semgrep.yml

rules:
- id: go.lang.security.audit.crypto.bad_imports.insecure-module-used
  message: >-
    Detected use of an insecure cryptographic hashing method. This method is known
    to be broken and easily compromised. Use SHA256 or SHA3 instead.
  metadata:
    owasp: 'A9: Using Components with Known Vulnerabilities'
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    source-rule-url: https://github.com/securego/gosec
    references:
    - https://godoc.org/golang.org/x/crypto/sha3
    dev.semgrep.actions: &id001
    - block
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used
    semgrep.ruleset: gosec
  languages: [go]
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern: |
        md5.$FUNC(...)
    - pattern: |
        des.$FUNC(...)
    - pattern: |
        sha1.$FUNC(...)
    - pattern: |
        rc4.$FUNC(...)
    - pattern: |-
        cgi.$FUNC(...)
- id: go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key
  message: |
    Disabled host key verification detected. This allows man-in-the-middle
    attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do
    host key verification.
    See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/
    to learn more about the problem and how to fix it.
  metadata:
    cwe: 'CWE-322: Key Exchange without Entity Authentication'
    owasp: 'A3: Sensitive Data Exposure'
    source-rule-url: https://github.com/securego/gosec
    references:
    - https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/
    - https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key
    semgrep.ruleset: gosec
  languages: [go]
  severity: WARNING
  pattern: |-
    ssh.InsecureIgnoreHostKey()
- id: go.lang.security.audit.crypto.math_random.math-random-used
  metadata:
    cwe: 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)'
    owasp: 'A3: Sensitive Data Exposure'
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used
    semgrep.ruleset: gosec
  message: Do not use `math/rand`. Use `crypto/rand` instead.
  languages: [go]
  severity: WARNING
  pattern-either:
  - patterns:
    - pattern-inside: |
        import mrand "math/rand"
        ...
    - pattern-either:
      - pattern: mrand.Int()
      - pattern: mrand.Read(...)
  - patterns:
    - pattern-inside: |
        import "math/rand"
        ...
    - pattern-not-inside: |
        import "crypto/rand"
        ...
    - pattern-either:
      - pattern: rand.Int()
      - pattern: rand.Read(...)
- id: go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure
  message: |
    SSLv3 is insecure because it has known vulnerabilities.
    Starting with go1.14, SSLv3 will be removed. Instead, use
    'tls.VersionTLS13'.
  metadata:
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A9: Using Components with Known Vulnerabilities'
    source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go
    references:
    - https://golang.org/doc/go1.14#crypto/tls
    - https://www.us-cert.gov/ncas/alerts/TA14-290A
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure
    semgrep.ruleset: gosec
  languages: [go]
  severity: ERROR
  patterns:
  - pattern: |-
      tls.Config{..., MinVersion: $TLS.VersionSSL30, ...}
  fix-regex:
    regex: VersionSSL30
    replacement: VersionTLS13
- id: go.lang.security.audit.crypto.tls.tls-with-insecure-cipher
  message: |
    Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak.
    Use the function 'tls.CipherSuites()' to get a list of good cipher suites.
    See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites
    for why and what other cipher suites to use.
  metadata:
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A9: Using Components with Known Vulnerabilities'
    source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls.go
    references:
    - https://golang.org/pkg/crypto/tls/#InsecureCipherSuites
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher
    semgrep.ruleset: gosec
  languages: [go]
  severity: WARNING
  pattern-either:
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_RC4_128_SHA,...}}
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_AES_128_CBC_SHA256,...}}
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,...}}
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA,...}}
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,...}}
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,...}}
  - pattern: |
      tls.CipherSuite{..., TLS_RSA_WITH_RC4_128_SHA ,...}
  - pattern: |
      tls.CipherSuite{..., TLS_RSA_WITH_AES_128_CBC_SHA256 ,...}
  - pattern: |
      tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_RC4_128_SHA ,...}
  - pattern: |
      tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_RC4_128_SHA ,...}
  - pattern: |
      tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 ,...}
  - pattern: |-
      tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 ,...}
- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5
  message: |
    Detected MD5 hash algorithm which is considered insecure. MD5 is not
    collision resistant and is therefore not suitable as a cryptographic
    signature. Use SHA256 or SHA3 instead.
  languages: [go]
  severity: WARNING
  metadata:
    owasp: 'A9: Using Components with Known Vulnerabilities'
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    source-rule-url: https://github.com/securego/gosec#available-rules
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5
    semgrep.ruleset: gosec
  pattern-either:
  - pattern: |
      md5.New()
  - pattern: |
      md5.Sum(...)
- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1
  message: |
    Detected SHA1 hash algorithm which is considered insecure. SHA1 is not
    collision resistant and is therefore not suitable as a cryptographic
    signature. Use SHA256 or SHA3 instead.
  languages: [go]
  severity: WARNING
  metadata:
    owasp: 'A9: Using Components with Known Vulnerabilities'
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    source-rule-url: https://github.com/securego/gosec#available-rules
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1
    semgrep.ruleset: gosec
  pattern-either:
  - pattern: |
      sha1.New()
  - pattern: |
      sha1.Sum(...)
- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES
  message: |
    Detected DES cipher algorithm which is insecure. The algorithm is
    considered weak and has been deprecated. Use AES instead.
  languages: [go]
  severity: WARNING
  metadata:
    owasp: 'A9: Using Components with Known Vulnerabilities'
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    source-rule-url: https://github.com/securego/gosec#available-rules
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES
    semgrep.ruleset: gosec
  pattern-either:
  - pattern: |
      des.NewTripleDESCipher(...)
  - pattern: |
      des.NewCipher(...)
- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4
  message: |
    Detected RC4 cipher algorithm which is insecure. The algorithm has many
    known vulnerabilities. Use AES instead.
  languages: [go]
  severity: WARNING
  metadata:
    owasp: 'A9: Using Components with Known Vulnerabilities'
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    source-rule-url: https://github.com/securego/gosec#available-rules
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4
    semgrep.ruleset: gosec
  pattern: |-
    rc4.NewCipher(...)
- id: go.lang.security.audit.database.string-formatted-query.string-formatted-query
  languages: [go]
  message: |
    String-formatted SQL query detected. This could lead to SQL injection if
    the string is not sanitized properly. Audit this call to ensure the
    SQL is not manipulatable by external data.
  severity: WARNING
  metadata:
    owasp: 'A1: Injection'
    cwe: "CWE-89: Improper Neutralization of Special Elements used in an SQL Command\
      \ ('SQL Injection')"
    source-rule-url: https://github.com/securego/gosec
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.database.string-formatted-query.string-formatted-query
    semgrep.ruleset: gosec
  patterns:
  - pattern-either:
    - pattern: $OBJ.Exec("..." + $X)
    - pattern: $OBJ.ExecContext($CTX, "..." + $X)
    - pattern: $OBJ.Query("..." + $X)
    - pattern: $OBJ.QueryContext($CTX, "..." + $X)
    - pattern: $OBJ.QueryRow("..." + $X)
    - pattern: $OBJ.QueryRow($CTX, "..." + $X)
    - pattern: $OBJ.QueryRowContext($CTX, "..." + $X)
    - pattern: $OBJ.Exec(fmt.$P("...", ...))
    - pattern: $OBJ.ExecContext($CTX, fmt.$P("...", ...))
    - pattern: $OBJ.Query(fmt.$P("...", ...))
    - pattern: $OBJ.QueryContext($CTX, fmt.$P("...", ...))
    - pattern: $OBJ.QueryRow(fmt.$P("...", ...))
    - pattern: $OBJ.QueryRow($CTX, fmt.$P("...", ...))
    - pattern: $OBJ.QueryRowContext($CTX, fmt.$P("...", ...))
    - pattern: |
        $QUERY = "..."
        ...
        $QUERY = $FXN(..., $QUERY, ...)
        ...
        $OBJ.Exec($QUERY, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $QUERY = $FXN(..., $QUERY, ...)
        ...
        $OBJ.Query($QUERY, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $QUERY = $FXN(..., $QUERY, ...)
        ...
        $OBJ.ExecContext($CTX, $QUERY, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $QUERY = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryContext($CTX, $QUERY, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $QUERY = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryRow($QUERY)
    - pattern: |
        $QUERY = "..."
        ...
        $QUERY = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryRow($CTX, $QUERY)
    - pattern: |
        $QUERY = "..."
        ...
        $QUERY = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryRowContext($CTX, $QUERY, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $OTHER = $FXN(..., $QUERY, ...)
