Skip to content

Commit 88d9b5c

Browse files
ESS-ENNESS-ENN
authored
Revert "Removing all rules except those tested on live pipeline (#61)"
This reverts commit 30448e0.
1 parent 30448e0 commit 88d9b5c

14 files changed

+173
-65
lines changed

‎d

Lines changed: 0 additions & 65 deletions
This file was deleted.

‎rules/c/security/info-leak-on-non-formated-string.yml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
id: info-leak-on-non-formated-string
2+
language: c
3+
severity: warning
4+
message: >-
5+
Information leak on non-formatted string detected. This can lead to security
6+
vulnerabilities. Use formatted strings to prevent information leaks.
7+
note: >-
8+
[CWE-532] Insertion of Sensitive Information into Log File
9+
[OWASP A09:2021] Security Logging and Monitoring Failures
10+
[REFERENCES]
11+
- http://nebelwelt.net/files/13PPREW.pdf
12+
rule:
13+
pattern: 'printf($A);'

‎rules/c/security/insecure-use-gets-function.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
id: insecure-use-gets-function
2+
language: c
3+
message: >-
4+
Avoid 'gets()' function, it does not consider buffer boundaries and can lead
5+
to buffer overflows. Use 'fgets()' or 'gets_s()' instead.
6+
note: >-
7+
[CWE-676] Use of Potentially Dangerous Function
8+
[REFERENCES]
9+
- https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s
10+
severity: warning
11+
rule:
12+
pattern: gets($$$);

‎rules/c/security/insecure-use-memset.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
id: insecure-use-memset-function
2+
language: c
3+
message: >-
4+
Avoid 'memset()' function, it does not consider buffer boundaries and can lead
5+
to buffer overflows. Use 'memset_s()' instead.
6+
severity: warning
7+
note: >-
8+
[CWE-14]: Compiler Removal of Code to Clear Buffers
9+
[OWASP A04:2021] Insecure Design
10+
[REFERENCES]
11+
- https://cwe.mitre.org/data/definitions/14.html
12+
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures/
13+
rule:
14+
pattern: memset($$$);

‎rules/c/security/insecure-use-scanf-function.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
id: insecure-use-scanf-function
2+
language: c
3+
message: >-
4+
Avoid 'scanf()' function, it does not consider buffer boundaries and can lead
5+
to buffer overflows. Use 'fgets()' or 'scanf_s()' instead.
6+
severity: warning
7+
note: >-
8+
[CWE-676]: Use of Potentially Dangerous Function
9+
[REFERENCES]
10+
- http://sekrit.de/webdocs/c/beginners-guide-away-from-scanf.html
11+
rule:
12+
pattern: scanf($$$);

‎rules/c/security/insecure-use-strcat-function.yml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
id: insecure-use-strcat-function
2+
language: c
3+
message: >-
4+
Avoid 'strcat()' or 'strncat()' functions, it does not consider buffer boundaries and can lead
5+
to buffer overflows. Use 'strcat_s()' instead.
6+
severity: warning
7+
note: >-
8+
[CWE-676]: Use of Potentially Dangerous Function
9+
[REFERENCES]
10+
- https://nvd.nist.gov/vuln/detail/CVE-2019-12553
11+
- https://techblog.mediaservice.net/2020/04/cve-2020-2851-stack-based-buffer-overflow-in-cde-libdtsvc/
12+
rule:
13+
any:
14+
- pattern: strcat($$$);
15+
- pattern: strncat($$$);

‎rules/c/security/insecure-use-string-copy-function.yml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
id: insecure-use-string-copy-function
2+
language: c
3+
severity: warning
4+
message: >-
5+
Avoid 'strcpy()' or 'strncpy()' function, it does not consider buffer boundaries and can lead
6+
to buffer overflows. Use 'strcpy_s()' instead.
7+
note: >-
8+
[CWE-676]: Use of Potentially Dangerous Function
9+
[REFERENCES]
10+
- https://cwe.mitre.org/data/definitions/676
11+
- https://nvd.nist.gov/vuln/detail/CVE-2019-11365
12+
rule:
13+
any:
14+
- pattern: strcpy($$$);
15+
- pattern: strncpy($$$);

‎rules/c/security/insecure-use-strtok-function.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
id: insecure-use-strtok-function
2+
language: c
3+
severity: warning
4+
message: >-
5+
Avoid 'strtok()' function, it is not reentrant and can lead to security
6+
vulnerabilities. Use 'strtok_r()' instead.
7+
note: >-
8+
[CWE-676]: Use of Potentially Dangerous Function
9+
[REFERENCES]
10+
- https://wiki.sei.cmu.edu/confluence/display/c/STR06-C.+Do+not+assume+that+strtok%28%29+leaves+the+parse+string+unchanged
11+
rule:
12+
pattern: strtok($$$);

