Skip to content

Commit 167fa50

Browse files
ESS-ENNESS-ENN
authored
Merge branch 'main' into rules_131-133
2 parents 7c738b8 + 318a90a commit 167fa50

File tree

80 files changed

+7112
-1
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

80 files changed

+7112
-1
lines changed

‎package-lock.json

Lines changed: 8 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,6 @@
1212
"author": "",
1313
"license": "ISC",
1414
"devDependencies": {
15-
"@ast-grep/cli": "^0.30.1"
15+
"@ast-grep/cli": "^0.31.1"
1616
}
1717
}

‎rules/java/security/cookie-httponly-false-java.yml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
id: cookie-httponly-false-java
2+
language: java
3+
message: >-
4+
A cookie was detected without setting the 'HttpOnly' flag. The
5+
'HttpOnly' flag for cookies instructs the browser to forbid client-side
6+
scripts from reading the cookie. Set the 'HttpOnly' flag by calling
7+
'cookie.setHttpOnly(true);'
8+
note: >-
9+
[CWE-1004] Sensitive Cookie Without 'HttpOnly' Flag.
10+
[REFERENCES]
11+
- https://capec.mitre.org/data/definitions/463.html
12+
rule:
13+
pattern: $COOKIE.setHttpOnly(false);

‎rules/java/security/cookie-missing-samesite-java.yml

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
id: cookie-missing-samesite-java
2+
severity: warning
3+
language: java
4+
message: >-
5+
The application does not appear to verify inbound requests which can
6+
lead to a Cross-site request forgery (CSRF) vulnerability. If the
7+
application uses cookie-based authentication, an attacker can trick users
8+
into sending authenticated HTTP requests without their knowledge from any
9+
arbitrary domain they visit. To prevent this vulnerability start by
10+
identifying if the framework or library leveraged has built-in features or
11+
offers plugins for CSRF protection. CSRF tokens should be unique and
12+
securely random. The `Synchronizer Token` or `Double Submit Cookie`
13+
patterns with defense-in-depth mechanisms such as the `sameSite` cookie
14+
flag can help prevent CSRF. For more information, see: [Cross-site request
15+
forgery prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Req\
16+
uest_Forgery_Prevention_Cheat_Sheet.html).
17+
note: >-
18+
[CWE-352] Cross-Site Request Forgery (CSRF).
19+
[REFERENCES]
20+
- https://stackoverflow.com/questions/42717210/samesite-cookie-in-java-application
21+
rule:
22+
any:
23+
- pattern: $RESP.setHeader("Set-Cookie", $T);
24+
inside:
25+
stopBy: end
26+
kind: block
27+
follows:
28+
stopBy: end
29+
kind: formal_parameters
30+
has:
31+
stopBy: end
32+
kind: formal_parameter
33+
all:
34+
- has:
35+
stopBy: end
36+
kind: type_identifier
37+
regex: '^HttpServletResponse$'
38+
- has:
39+
stopBy: neighbor
40+
kind: identifier
41+
- pattern: $RESP.addCookie($$$);
42+
not:
43+
follows:
44+
stopBy: end
45+
kind: expression_statement
46+
pattern: $RESP.setHeader("Set-Cookie", $T);
47+
inside:
48+
stopBy: end
49+
kind: block
50+
follows:
51+
stopBy: end
52+
kind: formal_parameters
53+
has:
54+
stopBy: end
55+
kind: formal_parameter
56+
all:
57+
- has:
58+
stopBy: end
59+
kind: type_identifier
60+
regex: '^HttpServletResponse$'
61+
- has:
62+
stopBy: neighbor
63+
kind: identifier
64+
- pattern: $RESP.setHeader("Set-Cookie");
65+
constraints:
66+
T:
67+
not:
68+
regex: ".*SameSite=.*"

‎rules/java/security/cookie-secure-flag-false-java.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
id: cookie-secure-flag-false-java
2+
language: java
3+
severity: warning
4+
message: >-
5+
A cookie was detected without setting the 'secure' flag. The 'secure'
6+
flag for cookies prevents the client from transmitting the cookie over
7+
insecure channels such as HTTP. Set the 'secure' flag by calling
8+
'$COOKIE.setSecure(true);'.
9+
note: >-
10+
[CWE-614] Sensitive Cookie in HTTPS Session Without 'Secure' Attribute.
11+
[REFERENCES]
12+
- https://owasp.org/www-community/controls/SecureCookieAttribute
13+
rule:
14+
pattern: $COOKIE.setSecure(false);