        ...
        $OBJ.Exec($OTHER, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $OTHER = $FXN(..., $QUERY, ...)
        ...
        $OBJ.Query($OTHER, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $OTHER = $FXN(..., $QUERY, ...)
        ...
        $OBJ.ExecContext($CTX, $OTHER, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $OTHER = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryContext($CTX, $OTHER, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $OTHER = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryRow($OTHER)
    - pattern: |
        $QUERY = "..."
        ...
        $OTHER = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryRow($CTX, $OTHER)
    - pattern: |
        $QUERY = "..."
        ...
        $OTHER = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryRowContext($CTX, $OTHER, ...)
    - pattern: |
        $QUERY = "..." + $X
        ...
        $OBJ.Exec($QUERY, ...)
    - pattern: |
        $QUERY = "..." + $X
        ...
        $OBJ.Query($QUERY, ...)
    - pattern: |
        $QUERY = "..." + $X
        ...
        $OBJ.ExecContext($CTX, $QUERY, ...)
    - pattern: |
        $QUERY = "..." + $X
        ...
        $OBJ.QueryContext($CTX, $QUERY, ...)
    - pattern: |
        $QUERY = "..." + $X
        ...
        $OBJ.QueryRow($QUERY)
    - pattern: |
        $QUERY = "..." + $X
        ...
        $OBJ.QueryRow($CTX, $QUERY)
    - pattern: |
        $QUERY = "..." + $X
        ...
        $OBJ.QueryRowContext($CTX, $QUERY, ...)
- id: go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces
  message: Listening on 0.0.0.0 or empty string could unexpectedly expose the server
    publicly as it binds to all available interfaces
  languages: [go]
  severity: WARNING
  metadata:
    cwe: 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
    owasp: 'A6: Security Misconfiguration'
    source-rule-url: https://github.com/securego/gosec
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces
    semgrep.ruleset: gosec
  pattern-either:
  - pattern: tls.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...)
  - pattern: net.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...)
  - pattern: tls.Listen($NETWORK, "=~/^:.*$/", ...)
  - pattern: net.Listen($NETWORK, "=~/^:.*$/", ...)
- id: go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace
  message: |
    Detected a potentially dynamic ClientTrace. This occurred because semgrep could not
    find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous because
    they deserialize function code to run when certain Request events occur, which could lead
    to code being run without your knowledge. Ensure that your ClientTrace is statically defined.
  metadata:
    cwe: 'CWE-913: Improper Control of Dynamically-Managed Code Resources'
    owasp: 'A8: Insecure Deserialization'
    references:
    - https://github.com/returntocorp/semgrep-rules/issues/518
  # Detects when a static ClientTrace is not defined in the same file as
  # WithClientTrace. Not a perfect detection, but sufficiently works in a
  # scan of ~1k repos: https://dev.massive.ret2.co/triager/filter/1007
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace
    semgrep.ruleset: gosec
  patterns:
  - pattern-not-inside: |
      ...
      &httptrace.ClientTrace { ... }
      ...
  - pattern: httptrace.WithClientTrace($ANY, $TRACE)

  severity: WARNING
  languages:
  - go
- id: go.lang.security.audit.net.formatted-template-string.formatted-template-string
  message: |
    Found a formatted template string passed to 'template.HTML()'.
    'template.HTML()' does not escape contents. Be absolutely sure
    there is no user-controlled data in this template. If user data
    can reach this template, you may have a XSS vulnerability.
  metadata:
    cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site\
      \ Scripting')"
    owasp: 'A1: Injection'
    references:
    - https://golang.org/pkg/html/template/#HTML
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string
    semgrep.ruleset: gosec
  languages: [go]
  severity: WARNING
  patterns:
  - pattern-not: template.HTML("..." + "...")
  - pattern-either:
    - pattern: template.HTML($T + $X, ...)
    - pattern: template.HTML(fmt.$P("...", ...), ...)
    - pattern: |
        $T = "..."
        ...
        $T = $FXN(..., $T, ...)
        ...
        template.HTML($T, ...)
    - pattern: |
        $T = fmt.$P("...", ...)
        ...
        template.HTML($T, ...)
    - pattern: |
        $T, $ERR = fmt.$P("...", ...)
        ...
        template.HTML($T, ...)
    - pattern: |
        $T = $X + $Y
        ...
        template.HTML($T, ...)
    - pattern: |
        $T = "..."
        ...
        $OTHER, $ERR = fmt.$P(..., $T, ...)
        ...
        template.HTML($OTHER, ...)
- id: go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr
  message: |
    Found a formatted template string passed to 'template.HTMLAttr()'.
    'template.HTMLAttr()' does not escape contents. Be absolutely sure
    there is no user-controlled data in this template.
  metadata:
    cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site\
      \ Scripting')"
    owasp: 'A1: Injection'
    references:
    - https://golang.org/pkg/html/template/#HTMLAttr
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr
    semgrep.ruleset: gosec
  languages: [go]
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern: template.HTMLAttr($T + $X, ...)
    - pattern: template.HTMLAttr(fmt.$P("...", ...), ...)
    - pattern: |
        $T = "..."
        ...
        $T = $FXN(..., $T, ...)
        ...
        template.HTMLAttr($T, ...)
    - pattern: |
        $T = fmt.$P("...", ...)
        ...
        template.HTMLAttr($T, ...)
    - pattern: |
        $T, $ERR = fmt.$P("...", ...)
        ...
        template.HTMLAttr($T, ...)
    - pattern: |
        $T = $X + $Y
        ...
        template.HTMLAttr($T, ...)
    - pattern: |
        $T = "..."
        ...
        $OTHER, $ERR = fmt.$P(..., $T, ...)
        ...
        template.HTMLAttr($OTHER, ...)
- id: go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js
  message: |
    Found a formatted template string passed to 'template.JS()'.
    'template.JS()' does not escape contents. Be absolutely sure
    there is no user-controlled data in this template.
  metadata:
    cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site\
      \ Scripting')"
    owasp: 'A1: Injection'
    references:
    - https://golang.org/pkg/html/template/#JS
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js
    semgrep.ruleset: gosec
  languages: [go]
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern: template.JS($T + $X, ...)
    - pattern: template.JS(fmt.$P("...", ...), ...)
    - pattern: |
        $T = "..."
        ...
        $T = $FXN(..., $T, ...)
        ...
        template.JS($T, ...)
    - pattern: |
        $T = fmt.$P("...", ...)
        ...
        template.JS($T, ...)
    - pattern: |
        $T, $ERR = fmt.$P("...", ...)
        ...
        template.JS($T, ...)
    - pattern: |
        $T = $X + $Y
        ...
        template.JS($T, ...)
    - pattern: |
        $T = "..."
        ...
        $OTHER, $ERR = fmt.$P(..., $T, ...)
        ...
        template.JS($OTHER, ...)
- id: go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url
  message: |
    Found a formatted template string passed to 'template.URL()'.
    'template.URL()' does not escape contents. Be absolutely sure
    there is no user-controlled data in this template.
  metadata:
    cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site\
      \ Scripting')"
    owasp: 'A1: Injection'
    references:
    - https://golang.org/pkg/html/template/#URL
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url
    semgrep.ruleset: gosec
  languages: [go]
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern: template.URL($T + $X, ...)
    - pattern: template.URL(fmt.$P("...", ...), ...)
    - pattern: |
        $T = "..."
        ...
        $T = $FXN(..., $T, ...)
        ...
        template.URL($T, ...)
    - pattern: |
        $T = fmt.$P("...", ...)
        ...
        template.URL($T, ...)
    - pattern: |
        $T, $ERR = fmt.$P("...", ...)
        ...
        template.URL($T, ...)
    - pattern: |
        $T = $X + $Y
        ...
        template.URL($T, ...)
    - pattern: |
        $T = "..."
        ...
        $OTHER, $ERR = fmt.$P(..., $T, ...)
        ...
        template.URL($OTHER, ...)
- id: go.lang.security.audit.unsafe.use-of-unsafe-block
  message: Using the unsafe package in Go gives you low-level memory management and
    many of the strengths of the C language but also gives flexibility to the attacker
    of your application.
  languages: [go]
  severity: WARNING
  metadata:
    cwe: 'CWE-242: Use of Inherently Dangerous Function'
    source_rule_url: https://github.com/securego/gosec/blob/master/rules/unsafe.go
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.unsafe.use-of-unsafe-block
    semgrep.ruleset: gosec
  patterns:
  - pattern: unsafe.$FUNC(...)
