Skip to content

Commit 5c87db3

Browse files
ESS-ENNESS-ENN
authored
Update ast-grep CLI & add Java cookie management rules
1 parent aa2c433 commit 5c87db3

12 files changed

+134
-38
lines changed

‎package-lock.json

Lines changed: 32 additions & 32 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,6 @@
1212
"author": "",
1313
"license": "ISC",
1414
"devDependencies": {
15-
"@ast-grep/cli": "^0.20.2"
15+
"@ast-grep/cli": "^0.26.0"
1616
}
17-
}
17+
}

‎rules/java/security/cookie-secure-flag-false-java.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
id: cookie-secure-flag-false-java
2+
language: java
3+
severity: warning
4+
message: >-
5+
A cookie was detected without setting the 'secure' flag. The 'secure'
6+
flag for cookies prevents the client from transmitting the cookie over
7+
insecure channels such as HTTP. Set the 'secure' flag by calling
8+
'$COOKIE.setSecure(true);'.
9+
note: >-
10+
[CWE-614] Sensitive Cookie in HTTPS Session Without 'Secure' Attribute.
11+
[REFERENCES]
12+
- https://owasp.org/www-community/controls/SecureCookieAttribute
13+
rule:
14+
pattern: $COOKIE.setSecure(false);

‎rules/java/security/documentbuilderfactory-external-general-entities-true-java.yml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
id: documentbuilderfactory-external-general-entities-true-java
2+
language: java
3+
severity: warning
4+
message: >-
5+
External entities are allowed for $DBFACTORY. This is vulnerable to XML
6+
external entity attacks. Disable this by setting the feature
7+
"http://xml.org/sax/features/external-general-entities" to false.
8+
note: >-
9+
[CWE-798]: Use of Hard-coded Credentials
10+
[OWASP A07:2021]: Identification and Authentication Failures
11+
[REFERENCES]
12+
- https://blog.sonarsource.com/secure-xml-processor
13+
rule:
14+
pattern:
15+
$DBFACTORY.setFeature("http://xml.org/sax/features/external-general-entities",
16+
true);

‎rules/java/security/use-of-rc2-java.yml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
id: use-of-rc2-java
2+
language: java
3+
severity: warning
4+
message: >-
5+
Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and
6+
is therefore considered non-compliant. Instead, use a strong, secure.
7+
note: >-
8+
[CWE-327] Use of a Broken or Risky Cryptographic Algorithm.
9+
[REFERENCES]
10+
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
11+
- https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html
12+
rule:
13+
pattern: $CIPHER.getInstance("RC2")

‎rules/scala/security/xmlinputfactory-dtd-enabled-scala.yml

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,4 @@ rule:
1919
- pattern: new XMLInputFactory($$$)
2020
precedes:
2121
not:
22-
pattern: $XMLFACTORY.setProperty($MODE, false)
23-
constraints:
24-
MODE:
25-
regex: "javax.xml.stream.isSupportingExternalEntities"
22+
pattern: $XMLFACTORY.setProperty(javax.xml.stream.isSupportingExternalEntities, false)

‎tests/__snapshots__/cookie-secure-flag-false-java-snapshot.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
id: cookie-secure-flag-false-java
2+
snapshots:
3+
? |
4+
cookie.setSecure(false);
5+
: labels:
6+
- source: cookie.setSecure(false);
7+
style: primary
8+
start: 0
9+
end: 24

‎tests/__snapshots__/documentbuilderfactory-external-general-entities-true-java-snapshot.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
id: documentbuilderfactory-external-general-entities-true-java
2+
snapshots:
3+
? |
4+
dbf.setFeature("http://xml.org/sax/features/external-general-entities" , true);
5+
spf.setFeature("http://xml.org/sax/features/external-general-entities" , true);
6+
: labels:
7+
- source: dbf.setFeature("http://xml.org/sax/features/external-general-entities" , true);
8+
style: primary
9+
start: 0
10+
end: 79

‎tests/__snapshots__/use-of-rc2-java-snapshot.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
id: use-of-rc2-java
2+
snapshots:
3+
? |
4+
useCipher(Cipher.getInstance("RC2"));
5+
Cipher.getInstance("RC2");
6+
: labels:
7+
- source: Cipher.getInstance("RC2")
8+
style: primary
9+
start: 10
10+
end: 35

‎tests/java/cookie-secure-flag-false-java-test.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
id: cookie-secure-flag-false-java
2+
valid:
3+
- |
4+
response.addCookie(cookie);
5+
cookie.setSecure(true);
6+
cookie.setHttpOnly(true);
7+
response.addCookie(cookie);
8+
invalid:
9+
- |
10+
cookie.setSecure(false);

‎tests/java/documentbuilderfactory-external-general-entities-true-java-test.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
id: documentbuilderfactory-external-general-entities-true-java
2+
valid:
3+
- |
4+
dbf.setFeature("http://xml.org/sax/features/external-general-entities" , false);
5+
spf.setFeature("http://xml.org/sax/features/external-general-entities" , false);
6+
invalid:
7+
- |
8+
dbf.setFeature("http://xml.org/sax/features/external-general-entities" , true);
9+
spf.setFeature("http://xml.org/sax/features/external-general-entities" , true);

‎tests/java/use-of-rc2-java-test.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
id: use-of-rc2-java
2+
valid:
3+
- |
4+
Cipher.getInstance("AES/CBC/PKCS7PADDING");
5+
invalid:
6+
- |
7+
useCipher(Cipher.getInstance("RC2"));
8+
Cipher.getInstance("RC2");

0 commit comments

Comments
 (0)