Skip to content

Add Security Rules for Vulnerability Detection in JavaScript and Java Applications #72

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Dec 17, 2024
Merged

Add Security Rules for Vulnerability Detection in JavaScript and Java Applications #72

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
cd340c9
simple-command-injection-direct-input-java
Dec 4, 2024
e511a4f
node-sequelize-empty-password-argument-javascript
Dec 5, 2024
3373af5
detect-angular-sce-disabled-javascript
Dec 5, 2024
83fa3ba
SEPARATING FOLDER node-sequelize-empty-password-argument-javascript
Dec 5, 2024
555fdc0
SEPARATING FOLDER detect-angular-sce-disabled-javascript
Dec 5, 2024
5181000
modification in node-sequelize-empty-password-argument-javascript
Dec 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 56 additions & 0 deletions rules/java/security/simple-command-injection-direct-input-java.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
id: simple-command-injection-direct-input-java
language: java
severity: warning
message: >-
"Untrusted input might be injected into a command executed by the
application, which can lead to a command injection vulnerability. An
attacker can execute arbitrary commands, potentially gaining complete
control of the system. To prevent this vulnerability, avoid executing OS
commands with user input. If this is unavoidable, validate and sanitize
the input, and use safe methods for executing the commands. For more
information, see: [Java command injection
prevention](https://semgrep.dev/docs/cheat-sheets/java-command-injection/\
)"
note: >-
[CWE-78] Improper Neutralization of Special Elements used in an OS
[REFERENCES]
- https://docs.oracle.com/javase/8/docs/api/java/lang/Runtime.html
- https://owasp.org/Top10/A03_2021-Injection

rule:
kind: method_invocation
pattern: Runtime.getRuntime().exec($SOURCE)
inside:
kind: method_declaration
stopBy: end
has:
stopBy: end
kind: formal_parameter
has:
kind: modifiers
any:
- has:
kind: marker_annotation
has:
kind: identifier
pattern: $REQ
- has:
kind: annotation
all:
- has:
kind: identifier
pattern: $REQ
- has:
kind: annotation_argument_list
precedes:
kind: type_identifier
pattern: $TYPE
precedes:
kind: identifier
pattern: $SOURCE