- id: go.lang.security.bad_tmp.bad-tmp-file-creation
  message: File creation in shared tmp directory without using ioutil.Tempfile
  languages: [go]
  severity: WARNING
  metadata:
    cwe: 'CWE-377: Insecure Temporary File'
    source_rule_url: https://github.com/securego/gosec
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.bad_tmp.bad-tmp-file-creation
    semgrep.ruleset: gosec
  pattern-either:
  - pattern: ioutil.WriteFile("=~//tmp/.*$/", ...)
  - pattern: os.Create("=~//tmp/.*$/", ...)
- id: go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb
  message: >-
    Detected a possible denial-of-service via a zip bomb attack. By limiting the max
    bytes read, you can mitigate this attack.
    `io.CopyN()` can specify a size. Refer to https://bomb.codes/ to learn more about
    this attack and other ways to mitigate
    it.
  severity: WARNING
  languages: [go]
  patterns:
  - pattern-either:
    - pattern: io.Copy(...)
    - pattern: io.CopyBuffer(...)
  - pattern-either:
    - pattern-inside: |
        gzip.NewReader(...)
        ...
    - pattern-inside: |
        zlib.NewReader(...)
        ...
    - pattern-inside: |
        zlib.NewReaderDict(...)
        ...
    - pattern-inside: |
        bzip2.NewReader(...)
        ...
    - pattern-inside: |
        flate.NewReader(...)
        ...
    - pattern-inside: |
        flate.NewReaderDict(...)
        ...
    - pattern-inside: |
        lzw.NewReader(...)
        ...
    - pattern-inside: |
        tar.NewReader(...)
        ...
    - pattern-inside: |
        zip.NewReader(...)
        ...
    - pattern-inside: |
        zip.OpenReader(...)
        ...
  fix-regex:
    regex: (.*)(Copy|CopyBuffer)\((.*?),(.*?)(\)|,.*\))
    replacement: \1CopyN(\3, \4, 1024*1024*256)
  metadata:
    cwe: 'CWE-400: Uncontrolled Resource Consumption'
    source-rule-url: https://github.com/securego/gosec
    references:
    - https://bomb.codes/
    - https://golang.org/pkg/io/#CopyN
    - https://github.com/securego/gosec/blob/master/rules/decompression-bomb.go
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb
    semgrep.ruleset: gosec
- id: go.lang.security.zip.path-traversal-inside-zip-extraction
  message: File traversal when extracting zip archive
  metadata:
    cwe: |
      CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    source_rule_url: https://github.com/securego/gosec/issues/205
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.zip.path-traversal-inside-zip-extraction
    semgrep.ruleset: gosec
  languages: [go]
  severity: WARNING
  patterns:
  - pattern: |-
      reader, $ERR := zip.OpenReader($ARCHIVE)
      ...
      for _, $FILE := range reader.File {
        ...
        path := filepath.Join($TARGET, $FILE.Name)
        ...
      }
- id: go.lang.security.audit.reflect-makefunc.reflect-makefunc
  message: |
    'reflect.MakeFunc' detected. This will sidestep protections that are
    normally afforded by Go's type system. Audit this call and be sure that
    user input cannot be used to affect the code generated by MakeFunc;
    otherwise, you will have a serious security vulnerability.
  metadata:
    owasp: 'A8: Insecure Deserialization'
    cwe: 'CWE-913: Improper Control of Dynamically-Managed Code Resources'
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.reflect-makefunc.reflect-makefunc
    semgrep.ruleset: golang
  severity: WARNING
  pattern: reflect.MakeFunc(...)
  languages:
  - go
- id: go.lang.security.audit.database.string-formatted-query.string-formatted-query
  languages: [go]
  message: |
    String-formatted SQL query detected. This could lead to SQL injection if
    the string is not sanitized properly. Audit this call to ensure the
    SQL is not manipulatable by external data.
  severity: WARNING
  metadata:
    owasp: 'A1: Injection'
    cwe: "CWE-89: Improper Neutralization of Special Elements used in an SQL Command\
      \ ('SQL Injection')"
    source-rule-url: https://github.com/securego/gosec
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.database.string-formatted-query.string-formatted-query
    semgrep.ruleset: golang
  patterns:
  - pattern-either:
    - pattern: $OBJ.Exec("..." + $X)
    - pattern: $OBJ.ExecContext($CTX, "..." + $X)
    - pattern: $OBJ.Query("..." + $X)
    - pattern: $OBJ.QueryContext($CTX, "..." + $X)
    - pattern: $OBJ.QueryRow("..." + $X)
    - pattern: $OBJ.QueryRow($CTX, "..." + $X)
    - pattern: $OBJ.QueryRowContext($CTX, "..." + $X)
    - pattern: $OBJ.Exec(fmt.$P("...", ...))
    - pattern: $OBJ.ExecContext($CTX, fmt.$P("...", ...))
    - pattern: $OBJ.Query(fmt.$P("...", ...))
    - pattern: $OBJ.QueryContext($CTX, fmt.$P("...", ...))
    - pattern: $OBJ.QueryRow(fmt.$P("...", ...))
    - pattern: $OBJ.QueryRow($CTX, fmt.$P("...", ...))
    - pattern: $OBJ.QueryRowContext($CTX, fmt.$P("...", ...))
    - pattern: |
        $QUERY = "..."
        ...
        $QUERY = $FXN(..., $QUERY, ...)
        ...
        $OBJ.Exec($QUERY, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $QUERY = $FXN(..., $QUERY, ...)
        ...
        $OBJ.Query($QUERY, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $QUERY = $FXN(..., $QUERY, ...)
        ...
        $OBJ.ExecContext($CTX, $QUERY, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $QUERY = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryContext($CTX, $QUERY, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $QUERY = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryRow($QUERY)
    - pattern: |
        $QUERY = "..."
        ...
        $QUERY = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryRow($CTX, $QUERY)
    - pattern: |
        $QUERY = "..."
        ...
        $QUERY = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryRowContext($CTX, $QUERY, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $OTHER = $FXN(..., $QUERY, ...)
        ...
        $OBJ.Exec($OTHER, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $OTHER = $FXN(..., $QUERY, ...)
        ...
        $OBJ.Query($OTHER, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $OTHER = $FXN(..., $QUERY, ...)
        ...
        $OBJ.ExecContext($CTX, $OTHER, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $OTHER = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryContext($CTX, $OTHER, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $OTHER = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryRow($OTHER)
    - pattern: |
        $QUERY = "..."
        ...
        $OTHER = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryRow($CTX, $OTHER)
    - pattern: |
        $QUERY = "..."
        ...
        $OTHER = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryRowContext($CTX, $OTHER, ...)
    - pattern: |
        $QUERY = "..." + $X
        ...
        $OBJ.Exec($QUERY, ...)
    - pattern: |
        $QUERY = "..." + $X
        ...
        $OBJ.Query($QUERY, ...)
    - pattern: |
        $QUERY = "..." + $X
        ...
        $OBJ.ExecContext($CTX, $QUERY, ...)
    - pattern: |
        $QUERY = "..." + $X
        ...
        $OBJ.QueryContext($CTX, $QUERY, ...)
    - pattern: |
        $QUERY = "..." + $X
        ...
        $OBJ.QueryRow($QUERY)
    - pattern: |
        $QUERY = "..." + $X
        ...
        $OBJ.QueryRow($CTX, $QUERY)
    - pattern: |
        $QUERY = "..." + $X
        ...
        $OBJ.QueryRowContext($CTX, $QUERY, ...)
- id: go.lang.security.audit.crypto.tls.tls-with-insecure-cipher
  message: |
    Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak.
    Use the function 'tls.CipherSuites()' to get a list of good cipher suites.
    See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites
    for why and what other cipher suites to use.
  metadata:
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A9: Using Components with Known Vulnerabilities'
    source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls.go
    references:
    - https://golang.org/pkg/crypto/tls/#InsecureCipherSuites
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher
    semgrep.ruleset: golang
  languages: [go]
  severity: WARNING
  pattern-either:
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_RC4_128_SHA,...}}
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_AES_128_CBC_SHA256,...}}
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,...}}
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA,...}}
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,...}}
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,...}}
  - pattern: |
      tls.CipherSuite{..., TLS_RSA_WITH_RC4_128_SHA ,...}
  - pattern: |
      tls.CipherSuite{..., TLS_RSA_WITH_AES_128_CBC_SHA256 ,...}
  - pattern: |
      tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_RC4_128_SHA ,...}
  - pattern: |
      tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_RC4_128_SHA ,...}
  - pattern: |
      tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 ,...}
  - pattern: |-
      tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 ,...}
- id: go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key
  message: |
    Disabled host key verification detected. This allows man-in-the-middle
    attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do
    host key verification.
