Skip to content

Commit 7312010

Browse files
ESS-ENNSakshis
ESS-ENN
and
Sakshis
authored
Remove Nested nthChild and if_statement Conditions and Rule Comments (#196)
* removed missing-secure-java * httponly-false-csharp * use-of-md5-digest-utils-java * removing use-of-md5-digest-utils and httponly-false-csharp * Update file-access-before-action-c rule file * Added ast-grep-essentials: true key to all rules not having this key-value pair --------- Co-authored-by: Sakshis <sakshil@abc.com>
1 parent 0c28058 commit 7312010

File tree

59 files changed

+2323
-2354
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

59 files changed

+2323
-2354
lines changed

‎rules/c/security/file-access-before-action-c.yml

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -25,15 +25,10 @@ utils:
2525
inside:
2626
stopBy: end
2727
kind: parenthesized_expression
28-
nthChild: 1
29-
inside:
30-
stopBy: end
31-
kind: if_statement
3228
inside:
3329
stopBy: end
3430
kind: compound_statement
3531
inside:
36-
stopBy: end
3732
kind: if_statement
3833
has:
3934
kind: parenthesized_expression
@@ -119,14 +114,10 @@ utils:
119114
inside:
120115
stopBy: end
121116
kind: parenthesized_expression
122-
inside:
123-
stopBy: end
124-
kind: if_statement
125117
inside:
126118
stopBy: end
127119
kind: compound_statement
128120
inside:
129-
stopBy: end
130121
kind: if_statement
131122
has:
132123
kind: parenthesized_expression

‎rules/c/security/sizeof-this-c.yml

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,13 @@ id: sizeof-this-c
22
language: c
33
severity: warning
44
message: >-
5-
Do not use `sizeof(this)` to get the number of bytes of the object in
6-
memory. It returns the size of the pointer, not the size of the object.
5+
Do not use `sizeof(this)` to get the number of bytes of the object in
6+
memory. It returns the size of the pointer, not the size of the object.
77
note: >-
88
[CWE-467]: Use of sizeof() on a Pointer Type
99
[REFERENCES]
1010
- https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array
11-
11+
ast-grep-essentials: true
1212
rule:
1313
not:
1414
has:
@@ -40,7 +40,7 @@ rule:
4040
has:
4141
kind: function_declarator
4242
nthChild: 1
43-
43+
4444
- kind: function_declarator
4545
all:
4646
- has:
@@ -65,7 +65,7 @@ rule:
6565
# - not:
6666
# inside:
6767
# has:
68-
# nthChild: 1
68+
# nthChild: 1
6969

7070
- kind: parameter_declaration
7171
all:
@@ -87,25 +87,25 @@ rule:
8787
- has:
8888
kind: abstract_parenthesized_declarator
8989
not:
90-
has:
91-
stopBy: end
92-
nthChild: 2
90+
has:
91+
stopBy: end
92+
nthChild: 2
9393
has:
9494
stopBy: end
9595
kind: parameter_list
9696
has:
9797
kind: parameter_declaration
98-
pattern: $THIS
98+
pattern: $THIS
9999

100100
- kind: sizeof_expression
101101
not:
102-
has:
102+
has:
103103
any:
104104
- nthChild: 2
105105
- kind: parameter_declaration
106106
has:
107107
stopBy: end
108-
kind: identifier
108+
kind: identifier
109109
pattern: $THIS
110110

111111
- kind: type_descriptor
@@ -121,7 +121,7 @@ rule:
121121
not:
122122
has:
123123
stopBy: end
124-
nthChild: 2
124+
nthChild: 2
125125
has:
126126
kind: parameter_declaration
127127
pattern: $THIS

‎rules/cpp/security/sizeof-this-cpp.yml

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ note: >-
88
[CWE-467]: Use of sizeof() on a Pointer Type
99
[REFERENCES]
1010
- https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array
11+
ast-grep-essentials: true
1112
utils:
1213
match_sizeof_this:
1314
kind: sizeof_expression
@@ -27,18 +28,16 @@ utils:
2728
kind: function_definition
2829

2930
rule:
30-
kind: sizeof_expression
31-
all:
32-
- has:
31+
kind: sizeof_expression
32+
all:
33+
- has:
3334
stopBy: end
3435
kind: this
35-
- not:
36-
has:
37-
stopBy: end
38-
any:
39-
- nthChild: 2
40-
- kind: pointer_expression
41-
- kind: ERROR
42-
- kind: sizeof_expression
43-
44-
36+
- not:
37+
has:
38+
stopBy: end
39+
any:
40+
- nthChild: 2
41+
- kind: pointer_expression
42+
- kind: ERROR
43+
- kind: sizeof_expression