constraints:
REQ:
regex: ^(RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute)
TYPE:
regex: ^[^I].*|^I[^n].*|^In[^t].*|^Int[^e].*|^Inte[^g].*|^Integ[^e].*|^Inge[^r].*|^L[^o].*|^Lo[^n].*|^Lon[^g].*|^F[^l].*|^Fl[^o].*|^Flo[^a].*|^Floa[^t].*|^D[^o].*|^Do[^u].*|^Dou[^b].*|^Doub[^l].*|^Doubl[^e].*|^C[^h].*|^Ch[^a].*|^Cha[^r].*|^B[^o].*|^Bo[^o].*|^Boo[^l].*|^Bool[^e].*|^Boole[^a].*|^Boolea[^n].*|^i[^n].*|^in[^t].*|^l[^o].*|^lo[^n].*|^lon[^g].*|^f[^l].*|^fl[^o].*|^flo[^a].*|^floa[^t].*|^d[^o].*|^do[^u].*|^dou[^b].*|^doub[^l].*|^doubl[^e].*|^c[^h].*|^ch[^a].*|^cha[^r].*|^b[^o].*|^bo[^o].*|^boo[^l].*|^bool[^e].*|^boole[^a].*|^boolea[^n].*
15 changes: 15 additions & 0 deletions rules/javascript/security/detect-angular-sce-disabled-javascript.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
id: detect-angular-sce-disabled-javascript
language: javascript
severity: warning
message: >-
$sceProvider is set to false. Disabling Strict Contextual escaping
(SCE) in an AngularJS application could provide additional attack surface
for XSS vulnerabilities.
note: >-
[CWE-79] Improper Neutralization of Input During Web Page Generation.
[REFERENCES]
- https://docs.angularjs.org/api/ng/service/$sce
- https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
rule:
pattern: |
$sceProvider.enabled(false);
197 changes: 197 additions & 0 deletions rules/javascript/security/node-sequelize-empty-password-argument-javascript.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,197 @@
id: node-sequelize-empty-password-argument-javascript
language: javascript
severity: warning
message: >-
The application creates a database connection with an empty password.
This can lead to unauthorized access by either an internal or external
malicious actor. To prevent this vulnerability, enforce authentication
when connecting to a database by using environment variables to securely
provide credentials or retrieving them from a secure vault or HSM
(Hardware Security Module).
note: >-
[CWE-287] Improper Authentication.
[REFERENCES]
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
utils:
MATCH_BLANK_PASSWORD:
kind: string
pattern: $Q
inside:
stopBy: end
kind: lexical_declaration
all:
- has:
stopBy: end
kind: new_expression
all:
- has:
stopBy: end
kind: identifier
pattern: $E
- has:
stopBy: end
kind: arguments
nthChild: 2
has:
stopBy: end
kind: string
nthChild: 3
pattern: $Q
not:
has:
stopBy: end
kind: string_fragment
- any:
- follows:
stopBy: end
kind: lexical_declaration
has:
stopBy: end
kind: variable_declarator
all:
- has:
stopBy: neighbor
kind: identifier
- has:
stopBy: neighbor
kind: call_expression
all:
- has:
stopBy: neighbor
kind: identifier
regex: '^require$'
- has:
stopBy: neighbor
kind: arguments
has:
stopBy: neighbor
kind: string
has:
stopBy: neighbor
kind: string_fragment
regex: '^sequelize$'
- follows:
stopBy: end
kind: import_statement
has:
stopBy: end
kind: import_clause
has:
stopBy: end
kind: identifier
pattern: $E
- follows:
stopBy: end
kind: import_statement
has:
stopBy: end
kind: import_clause
has:
stopBy: end
kind: identifier
pattern: $E


MATCH_BLANK_PASSWORD_WITH_INSTANCE:
kind: identifier
pattern: $Q
inside:
stopBy: end
kind: lexical_declaration
all:
- has:
stopBy: end
kind: new_expression
all:
- has:
stopBy: end
kind: identifier
pattern: $E
- has:
stopBy: end
kind: arguments
nthChild: 2
has:
stopBy: end
kind: identifier
nthChild: 3
pattern: $Q
not:
has:
stopBy: end
kind: string_fragment
- follows:
stopBy: end
kind: lexical_declaration
has:
stopBy: end
kind: variable_declarator
all:
- has:
stopBy: neighbor
kind: identifier
pattern: $Q
- has:
stopBy: neighbor
kind: string
not:
has:
stopBy: neighbor
kind: string_fragment
- any:
- follows:
stopBy: end
kind: lexical_declaration
has:
stopBy: end
kind: variable_declarator
all:
- has:
stopBy: neighbor
kind: identifier
- has:
stopBy: neighbor
kind: call_expression
all:
- has:
stopBy: neighbor
kind: identifier
regex: '^require$'
- has:
stopBy: neighbor
kind: arguments
has:
stopBy: neighbor
kind: string
has:
stopBy: neighbor
kind: string_fragment
regex: '^sequelize$'
- follows:
stopBy: end
kind: import_statement
has:
stopBy: end
kind: import_clause
has:
stopBy: end
kind: identifier
pattern: $E
- follows:
stopBy: end
kind: import_statement
has:
stopBy: end
kind: import_clause
has:
stopBy: end
kind: identifier
pattern: $E
rule:
any:
- kind: string
matches: MATCH_BLANK_PASSWORD
- kind: identifier
matches: MATCH_BLANK_PASSWORD_WITH_INSTANCE


9 changes: 9 additions & 0 deletions tests/__snapshots__/detect-angular-sce-disabled-javascript-snapshot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
id: detect-angular-sce-disabled-javascript
snapshots:
? |
$sceProvider.enabled(false);
: labels:
- source: $sceProvider.enabled(false);
style: primary
start: 0
end: 28
Loading