    See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/
    to learn more about the problem and how to fix it.
  metadata:
    cwe: 'CWE-322: Key Exchange without Entity Authentication'
    owasp: 'A3: Sensitive Data Exposure'
    source-rule-url: https://github.com/securego/gosec
    references:
    - https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/
    - https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key
    semgrep.ruleset: golang
  languages: [go]
  severity: WARNING
  pattern: |-
    ssh.InsecureIgnoreHostKey()
- id: go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure
  message: |
    SSLv3 is insecure because it has known vulnerabilities.
    Starting with go1.14, SSLv3 will be removed. Instead, use
    'tls.VersionTLS13'.
  metadata:
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A9: Using Components with Known Vulnerabilities'
    source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go
    references:
    - https://golang.org/doc/go1.14#crypto/tls
    - https://www.us-cert.gov/ncas/alerts/TA14-290A
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure
    semgrep.ruleset: golang
  languages: [go]
  severity: ERROR
  patterns:
  - pattern: |-
      tls.Config{..., MinVersion: $TLS.VersionSSL30, ...}
  fix-regex:
    regex: VersionSSL30
    replacement: VersionTLS13
- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5
  message: |
    Detected MD5 hash algorithm which is considered insecure. MD5 is not
    collision resistant and is therefore not suitable as a cryptographic
    signature. Use SHA256 or SHA3 instead.
  languages: [go]
  severity: WARNING
  metadata:
    owasp: 'A9: Using Components with Known Vulnerabilities'
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    source-rule-url: https://github.com/securego/gosec#available-rules
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5
    semgrep.ruleset: golang
  pattern-either:
  - pattern: |
      md5.New()
  - pattern: |
      md5.Sum(...)
- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1
  message: |
    Detected SHA1 hash algorithm which is considered insecure. SHA1 is not
    collision resistant and is therefore not suitable as a cryptographic
    signature. Use SHA256 or SHA3 instead.
  languages: [go]
  severity: WARNING
  metadata:
    owasp: 'A9: Using Components with Known Vulnerabilities'
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    source-rule-url: https://github.com/securego/gosec#available-rules
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1
    semgrep.ruleset: golang
  pattern-either:
  - pattern: |
      sha1.New()
  - pattern: |
      sha1.Sum(...)
- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES
  message: |
    Detected DES cipher algorithm which is insecure. The algorithm is
    considered weak and has been deprecated. Use AES instead.
  languages: [go]
  severity: WARNING
  metadata:
    owasp: 'A9: Using Components with Known Vulnerabilities'
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    source-rule-url: https://github.com/securego/gosec#available-rules
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES
    semgrep.ruleset: golang
  pattern-either:
  - pattern: |
      des.NewTripleDESCipher(...)
  - pattern: |
      des.NewCipher(...)
- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4
  message: |
    Detected RC4 cipher algorithm which is insecure. The algorithm has many
    known vulnerabilities. Use AES instead.
  languages: [go]
  severity: WARNING
  metadata:
    owasp: 'A9: Using Components with Known Vulnerabilities'
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    source-rule-url: https://github.com/securego/gosec#available-rules
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4
    semgrep.ruleset: golang
  pattern: |-
    rc4.NewCipher(...)
- id: go.lang.security.audit.net.pprof.pprof-debug-exposure
  metadata:
    cwe: 'CWE-489: Active Debug Code'
    owasp: 'A6: Security Misconfiguration'
    source-rule-url: https://github.com/securego/gosec#available-rules
    references:
    - https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.net.pprof.pprof-debug-exposure
    semgrep.ruleset: golang
  message: |
    The profiling 'pprof' endpoint is automatically exposed on /debug/pprof.
    This could leak information about the server.
    Instead, use `import "net/http/pprof"`. See
    https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/
    for more information and mitigation.
  languages: [go]
  severity: WARNING
  patterns:
  - pattern-inside: |
      import _ "net/http/pprof"
      ...
  - pattern-inside: |
      func $ANY(...) {
        ...
      }
  - pattern-not: http.ListenAndServe("=~/^localhost.*/", ...)
  - pattern-not: http.ListenAndServe("=~/^127[.]0[.]0[.]1.*/", ...)
  - pattern: http.ListenAndServe(...)
- id: go.lang.security.audit.net.formatted-template-string.formatted-template-string
  message: |
    Found a formatted template string passed to 'template.HTML()'.
    'template.HTML()' does not escape contents. Be absolutely sure
    there is no user-controlled data in this template. If user data
    can reach this template, you may have a XSS vulnerability.
  metadata:
    cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site\
      \ Scripting')"
    owasp: 'A1: Injection'
    references:
    - https://golang.org/pkg/html/template/#HTML
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string
    semgrep.ruleset: golang
  languages: [go]
  severity: WARNING
  patterns:
  - pattern-not: template.HTML("..." + "...")
  - pattern-either:
    - pattern: template.HTML($T + $X, ...)
    - pattern: template.HTML(fmt.$P("...", ...), ...)
    - pattern: |
        $T = "..."
        ...
        $T = $FXN(..., $T, ...)
        ...
        template.HTML($T, ...)
    - pattern: |
        $T = fmt.$P("...", ...)
        ...
        template.HTML($T, ...)
    - pattern: |
        $T, $ERR = fmt.$P("...", ...)
        ...
        template.HTML($T, ...)
    - pattern: |
        $T = $X + $Y
        ...
        template.HTML($T, ...)
    - pattern: |
        $T = "..."
        ...
        $OTHER, $ERR = fmt.$P(..., $T, ...)
        ...
        template.HTML($OTHER, ...)
- id: go.lang.maintainability.useless-ifelse.useless-if-conditional
  patterns:
  - pattern-either:
    - pattern: |-
        if ($X) {
            ...
        } else if ($X) {
            ...
        }
  message: |
    Detected an if block that checks for the same condition on both branches (`$X`)
  languages: [go]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.maintainability.useless-ifelse.useless-if-conditional
    semgrep.ruleset: golang
- id: go.lang.maintainability.useless-ifelse.useless-if-body
  patterns:
  - pattern: |-
      if ($X) {
          $S
      } else {
          $S
      }
  message: |
    Detected identical if-statement bodies. Is this intentional?
  languages: [go]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.maintainability.useless-ifelse.useless-if-body
    semgrep.ruleset: golang
- id: javascript.jsonwebtoken.security.jwt-exposed-credentials.jwt-exposed-credentials
  languages:
  - javascript
  metadata:
    cwe: 'CWE-522: Insufficiently Protected Credentials'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    references:
    - https://cwe.mitre.org/data/definitions/522.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-exposed-credentials.jwt-exposed-credentials
    semgrep.ruleset: jwt
  message: |
    Password is exposed through JWT token payload. This is not encrypted and
    the password could be compromised. Do not store passwords in JWT tokens.
  patterns:
  - pattern-either:
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $T = $JWT.sign({password:...},...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $T = $JWT.sign({password:...},...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $JWT.sign({password:...},...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = {password:...};
        ...
        var $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = {password:...};
        ...
        $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = {password:...};
        ...
        $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = {password:...};
        ...
        var $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = {password:...};
        ...
        $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = {password:...};
        ...
        $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P.password = ...;
        ...
        var $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P.password = ...;
        ...
        $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P.password = ...;
        ...
        $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = Object.assign(...,{password:...},...);
        ...
        var $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = Object.assign(...,{password:...},...);
        ...
        $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = Object.assign(...,{password:...},...);
        ...
        $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = Object.assign(...,{password:...},...);
        ...
        var $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = Object.assign(...,{password:...},...);
        ...
        $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = Object.assign(...,{password:...},...);
        ...
        $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $T = $JWT.sign(Object.assign(...,{password:...},...),...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $T = $JWT.sign(Object.assign(...,{password:...},...),...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $JWT.sign(Object.assign(...,{password:...},...),...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $T = $JWT.sign({$U:{password:...}},...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $T = $JWT.sign({$U:{password:...}},...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $JWT.sign({$U:{password:...}},...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = {$U:{password:...}};
        ...
        var $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = {$U:{password:...}};
        ...
        $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = {$U:{password:...}};
        ...