‎rules/go/security/avoid-bind-to-all-interfaces-go.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ note: >-
1111
[REFERENCES]
1212
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
1313
14+
ast-grep-essentials: true
15+
1416
rule:
1517
not:
1618
has:
@@ -27,4 +29,3 @@ constraints:
2729
regex: ^"0.0.0.0:.*"$|^":.*"$|^'0.0.0.0:.*'$|^':.*'$
2830
- kind: raw_string_literal
2931
regex: ^`0.0.0.0:.*`$|^`:.*`$
30-

‎rules/java/security/cbc-padding-oracle-java.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ note: >-
1010
[CWE-327] Use of a Broken or Risky Cryptographic Algorithm.
1111
[REFERENCES]
1212
- https://capec.mitre.org/data/definitions/463.html
13+
ast-grep-essentials: true
1314
rule:
1415
pattern: Cipher.getInstance($MODE)
1516
constraints:

‎rules/java/security/cookie-httponly-false-java.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,5 +9,6 @@ note: >-
99
[CWE-1004] Sensitive Cookie Without 'HttpOnly' Flag.
1010
[REFERENCES]
1111
- https://capec.mitre.org/data/definitions/463.html
12+
ast-grep-essentials: true
1213
rule:
1314
pattern: $COOKIE.setHttpOnly(false);

‎rules/java/security/cookie-missing-httponly-java.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ note: >-
1010
[CWE-1004] Sensitive Cookie Without 'HttpOnly' Flag.
1111
[REFERENCES]
1212
- https://owasp.org/www-community/HttpOnly
13+
ast-grep-essentials: true
1314
rule:
1415
pattern: $RESPONSE.addCookie($COOKIE);
1516
all:

‎rules/java/security/cookie-missing-samesite-java.yml

Lines changed: 19 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,14 @@ note: >-
1818
[CWE-352] Cross-Site Request Forgery (CSRF).
1919
[REFERENCES]
2020
- https://stackoverflow.com/questions/42717210/samesite-cookie-in-java-application
21+
ast-grep-essentials: true
2122
rule:
2223
any:
2324
- pattern: $RESP.setHeader("Set-Cookie", $T);
2425
inside:
2526
stopBy: end
26-
kind: block
27-
follows:
27+
kind: block
28+
follows:
2829
stopBy: end
2930
kind: formal_parameters
3031
has:
@@ -34,7 +35,7 @@ rule:
3435
- has:
3536
stopBy: end
3637
kind: type_identifier
37-
regex: '^HttpServletResponse$'
38+
regex: "^HttpServletResponse$"
3839
- has:
3940
stopBy: neighbor
4041
kind: identifier
@@ -45,22 +46,22 @@ rule:
4546
kind: expression_statement
4647
pattern: $RESP.setHeader("Set-Cookie", $T);
4748
inside:
48-
stopBy: end
49-
kind: block
50-
follows:
51-
stopBy: end
52-
kind: formal_parameters
53-
has:
49+
stopBy: end
50+
kind: block
51+
follows:
5452
stopBy: end
55-
kind: formal_parameter
56-
all:
57-
- has:
58-
stopBy: end
59-
kind: type_identifier
60-
regex: '^HttpServletResponse$'
61-
- has:
62-
stopBy: neighbor
63-
kind: identifier
53+
kind: formal_parameters
54+
has:
55+
stopBy: end
56+
kind: formal_parameter
57+
all:
58+
- has:
59+
stopBy: end
60+
kind: type_identifier
61+
regex: "^HttpServletResponse$"
62+
- has:
63+
stopBy: neighbor
64+
kind: identifier
6465
- pattern: $RESP.setHeader("Set-Cookie");
6566
constraints:
6667
T:

‎rules/java/security/cookie-missing-secure-flag-java.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ note: >-
1010
[CWE-614] Sensitive Cookie in HTTPS Session Without 'Secure' Attribute.
1111
[REFERENCES]
1212
- https://owasp.org/www-community/controls/SecureCookieAttribute
13+
ast-grep-essentials: true
1314
utils:
1415
MATCH_RESPONSE_COOKIE_STATEMENT:
1516
kind: expression_statement