‎rules/csharp/security/binary-formatter.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
id: binary-formatter
2+
language: csharp
3+
message: 'Avoid using BinaryFormatter, it is insecure and can lead to remote code execution'
4+
severity: warning
5+
note: >-
6+
[CWE-502]: Deserialization of Untrusted Data
7+
[OWASP A08:2017]: Insecure Deserialization
8+
[OWASP A08:2021]: Software and Data Integrity Failures
9+
[REFERENCES]
10+
- https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide
11+
rule:
12+
pattern: new BinaryFormatter()

‎rules/csharp/security/data-contract-resolver.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
id: data-contract-resolver
2+
language: csharp
3+
note: >-
4+
[CWE-502]: Deserialization of Untrusted Data
5+
[OWASP A08:2017]: Insecure Deserialization
6+
[OWASP A08:2021]: Software and Data Integrity Failures
7+
[REFERENCES]
8+
- https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide
9+
message: >-
10+
Use DataContractResolver if you are sure that the data is safe to deserialize.
11+
severity: warning
12+
rule:
13+
pattern: |
14+
class $DCR : DataContractResolver { $$$ }

‎rules/csharp/security/html-raw-json.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
id: html-raw-json
2+
language: csharp
3+
message: >-
4+
Avoid using '@Html.Raw(Json.Encode())', '@Html.Raw(JsonConvert.SerializeObject())' or '@Html.Raw().ToJson()' to prevent Cross-Site Scripting (XSS) attacks.
5+
Use '@Html.Raw()' only when necessary and ensure that the data is properly sanitized.
6+
For more information checkout the references.
7+
note: >-
8+
[CWE-79]: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
9+
[OWASP Top 10 2017]: A07:2017 - Cross-Site Scripting (XSS)
10+
[OWASP Top 10 2021]: A03:2021 - Injection
11+
[REFERENCES]
12+
- https://owasp.org/Top10/A03_2021-Injection
13+
severity: warning
14+
rule:
15+
any:
16+
- pattern: '@Html.Raw(Json.Encode($$$))'
17+
- pattern: '@Html.Raw(JsonConvert.SerializeObject($$$))'
18+
- pattern: '@Html.Raw($$$ToJson($$$))'

‎rules/csharp/security/insecure-fspickler-deserialization.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
id: insecure-fspickler-deserialization
2+
severity: warning
3+
language: csharp
4+
message: Avoid using FSPickler, it is insecure and can lead to remote code execution
5+
note: >-
6+
[CWE-502]: Deserialization of Untrusted Data
7+
[OWASP A08:2017]: Insecure Deserialization
8+
[OWASP A08:2021]: Software and Data Integrity Failures
9+
[REFERENCES]
10+
- https://mbraceproject.github.io/FsPickler/tutorial.html#Disabling-Subtype-Resolution
11+
rule:
12+
pattern: FsPickler.CreateJsonSerializer()

‎rules/csharp/security/insecure-netdatacontract-deserialization.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
id: insecure-netdatacontract-deserialization
2+
severity: warning
3+
language: csharp
4+
message: Avoid using NetDataContractSerializer, it is insecure and can lead to remote code execution
5+
note: >-
6+
[CWE-502]: Deserialization of Untrusted Data
7+
[OWASP A08:2017]: Insecure Deserialization
8+
[OWASP A08:2021]: Software and Data Integrity Failures
9+
[REFERENCES]
10+
- https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.netdatacontractserializer?view=netframework-4.8
11+
rule:
12+
pattern: new NetDataContractSerializer()

‎rules/csharp/security/los-formatter.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
id: los-formatter
2+
language: csharp
3+
message: 'Avoid using LosFormatter, it is insecure and can lead to remote code execution'
4+
severity: warning
5+
note: >-
6+
[CWE-502]: Deserialization of Untrusted Data
7+
[OWASP A08:2017]: Insecure Deserialization
8+
[OWASP A08:2021]: Software and Data Integrity Failures
9+
[REFERENCES]
10+
- https://docs.microsoft.com/en-us/dotnet/api/system.web.ui.webcontrols.losformatter?view=netframework-4.8
11+
rule:
12+
pattern: new LosFormatter()

0 commit comments

Comments
 (0)