        $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = {$U:{password:...}};
        ...
        var $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = {$U:{password:...}};
        ...
        $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = {$U:{password:...}};
        ...
        $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P.$U.password = ...;
        ...
        var $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P.$U.password = ...;
        ...
        $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P.$U.password = ...;
        ...
        $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = Object.assign(...,{$U:{password:...}},...);
        ...
        var $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = Object.assign(...,{$U:{password:...}},...);
        ...
        $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = Object.assign(...,{$U:{password:...}},...);
        ...
        $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = Object.assign(...,{$U:{password:...}},...);
        ...
        var $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = Object.assign(...,{$U:{password:...}},...);
        ...
        $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = Object.assign(...,{$U:{password:...}},...);
        ...
        $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $T = $JWT.sign(Object.assign(...,{$U:{password:...}},...),...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $T = $JWT.sign(Object.assign(...,{$U:{password:...}},...),...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $JWT.sign(Object.assign(...,{$U:{password:...}},...),...);
  severity: ERROR
- id: javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg
  message: |
    Detected use of the 'none' algorithm in a JWT token.
    The 'none' algorithm assumes the integrity of the token has already
    been verified. This would allow a malicious actor to forge a JWT token
    that will automatically be verified. Do not explicitly use the 'none'
    algorithm. Instead, use an algorithm such as 'HS256'.
  metadata:
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg
    semgrep.ruleset: jwt
  languages: [javascript]
  severity: ERROR
  patterns:
  - pattern-either:
          # jsonwebtoken
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $T = $JWT.verify($P, $X, {algorithms:[...,'none',...]},...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $T = $JWT.verify($P, $X, {algorithms:[...,'none',...]},...);
    - pattern: |-
        var $JWT = require("jsonwebtoken");
        ...
        $JWT.verify($P, $X, {algorithms:[...,'none',...]},...);
- id: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret
  message: |
    Hardcoded JWT secret or private key is used.
    This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html
    Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables: process.env.SECRET)
  metadata:
    cwe: 'CWE-522: Insufficiently Protected Credentials'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret
    semgrep.ruleset: jwt
  patterns:
  - pattern-either:
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $T = $JWT.sign($P, "...", ...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $T = $JWT.verify($P, "...", ...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $JWT.sign($P, "...", ...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $JWT.verify($P, "...", ...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $SECRET = "...";
        ...
        var $T = $JWT.sign($P, $SECRET, ...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $SECRET = "...";
        ...
        var $T = $JWT.verify($P, $SECRET, ...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $SECRET = "...";
        ...
        $JWT.sign($P, $SECRET, ...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $SECRET = "...";
        ...
        $JWT.verify($P, $SECRET, ...);
  languages: [javascript]
  severity: ERROR
- id: javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify
  message: |
    Detected the decoding of a JWT token without a verify step.
    JWT tokens must be verified before use, otherwise the token's
    integrity is unknown. This means a malicious actor could forge
    a JWT token with any claims. Call '.verify()' before using the token.
  metadata:
    cwe: 'CWE-345: Insufficient Verification of Data Authenticity'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify
    semgrep.ruleset: jwt
  languages: [javascript]
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern: |
        var $JWT = require('jsonwebtoken');
        ...
        $JWT.decode(...);
    - pattern: |
        var $JWT = require('jsonwebtoken');
        ...
        return $JWT.decode(...);
    - pattern: |
        var $JWT = require('jsonwebtoken');
        ...
        if(<... $JWT.decode(...) ...>) {
            ...
        }
    - pattern: |
        var $JWT = require('jsonwebtoken');
        ...
        return {$P: $JWT.decode(...)};
    - pattern: |
        var $JWT = require('jsonwebtoken');
        ...
        $X = {$P: $JWT.decode(...)};
    - pattern: |
        var $JWT = require('jsonwebtoken');
        ...
        $FUNC({$P: $JWT.decode(...)});
    - pattern: |
        var $JWT = require('jsonwebtoken');
        ...
        return $FUNC({$P: $JWT.decode(...)});
  - pattern-not-inside: |
      ...
      $JWT.verify(...);
  - pattern-not-inside: |
      ...
      return $JWT.verify(...);
  - pattern-not-inside: |
      ...
      if(<... $JWT.verify(...) ...>) {
          ...
      }
  - pattern-not-inside: |
      ...
      return {$P: $JWT.verify(...)};
  - pattern-not-inside: |
      ...
      $X = {$P: $JWT.verify(...)};
  - pattern-not-inside: |
      ...
      $FUNC({$P: $JWT.verify(...)});
  - pattern-not-inside: |-
      ...
      return $FUNC({$P: $JWT.verify(...)});
- id: javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data
  message: |
    The object is passed strictly to jsonwebtoken.sign(...)
    Make sure that sensitive information is not exposed through JWT token payload.
  severity: WARNING
  metadata:
    owasp: A3:2017-Sensitive Data Exposure
    cwe: 'CWE-522: Insufficiently Protected Credentials'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data
    semgrep.ruleset: jwt
  languages: [javascript]
  patterns:
  - pattern-inside: |
      ...
      $JWT = require('jsonwebtoken');
      ...
  - pattern-either:
    - pattern-inside: function (...,$INPUT,...) {...}
    - pattern-inside: function $F(...,$INPUT,...) {...}
  - pattern: $JWT.sign($INPUT,...)
- id: javascript.jose.security.jwt-none-alg.jwt-none-alg
  message: |
    Detected use of the 'none' algorithm in a JWT token.
    The 'none' algorithm assumes the integrity of the token has already
    been verified. This would allow a malicious actor to forge a JWT token
    that will automatically be verified. Do not explicitly use the 'none'
    algorithm. Instead, use an algorithm such as 'HS256'.
  metadata:
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg
    semgrep.ruleset: jwt
  languages: [javascript]
  severity: ERROR
  patterns:
  - pattern-either:
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $T = JWT.verify($P, JWK.None,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        $T = JWT.verify($P, JWK.None,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        JWT.verify($P, JWK.None,...);
- id: javascript.jose.security.jwt-exposed-credentials.jwt-exposed-credentials
  languages:
  - javascript
  metadata:
    cwe: 'CWE-522: Insufficiently Protected Credentials'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    references:
    - https://cwe.mitre.org/data/definitions/522.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.jose.security.jwt-exposed-credentials.jwt-exposed-credentials
    semgrep.ruleset: jwt
  message: |
    Password is exposed through JWT token payload. This is not encrypted and
    the password could be compromised. Do not store passwords in JWT tokens.
  patterns:
  - pattern-either:
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $T = JWT.sign({password:...},...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $T = JWT.sign({password:...},...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $P = {password:...};
        ...
        var $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $P = {password:...};
        ...
        $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P = {password:...};
        ...
        var $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P = {password:...};
        ...
        $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P.password = ...;
        ...
        var $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P.password = ...;
        ...
        $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $P = Object.assign(...,{password:...},...);
        ...
        var $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $P = Object.assign(...,{password:...},...);
        ...
        $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P = Object.assign(...,{password:...},...);
        ...
        var $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P = Object.assign(...,{password:...},...);
        ...
        $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $T = JWT.sign(Object.assign(...,{password:...},...),...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $T = JWT.sign(Object.assign(...,{password:...},...),...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $T = JWT.sign({$U:{password:...}},...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $T = JWT.sign({$U:{password:...}},...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $P = {$U:{password:...}};
        ...
        var $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $P = {$U:{password:...}};
        ...
        $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P = {$U:{password:...}};
        ...
        var $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P = {$U:{password:...}};
        ...
        $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P.$U.password = ...;
        ...
        var $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P.$U.password = ...;
        ...
        $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $P = Object.assign(...,{$U:{password:...}},...);
        ...
        var $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $P = Object.assign(...,{$U:{password:...}},...);
        ...
        $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P = Object.assign(...,{$U:{password:...}},...);
        ...
        var $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P = Object.assign(...,{$U:{password:...}},...);
        ...
        $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $T = JWT.sign(Object.assign(...,{$U:{password:...}},...),...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $T = JWT.sign(Object.assign(...,{$U:{password:...}},...),...);
  severity: ERROR
- id: javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret
  message: |
    Hardcoded JWT secret or private key is used.
    This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html
    Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables: process.env.SECRET)
  metadata:
    cwe: 'CWE-522: Insufficiently Protected Credentials'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret
    semgrep.ruleset: jwt
  patterns:
  - pattern-either:
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        JWT.verify($P, "...", ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $T = JWT.sign($P, "...", ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $T = JWT.verify($P, "...", ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        JWT.verify($P, JWK.asKey("..."), ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $KEY = JWK.asKey("...");
        ...