‎rules/java/security/cookie-secure-flag-false-java.yml

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,14 @@ id: cookie-secure-flag-false-java
22
language: java
33
severity: warning
44
message: >-
5-
A cookie was detected without setting the 'secure' flag. The 'secure'
6-
flag for cookies prevents the client from transmitting the cookie over
7-
insecure channels such as HTTP. Set the 'secure' flag by calling
8-
'$COOKIE.setSecure(true);'.
5+
A cookie was detected without setting the 'secure' flag. The 'secure'
6+
flag for cookies prevents the client from transmitting the cookie over
7+
insecure channels such as HTTP. Set the 'secure' flag by calling
8+
'$COOKIE.setSecure(true);'.
99
note: >-
1010
[CWE-614] Sensitive Cookie in HTTPS Session Without 'Secure' Attribute.
1111
[REFERENCES]
1212
- https://owasp.org/www-community/controls/SecureCookieAttribute
13+
ast-grep-essentials: true
1314
rule:
14-
pattern: $COOKIE.setSecure(false);
15+
pattern: $COOKIE.setSecure(false);

‎rules/java/security/des-is-deprecated-java.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,9 @@ note: >-
99
[CWE-326] Inadequate Encryption Strength.
1010
[REFERENCES]
1111
- https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard
12+
ast-grep-essentials: true
1213
rule:
1314
pattern: $CIPHER.getInstance($SAS)
14-
constraints:
15+
constraints:
1516
SAS:
1617
regex: ^".*/DES/.*"|"DES"|"DES/.*"$

‎rules/java/security/documentbuilderfactory-disallow-doctype-decl-false-java.yml

Lines changed: 19 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,22 @@ id: documentbuilderfactory-disallow-doctype-decl-false-java
22
language: java
33
severity: warning
44
message: >-
5-
DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting
6-
external entity declarations, this is vulnerable to XML external entity
7-
attacks. Disable this by setting the feature
8-
"http://apache.org/xml/features/disallow-doctype-decl" to true.
9-
Alternatively, allow DOCTYPE declarations and only prohibit external
10-
entities declarations. This can be done by setting the features
11-
"http://xml.org/sax/features/external-general-entities" and
12-
"http://xml.org/sax/features/external-parameter-entities" to false.
5+
DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting
6+
external entity declarations, this is vulnerable to XML external entity
7+
attacks. Disable this by setting the feature
8+
"http://apache.org/xml/features/disallow-doctype-decl" to true.
9+
Alternatively, allow DOCTYPE declarations and only prohibit external
10+
entities declarations. This can be done by setting the features
11+
"http://xml.org/sax/features/external-general-entities" and
12+
"http://xml.org/sax/features/external-parameter-entities" to false.
1313
note: >-
1414
[CWE-611]: mproper Restriction of XML External Entity Reference
1515
[OWASP A04:2017]: XML External Entities (XXE)
1616
[OWASP A05:2021 - Security Misconfiguration]
1717
[REFERENCES]
1818
https://blog.sonarsource.com/secure-xml-processor
1919
https://xerces.apache.org/xerces2-j/features.html
20+
ast-grep-essentials: true
2021
utils:
2122
match_expression_statement:
2223
kind: expression_statement
@@ -25,22 +26,22 @@ utils:
2526
kind: method_invocation
2627
all:
2728
- has:
28-
stopBy: end
29-
kind: identifier
29+
stopBy: end
30+
kind: identifier
3031
- has:
31-
stopBy: end
32-
kind: identifier
33-
regex: '^setFeature$'
32+
stopBy: end
33+
kind: identifier
34+
regex: "^setFeature$"
3435
has:
3536
kind: argument_list
3637
all:
3738
- has:
38-
stopBy: end
39-
kind: string_literal
40-
regex: 'http://apache.org/xml/features/disallow-doctype-decl'
39+
stopBy: end
40+
kind: string_literal
41+
regex: "http://apache.org/xml/features/disallow-doctype-decl"
4142
- has:
42-
stopBy: end
43-
regex: '^false$'
43+
stopBy: end
44+
regex: "^false$"
4445
rule:
4546
any:
4647
- matches: match_expression_statement

‎rules/java/security/rsa-no-padding-java.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,9 @@ note: >-
77
[CWE-326] Inadequate Encryption Strength
88
[REFERENCES]
99
- https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/
10+
ast-grep-essentials: true
1011
rule:
1112
pattern: $YST.getInstance($MODE)
1213
constraints:
1314
MODE:
14-
regex: 'RSA/[Nn][Oo][Nn][Ee]/NoPadding'
15+
regex: "RSA/[Nn][Oo][Nn][Ee]/NoPadding"

‎rules/java/security/simple-command-injection-direct-input-java.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ note: >-
1616
[REFERENCES]
1717
- https://docs.oracle.com/javase/8/docs/api/java/lang/Runtime.html
1818
- https://owasp.org/Top10/A03_2021-Injection
19-
19+
ast-grep-essentials: true
2020
rule:
2121
kind: method_invocation
2222
pattern: Runtime.getRuntime().exec($SOURCE)

0 commit comments

Comments
 (0)