‎rules/java/security/documentbuilderfactory-disallow-doctype-decl-false-java.yml

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
id: documentbuilderfactory-disallow-doctype-decl-false-java
2+
language: java
3+
severity: warning
4+
message: >-
5+
DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting
6+
external entity declarations, this is vulnerable to XML external entity
7+
attacks. Disable this by setting the feature
8+
"http://apache.org/xml/features/disallow-doctype-decl" to true.
9+
Alternatively, allow DOCTYPE declarations and only prohibit external
10+
entities declarations. This can be done by setting the features
11+
"http://xml.org/sax/features/external-general-entities" and
12+
"http://xml.org/sax/features/external-parameter-entities" to false.
13+
note: >-
14+
[CWE-611]: mproper Restriction of XML External Entity Reference
15+
[OWASP A04:2017]: XML External Entities (XXE)
16+
[OWASP A05:2021 - Security Misconfiguration]
17+
[REFERENCES]
18+
https://blog.sonarsource.com/secure-xml-processor
19+
https://xerces.apache.org/xerces2-j/features.html
20+
utils:
21+
match_expression_statement:
22+
kind: expression_statement
23+
has:
24+
stopBy: end
25+
kind: method_invocation
26+
all:
27+
- has:
28+
stopBy: end
29+
kind: identifier
30+
- has:
31+
stopBy: end
32+
kind: identifier
33+
regex: '^setFeature$'
34+
has:
35+
kind: argument_list
36+
all:
37+
- has:
38+
stopBy: end
39+
kind: string_literal
40+
regex: 'http://apache.org/xml/features/disallow-doctype-decl'
41+
- has:
42+
stopBy: end
43+
regex: '^false$'
44+
rule:
45+
any:
46+
- matches: match_expression_statement

‎rules/java/security/simple-command-injection-direct-input-java.yml

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
id: simple-command-injection-direct-input-java
2+
language: java
3+
severity: warning
4+
message: >-
5+
"Untrusted input might be injected into a command executed by the
6+
application, which can lead to a command injection vulnerability. An
7+
attacker can execute arbitrary commands, potentially gaining complete
8+
control of the system. To prevent this vulnerability, avoid executing OS
9+
commands with user input. If this is unavoidable, validate and sanitize
10+
the input, and use safe methods for executing the commands. For more
11+
information, see: [Java command injection
12+
prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/\
13+
)"
14+
note: >-
15+
[CWE-78] Improper Neutralization of Special Elements used in an OS
16+
[REFERENCES]
17+
- https://docs.oracle.com/javase/8/docs/api/java/lang/Runtime.html
18+
- https://owasp.org/Top10/A03_2021-Injection
19+
20+
rule:
21+
kind: method_invocation
22+
pattern: Runtime.getRuntime().exec($SOURCE)
23+
inside:
24+
kind: method_declaration
25+
stopBy: end
26+
has:
27+
stopBy: end
28+
kind: formal_parameter
29+
has:
30+
kind: modifiers
31+
any:
32+
- has:
33+
kind: marker_annotation
34+
has:
35+
kind: identifier
36+
pattern: $REQ
37+
- has:
38+
kind: annotation
39+
all:
40+
- has:
41+
kind: identifier
42+
pattern: $REQ
43+
- has:
44+
kind: annotation_argument_list
45+
precedes:
46+
kind: type_identifier
47+
pattern: $TYPE
48+
precedes:
49+
kind: identifier
50+
pattern: $SOURCE
51+
52+
constraints:
53+
REQ:
54+
regex: ^(RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute)
55+
TYPE:
56+
regex: ^[^I].*|^I[^n].*|^In[^t].*|^Int[^e].*|^Inte[^g].*|^Integ[^e].*|^Inge[^r].*|^L[^o].*|^Lo[^n].*|^Lon[^g].*|^F[^l].*|^Fl[^o].*|^Flo[^a].*|^Floa[^t].*|^D[^o].*|^Do[^u].*|^Dou[^b].*|^Doub[^l].*|^Doubl[^e].*|^C[^h].*|^Ch[^a].*|^Cha[^r].*|^B[^o].*|^Bo[^o].*|^Boo[^l].*|^Bool[^e].*|^Boole[^a].*|^Boolea[^n].*|^i[^n].*|^in[^t].*|^l[^o].*|^lo[^n].*|^lon[^g].*|^f[^l].*|^fl[^o].*|^flo[^a].*|^floa[^t].*|^d[^o].*|^do[^u].*|^dou[^b].*|^doub[^l].*|^doubl[^e].*|^c[^h].*|^ch[^a].*|^cha[^r].*|^b[^o].*|^bo[^o].*|^boo[^l].*|^bool[^e].*|^boole[^a].*|^boolea[^n].*

‎rules/javascript/security/detect-angular-sce-disabled-javascript.yml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
id: detect-angular-sce-disabled-javascript
2+
language: javascript
3+
severity: warning
4+
message: >-
5+
$sceProvider is set to false. Disabling Strict Contextual escaping
6+
(SCE) in an AngularJS application could provide additional attack surface
7+
for XSS vulnerabilities.
8+
note: >-
9+
[CWE-79] Improper Neutralization of Input During Web Page Generation.
10+
[REFERENCES]
11+
- https://docs.angularjs.org/api/ng/service/$sce
12+
- https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
13+
rule:
14+
pattern: |
15+
$sceProvider.enabled(false);

0 commit comments

Comments
 (0)