        JWT.verify($P, $KEY, ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $T = JWT.sign($P, JWK.asKey("..."), ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $T = JWT.verify($P, JWK.asKey("..."), ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $KEY = JWK.asKey("...");
        ...
        var $T = JWT.sign($P, $KEY, ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $KEY = JWK.asKey("...");
        ...
        var $T = JWT.verify($P, $KEY, ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $SECRET = "...";
        ...
        JWT.verify($P, $SECRET, ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $SECRET = "...";
        ...
        var $T = JWT.sign($P, $SECRET, ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $SECRET = "...";
        ...
        var $T = JWT.verify($P, $SECRET, ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $SECRET = "...";
        ...
        JWT.verify($P, JWK.asKey($SECRET), ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $SECRET = "...";
        ...
        var $KEY = JWK.asKey($SECRET);
        ...
        JWT.verify($P, $KEY, ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $SECRET = "...";
        ...
        var $T = JWT.sign($P, JWK.asKey($SECRET), ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $SECRET = "...";
        ...
        var $KEY = JWK.asKey($SECRET);
        ...
        var $T = JWT.sign($P, $KEY, ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $SECRET = "...";
        ...
        var $T = JWT.verify($P, JWK.asKey($SECRET), ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $SECRET = "...";
        ...
        var $KEY = JWK.asKey($SECRET);
        ...
        var $T = JWT.verify($P, $KEY, ...);
  languages: [javascript]
  severity: ERROR
- id: javascript.jose.security.audit.jose-exposed-data.jose-exposed-data
  message: |
    The object is passed strictly to jose.JWT.sign(...)
    Make sure that sensitive information is not exposed through JWT token payload.
  severity: WARNING
  metadata:
    owasp: A3:2017-Sensitive Data Exposure
    cwe: 'CWE-522: Insufficiently Protected Credentials'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.jose.security.audit.jose-exposed-data.jose-exposed-data
    semgrep.ruleset: jwt
  languages: [javascript]
  patterns:
  - pattern-inside: |
      ...
      require('jose');
      ...
  - pattern-either:
    - patterns:
      - pattern-inside: function (...,$INPUT,...) {...}
      - pattern-either:
        - pattern: $JOSE.JWT.sign($INPUT,...)
        - pattern: $JWT.sign($INPUT,...)
    - patterns:
      - pattern-inside: function $F(...,$INPUT,...) {...}
      - pattern-either:
        - pattern: $JOSE.JWT.sign($INPUT,...)
        - pattern: $JWT.sign($INPUT,...)
- id: go.jwt-go.security.jwt.hardcoded-jwt-key
  metadata:
    cwe: 'CWE-798: Use of Hard-coded Credentials'
    owasp: 'A2: Broken Authentication'
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key
    semgrep.ruleset: jwt
  pattern-either:
  - pattern: |
      $X = []byte("...")
      ...
      $Y := $TOKEN.SignedString($X)
  - pattern: |
      $TOKEN.SignedString([]byte("..."))
  message: JWT token is hardcoded
  languages: [go]
  severity: WARNING
- id: go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm
  message: |
    Detected use of the 'none' algorithm in a JWT token.
    The 'none' algorithm assumes the integrity of the token has already
    been verified. This would allow a malicious actor to forge a JWT token
    that will automatically be verified. Do not explicitly use the 'none'
    algorithm. Instead, use an algorithm such as 'HS256'.
  metadata:
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm
    semgrep.ruleset: jwt
  languages: [go]
  severity: ERROR
  patterns:
  - pattern-inside: |
      import "github.com/dgrijalva/jwt-go"
      ...
  - pattern-either:
    - pattern: |
        jwt.SigningMethodNone
    - pattern: jwt.UnsafeAllowNoneSignatureType
- id: go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified
  message: |
    Detected the decoding of a JWT token without a verify step.
    Don't use `ParseUnverified` unless you know what you're doing
    This method parses the token but doesn't validate the signature. It's only ever useful in cases where you know the signature is valid (because it has been checked previously in the stack) and you want to extract values from it.
  metadata:
    cwe: 'CWE-345: Insufficient Verification of Data Authenticity'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified
    semgrep.ruleset: jwt
  languages: [go]
  severity: WARNING
  patterns:
  - pattern-inside: |
      import "github.com/dgrijalva/jwt-go"
      ...
  - pattern: |
      $JWT.ParseUnverified(...)
- id: java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret
  message: |
    Hardcoded JWT secret or private key is used.
    This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html
    Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)
  metadata:
    cwe: 'CWE-522: Insufficiently Protected Credentials'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret
    semgrep.ruleset: jwt
  patterns:
  - pattern-either:
    - pattern: |
        com.auth0.jwt.algorithms.Algorithm.HMAC256("...");
    - pattern: |
        $SECRET = "...";
        ...
        com.auth0.jwt.algorithms.Algorithm.HMAC256($SECRET);
    - pattern: |
        class $CLASS {
          ...
          $TYPE $SECRET = "...";
          ...
          $RETURNTYPE $FUNC (...) {
            ...
            com.auth0.jwt.algorithms.Algorithm.HMAC256($SECRET);
            ...
          }
          ...
        }
    - pattern: |
        com.auth0.jwt.algorithms.Algorithm.HMAC384("...");
    - pattern: |
        $SECRET = "...";
        ...
        com.auth0.jwt.algorithms.Algorithm.HMAC384($SECRET);
    - pattern: |
        class $CLASS {
          ...
          $TYPE $SECRET = "...";
          ...
          $RETURNTYPE $FUNC (...) {
            ...
            com.auth0.jwt.algorithms.Algorithm.HMAC384($SECRET);
            ...
          }
          ...
        }
    - pattern: |
        com.auth0.jwt.algorithms.Algorithm.HMAC512("...");
    - pattern: |
        $SECRET = "...";
        ...
        com.auth0.jwt.algorithms.Algorithm.HMAC512($SECRET);
    - pattern: |
        class $CLASS {
          ...
          $TYPE $SECRET = "...";
          ...
          $RETURNTYPE $FUNC (...) {
            ...
            com.auth0.jwt.algorithms.Algorithm.HMAC512($SECRET);
            ...
          }
          ...
        }
  languages: [java]
  severity: ERROR
- id: java.java-jwt.security.jwt-none-alg.java-jwt-none-alg
  message: |
    Detected use of the 'none' algorithm in a JWT token.
    The 'none' algorithm assumes the integrity of the token has already
    been verified. This would allow a malicious actor to forge a JWT token
    that will automatically be verified. Do not explicitly use the 'none'
    algorithm. Instead, use an algorithm such as 'HS256'.
  metadata:
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg
    semgrep.ruleset: jwt
  languages: [java]
  severity: ERROR
  patterns:
  - pattern-either:
    - pattern: |
        $JWT.sign(com.auth0.jwt.algorithms.Algorithm.none());
    - pattern: |
        $NONE = com.auth0.jwt.algorithms.Algorithm.none();
        ...
        $JWT.sign($NONE);
    - pattern: |-
        class $CLASS {
          ...
          $TYPE $NONE = com.auth0.jwt.algorithms.Algorithm.none();
          ...
          $RETURNTYPE $FUNC (...) {
            ...
            $JWT.sign($NONE);
            ...
          }
          ...
        }
- id: java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify
  message: |
    Detected the decoding of a JWT token without a verify step.
    JWT tokens must be verified before use, otherwise the token's
    integrity is unknown. This means a malicious actor could forge
    a JWT token with any claims. Call '.verify()' before using the token.
  metadata:
    cwe: 'CWE-345: Insufficient Verification of Data Authenticity'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify
    semgrep.ruleset: jwt
  languages: [java]
  severity: WARNING
  patterns:
  - pattern: |
      com.auth0.jwt.JWT.decode(...);
  - pattern-not-inside: |-
      class $CLASS {
        ...
        $RETURNTYPE $FUNC (...) {
          ...
          $VERIFIER.verify(...);
          ...
        }
      }
- id: java.jjwt.secuirty.jwt-none-alg.jjwt-none-alg
  message: |
    Detected use of the 'none' algorithm in a JWT token.
