VAR = {..., user_hash: $USER_HASH, ...};\n...\nIntercom('boot', $VAR);\n" | |
| } | |
| ], | |
| "message": "Found an initialization of the Intercom Messenger that identifies a User, but does not specify a `user_hash`. This configuration allows users to impersonate one another. See the Intercom Identity Verification docs for more context https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile", | |
| "languages": [ | |
| "js" | |
| ], | |
| "severity": "WARNING", | |
| "metadata": { | |
| "category": "security", | |
| "subcategory": [ | |
| "audit" | |
| ], | |
| "cwe": [ | |
| "CWE-287: Improper Authentication" | |
| ], | |
| "confidence": "MEDIUM", | |
| "likelihood": "MEDIUM", | |
| "impact": "HIGH", | |
| "technology": [ | |
| "intercom" | |
| ], | |
| "references": [ | |
| "https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile" | |
| ], | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Improper Authentication" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash", | |
| "shortlink": "https://sg.run/Eb5w", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 60237, | |
| "rv_id": 945842, | |
| "rule_id": "QrU96W", | |
| "version_id": "nWTpzDk", | |
| "url": "https://semgrep.dev/playground/r/nWTpzDk/javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash", | |
| "origin": "community" | |
| } | |
| } | |
| } | |
| }, | |
| { | |
| "id": "problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification", | |
| "message": "Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses verification against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability to MTM attacks, and should not be used.", | |
| "severity": "WARNING", | |
| "metadata": { | |
| "likelihood": "MEDIUM", | |
| "impact": "MEDIUM", | |
| "confidence": "MEDIUM", | |
| "category": "security", | |
| "cwe": "CWE-319: Cleartext Transmission of Sensitive Information", | |
| "owasp": "A03:2017 - Sensitive Data Exposure", | |
| "references": [ | |
| "https://nodejs.org/api/https.html#https_https_request_options_callback", | |
| "https://stackoverflow.com/questions/20433287/node-js-request-cert-has-expired#answer-29397100" | |
| ], | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "technology": [ | |
| "node.js" | |
| ], | |
| "vulnerability": "Insecure Transport", | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Mishandled Sensitive Information" | |
| ], | |
| "source": "https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification", | |
| "shortlink": "https://sg.run/9oxr", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 9423, | |
| "rv_id": 946067, | |
| "rule_id": "OrU3Y6", | |
| "version_id": "JdTDybO", | |
| "url": "https://semgrep.dev/playground/r/JdTDybO/problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "pattern-either": [ | |
| { | |
| "pattern": "process.env[\"NODE_TLS_REJECT_UNAUTHORIZED\"] = 0;\n" | |
| }, | |
| { | |
| "pattern": "{rejectUnauthorized:false}\n" | |
| } | |
| ] | |
| }, | |
| { | |
| "id": "javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify", | |
| "message": "Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` before using the token.", | |
| "severity": "ERROR", | |
| "metadata": { | |
| "owasp": [ | |
| "A05:2021 - Security Misconfiguration", | |
| "A07:2021 - Identification and Authentication Failures", | |
| "A02:2025 - Security Misconfiguration", | |
| "A07:2025 - Authentication Failures" | |
| ], | |
| "cwe": [ | |
| "CWE-287: Improper Authentication", | |
| "CWE-345: Insufficient Verification of Data Authenticity", | |
| "CWE-347: Improper Verification of Cryptographic Signature" | |
| ], | |
| "category": "security", | |
| "subcategory": [ | |
| "vuln" | |
| ], | |
| "technology": [ | |
| "jwt-simple", | |
| "jwt" | |
| ], | |
| "confidence": "HIGH", | |
| "likelihood": "MEDIUM", | |
| "impact": "HIGH", | |
| "references": [ | |
| "https://www.npmjs.com/package/jwt-simple", | |
| "https://cwe.mitre.org/data/definitions/287", | |
| "https://cwe.mitre.org/data/definitions/345", | |
| "https://cwe.mitre.org/data/definitions/347" | |
| ], | |
| "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license", | |
| "vulnerability_class": [ | |
| "Cryptographic Issues", | |
| "Improper Authentication" | |
| ], | |
| "source": "https://semgrep.dev/r/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify", | |
| "shortlink": "https://sg.run/zdjod", | |
| "semgrep.dev": { | |
| "rule": { | |
| "r_id": 120561, | |
| "rv_id": 1263191, | |
| "rule_id": "r6UyNLy", | |
| "version_id": "3ZT4Xxv", | |
| "url": "https://semgrep.dev/playground/r/3ZT4Xxv/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify", | |
| "origin": "community" | |
| } | |
| } | |
| }, | |
| "languages": [ | |
| "javascript", | |
| "typescript" | |
| ], | |
| "patterns": [ | |
| { | |
| "pattern-inside": "$JWT = require('jwt-simple');\n...\n" | |
| }, | |
| { | |
| "pattern": "$JWT.decode($TOKEN, $SECRET, $NOVERIFY, ...)" | |
| }, | |
| { | |
| "metavariable-pattern": { | |
| "metavariable": "$NOVERIFY", | |
| "patterns": [ | |
| { | |
| "pattern-either": [ | |
| { | |
| "pattern": "true\n" | |
| }, | |
| { | |
| "pattern": "\"...\"\n" | |
| } | |
| ] | |
| } | |
| ] | |
| } | |
| } | |
| ] | |
| } | |
| ], | |
| "missed": 242 | |
| } |