    The 'none' algorithm assumes the integrity of the token has already
    been verified. This would allow a malicious actor to forge a JWT token
    that will automatically be verified. Do not explicitly use the 'none'
    algorithm. Instead, use an algorithm such as 'HS256'.
  metadata:
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.jjwt.secuirty.jwt-none-alg.jjwt-none-alg
    semgrep.ruleset: jwt
  languages: [java]
  severity: ERROR
  patterns:
  - pattern: |
      io.jsonwebtoken.Jwts.builder();
  - pattern-not-inside: |-
      $RETURNTYPE $FUNC(...) {
        ...
        $JWTS.signWith(...);
        ...
      }
- id: python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials
  languages:
  - python
  metadata:
    cwe: 'CWE-522: Insufficiently Protected Credentials'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    references:
    - https://cwe.mitre.org/data/definitions/522.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.jwt.security.jwt-exposed-credentials.jwt-python-exposed-credentials
    semgrep.ruleset: jwt
  message: |
    Password is exposed through JWT token payload. This is not encrypted and
    the password could be compromised. Do not store passwords in JWT tokens.
  pattern-either:
  - pattern: |
      jwt.encode({...,"password":$P,...},...)
  - pattern: |
      $PAYLOAD = {...,"password":$P,...}
      ...
      jwt.encode($PAYLOAD,...)
  severity: ERROR
- id: python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret
  message: |
    Hardcoded JWT secret or private key is used.
    This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html
    Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)
  metadata:
    cwe: 'CWE-522: Insufficiently Protected Credentials'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret
    semgrep.ruleset: jwt
  pattern-either:
  - pattern: |
      jwt.encode($X, "...", ...)
  - pattern: |
      $SECRET = "..."
      ...
      jwt.encode($X, $SECRET, ...)
  languages: [python]
  severity: ERROR
- id: python.jwt.security.jwt-none-alg.jwt-python-none-alg
  message: |
    Detected use of the 'none' algorithm in a JWT token.
    The 'none' algorithm assumes the integrity of the token has already
    been verified. This would allow a malicious actor to forge a JWT token
    that will automatically be verified. Do not explicitly use the 'none'
    algorithm. Instead, use an algorithm such as 'HS256'.
  metadata:
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.jwt.security.jwt-none-alg.jwt-python-none-alg
    semgrep.ruleset: jwt
  languages: [python]
  severity: ERROR
  pattern-either:
  - pattern: |
      jwt.encode(...,algorithm="none",...)
  - pattern: |-
      jwt.decode(...,algorithms=[...,"none",...],...)
- id: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode
  pattern: |
    jwt.decode(..., verify=False, ...)
  message: |
    Detected JWT token decoded with 'verify=False'. This bypasses any integrity
    checks for the token which means the token could be tampered with by
    malicious actors. Ensure that the JWT token is verified.
  metadata:
    owasp: 'A5: Broken Authentication'
    cwe: 'CWE-287: Improper Authentication'
    references:
    - https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode
    semgrep.ruleset: jwt
  fix-regex:
    regex: (verify\s*=\s*)False
    replacement: \1True
  severity: ERROR
  languages:
  - python
- id: python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data
  message: |
    The object is passed strictly to jwt.encode(...)
    Make sure that sensitive information is not exposed through JWT token payload.
  severity: WARNING
  metadata:
    owasp: A3:2017-Sensitive Data Exposure
    cwe: 'CWE-522: Insufficiently Protected Credentials'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.jwt.security.audit.jwt-exposed-data.jwt-python-exposed-data
    semgrep.ruleset: jwt
  languages: [python]
  patterns:
  - pattern-inside: |
      def $FUNC(...,$INPUT,...):
        ...
  - pattern: |-
      jwt.encode($INPUT,...)
- id: ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data
  message: |
    The object is passed strictly to jsonwebtoken.sign(...)
    Make sure that sensitive information is not exposed through JWT token payload.
  severity: WARNING
  metadata:
    owasp: A3:2017-Sensitive Data Exposure
    cwe: 'CWE-522: Insufficiently Protected Credentials'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ruby.jwt.security.audit.jwt-exposed-data.ruby-jwt-exposed-data
    semgrep.ruleset: jwt
  languages: [ruby]
  patterns:
  - pattern-inside: |
      require 'jwt'
      ...
  - pattern-inside: |
      def $FUNC(...,$INPUT,...)
        ...
      end
  - pattern: |
      JWT.encode($INPUT,...)
- id: ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify
  message: |
    Detected the decoding of a JWT token without a verify step.
    JWT tokens must be verified before use, otherwise the token's
    integrity is unknown. This means a malicious actor could forge
    a JWT token with any claims.
  metadata:
    cwe: 'CWE-345: Insufficient Verification of Data Authenticity'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify
    semgrep.ruleset: jwt
  languages: [ruby]
  severity: WARNING
  patterns:
  - pattern-inside: |
      require 'jwt'
      ...
  - pattern: |-
      JWT.decode($PAYLOAD,$SECRET,false,...)
- id: ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg
  message: |
    Detected use of the 'none' algorithm in a JWT token.
    The 'none' algorithm assumes the integrity of the token has already
    been verified. This would allow a malicious actor to forge a JWT token
    that will automatically be verified. Do not explicitly use the 'none'
    algorithm. Instead, use an algorithm such as 'HS256'.
  metadata:
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg
    semgrep.ruleset: jwt
  languages: [ruby]
  severity: ERROR
  patterns:
  - pattern-inside: |
      require 'jwt'
      ...
  - pattern: |
      JWT.encode($PAYLOAD, $SECRET, 'none', ...)
- id: ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials
  languages:
  - ruby
  metadata:
    cwe: 'CWE-522: Insufficiently Protected Credentials'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    references:
    - https://cwe.mitre.org/data/definitions/522.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ruby.jwt.security.jwt-exposed-credentials.ruby-jwt-exposed-credentials
    semgrep.ruleset: jwt
  message: |
    Password is exposed through JWT token payload. This is not encrypted and
    the password could be compromised. Do not store passwords in JWT tokens.
  patterns:
  - pattern-inside: |
      require 'jwt'
      ...
  - pattern: |
      $PAYLOAD = {...,password:...,...}
      ...
      JWT.encode($PAYLOAD,...)
  severity: ERROR
- id: ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret
  message: |
    Hardcoded JWT secret or private key is used.
    This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html
    Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)
  metadata:
    cwe: 'CWE-522: Insufficiently Protected Credentials'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret
    semgrep.ruleset: jwt
  patterns:
  - pattern-inside: |
      require 'jwt'
      ...
  - pattern-either:
    - pattern: |
        JWT.encode($PAYLOAD,"...",...)
    - pattern: |
        JWT.decode($PAYLOAD,"...",...)
    - pattern: |
        JWT.encode($PAYLOAD,nil,...)
    - pattern: |
        JWT.decode($PAYLOAD,nil,...)
    - pattern: |
        $SECRET = "..."
        ...
        JWT.encode($PAYLOAD,$SECRET,...)
    - pattern: |
        $SECRET = "..."
        ...
        JWT.decode($PAYLOAD,$SECRET,...)
  languages: [ruby]
  severity: ERROR
- id: ocaml.lang.compatibility.deprecated.deprecated-pervasives
  pattern: Pervasives.$X
  message: Pervasives is deprecated and will not be available after 4.10. Use Stdlib.
  languages: [ocaml]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ocaml.lang.compatibility.deprecated.deprecated-pervasives
    semgrep.ruleset: r2c-best-practices
- id: ocaml.lang.portability.slash_tmp.not-portable-tmp-string
  pattern: |
    "=~/\/tmp/"
  message: You should probably use Filename.get_temp_dirname().
  languages: [ocaml]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ocaml.lang.portability.slash_tmp.not-portable-tmp-string
    semgrep.ruleset: r2c-best-practices
- id: ocaml.lang.correctness.physical_vs_structural.physical-equal
  pattern: $X == $Y
  message: You probably want the structural inequality operator =
  languages: [ocaml]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ocaml.lang.correctness.physical_vs_structural.physical-equal
    semgrep.ruleset: r2c-best-practices
- id: ocaml.lang.correctness.physical_vs_structural.physical-not-equal
  pattern: $X != $Y
  message: You probably want the structural inequality operator <>
  languages: [ocaml]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ocaml.lang.correctness.physical_vs_structural.physical-not-equal
    semgrep.ruleset: r2c-best-practices
- id: ocaml.lang.correctness.useless_let.useless-let
  pattern: let $X = $E in $X
  message: Useless let
  languages: [ocaml]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ocaml.lang.correctness.useless_let.useless-let
    semgrep.ruleset: r2c-best-practices
- id: ocaml.lang.correctness.useless_if.ocamllint-useless-if
  pattern: if $X then $E else $E
  message: Useless if. Both branches are equal.
  languages: [ocaml]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ocaml.lang.correctness.useless_if.ocamllint-useless-if
    semgrep.ruleset: r2c-best-practices
- id: ocaml.lang.correctness.useless_eq.useless-equal
  pattern: $X = $X
  message: This is always true. If testing for floating point NaN, use `Float.is_nan`
    instead.
  languages: [ocaml]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ocaml.lang.correctness.useless_eq.useless-equal
    semgrep.ruleset: r2c-best-practices
- id: ocaml.lang.performance.list.ocamllint-length-list-zero
  pattern: List.length $X = 0
  message: You probably want $X = [], which is faster.
  languages: [ocaml]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ocaml.lang.performance.list.ocamllint-length-list-zero
    semgrep.ruleset: r2c-best-practices
- id: ocaml.lang.performance.list.ocamllint-length-more-than-zero
  pattern: List.length $X > 0
  message: You probably want $X <> [], which is faster.
  languages: [ocaml]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ocaml.lang.performance.list.ocamllint-length-more-than-zero
    semgrep.ruleset: r2c-best-practices
- id: ocaml.lang.best-practice.bool.ocamllint-bool-true
  pattern-either:
  - pattern: $X = true
  - pattern: $X == true
  - pattern: $X != false
  message: Comparison to boolean. Just use `$X`
  languages: [ocaml]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ocaml.lang.best-practice.bool.ocamllint-bool-true
    semgrep.ruleset: r2c-best-practices
- id: ocaml.lang.best-practice.bool.ocamllint-bool-false
  pattern-either:
  - pattern: $X = false
  - pattern: $X == false
  - pattern: $X <> true
  message: Comparison to boolean. Just use `not $X`
  languages: [ocaml]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ocaml.lang.best-practice.bool.ocamllint-bool-false
    semgrep.ruleset: r2c-best-practices
- id: ocaml.lang.best-practice.ifs.ocamllint-useless-else
  pattern: if $E then $E1 else ()
  message: Useless else. Just remove the else branch;
  languages: [ocaml]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ocaml.lang.best-practice.ifs.ocamllint-useless-else
    semgrep.ruleset: r2c-best-practices
- id: ocaml.lang.best-practice.ifs.ocamllint-backwards-if
  pattern: if $E then () else $E2
  message: Backwards if. Rewrite the code as 'if not $E then $E2'.
  languages: [ocaml]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ocaml.lang.best-practice.ifs.ocamllint-backwards-if
    semgrep.ruleset: r2c-best-practices
- id: ocaml.lang.best-practice.hashtbl.hashtbl-find-outside-try
  patterns:
  - pattern-either:
    - pattern: |
        Hashtbl.find ...
  - pattern-not-inside: |
      try ... with ... -> ...
  message: You should not use Hashtbl.find outside of a try, or you should use Hashtbl.find_opt
  languages: [ocaml]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ocaml.lang.best-practice.hashtbl.hashtbl-find-outside-try
    semgrep.ruleset: r2c-best-practices
- id: ocaml.lang.best-practice.list.list-find-outside-try
  patterns:
  - pattern-either:
    - pattern: |
        List.find ...
  - pattern-not-inside: |
      try ... with ... -> ...
  message: You should not use List.find outside of a try, or you should use List.find_opt
  languages: [ocaml]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ocaml.lang.best-practice.list.list-find-outside-try
    semgrep.ruleset: r2c-best-practices
- id: ocaml.lang.best-practice.string.ocamllint-str-first-chars
  pattern: String.sub $S 0 $N
  message: Use instead `Str.first_chars`
  languages: [ocaml]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ocaml.lang.best-practice.string.ocamllint-str-first-chars
    semgrep.ruleset: r2c-best-practices
- id: ocaml.lang.best-practice.string.ocamllint-str-string-after
  pattern: String.sub $S $N (String.length $S - $N)
  message: Use instead `Str.string_after`
  languages: [ocaml]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ocaml.lang.best-practice.string.ocamllint-str-string-after
    semgrep.ruleset: r2c-best-practices
- id: ocaml.lang.best-practice.string.ocamllint-str-last-chars
  pattern: String.sub $S (String.length $S - $N) $N
  message: Use instead `Str.last_chars`
  languages: [ocaml]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ocaml.lang.best-practice.string.ocamllint-str-last-chars
    semgrep.ruleset: r2c-best-practices
- id: ocaml.lang.best-practice.string.ocamllint-useless-sprintf
  pattern-either:
  - pattern: Printf.sprintf "..."
  - pattern: Printf.sprintf "%s" $S
  message: Useless sprintf
  languages: [ocaml]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ocaml.lang.best-practice.string.ocamllint-useless-sprintf
    semgrep.ruleset: r2c-best-practices
- id: ocaml.lang.best-practice.ref.ocamllint-ref-incr
  pattern: $X := $X + 1
  message: You should use `incr`
  languages: [ocaml]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ocaml.lang.best-practice.ref.ocamllint-ref-incr
    semgrep.ruleset: r2c-best-practices
- id: ocaml.lang.best-practice.ref.ocamllint-ref-decr
  pattern: $X := $X - 1
  message: You should use `decr
  languages: [ocaml]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ocaml.lang.best-practice.ref.ocamllint-ref-decr
    semgrep.ruleset: r2c-best-practices
- id: go.lang.maintainability.useless-ifelse.useless-if-conditional
  patterns:
  - pattern-either:
    - pattern: |-
        if ($X) {
            ...
        } else if ($X) {
            ...
        }
  message: |
    Detected an if block that checks for the same condition on both branches (`$X`)
  languages: [go]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.maintainability.useless-ifelse.useless-if-conditional
    semgrep.ruleset: r2c-best-practices
- id: go.lang.maintainability.useless-ifelse.useless-if-body
  patterns:
  - pattern: |-
      if ($X) {
          $S
      } else {
          $S
      }
  message: |
    Detected identical if-statement bodies. Is this intentional?
  languages: [go]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.maintainability.useless-ifelse.useless-if-body
    semgrep.ruleset: r2c-best-practices
- id: go.lang.correctness.permissions.file_permission.incorrect-default-permission
  message: Expect permissions to be `0600` or less for os.Chmod()
  metadata:
    cwe: 'CWE-276: Incorrect Default Permissions'
    source_rule_url: https://github.com/securego/gosec
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.correctness.permissions.file_permission.incorrect-default-permission
    semgrep.ruleset: r2c-best-practices
  severity: WARNING
  languages: [go]
  patterns:
  - pattern: |
      os.Chmod($NAME, $PERM)
  - metavariable-comparison:
      metavariable: $PERM
      comparison: $PERM > 0o600
      base: 8
- id: go.lang.correctness.permissions.file_permission.incorrect-default-permission
  message: Expect permissions to be `0600` or less for ioutil.WriteFile()
  metadata:
    cwe: 'CWE-276: Incorrect Default Permissions'
    source_rule_url: https://github.com/securego/gosec
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.correctness.permissions.file_permission.incorrect-default-permission
    semgrep.ruleset: r2c-best-practices
  severity: WARNING
  languages: [go]
  patterns:
  - pattern: |
      ioutil.WriteFile($NAME, $DATA, $PERM)
  - metavariable-comparison:
      metavariable: $PERM
      comparison: $PERM > 0o600
      base: 8
- id: go.lang.correctness.permissions.file_permission.incorrect-default-permission
  message: Expect permissions to be `0600` or less for ioutil.WriteFile()
  metadata:
    cwe: 'CWE-276: Incorrect Default Permissions'
    source_rule_url: https://github.com/securego/gosec
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.correctness.permissions.file_permission.incorrect-default-permission
    semgrep.ruleset: r2c-best-practices
  severity: WARNING
  languages: [go]
  patterns:
  - pattern: |
      os.Mkdir($NAME, $PERM)
  - metavariable-comparison:
      metavariable: $PERM
      comparison: $PERM > 0o600
      base: 8
- id: go.lang.correctness.permissions.file_permission.incorrect-default-permission
  message: Expect permissions to be `0600` or less for ioutil.WriteFile()
  metadata:
    cwe: 'CWE-276: Incorrect Default Permissions'
    source_rule_url: https://github.com/securego/gosec
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.correctness.permissions.file_permission.incorrect-default-permission
    semgrep.ruleset: r2c-best-practices
  severity: WARNING
  languages: [go]
  patterns:
  - pattern: |
      os.MkdirAll($NAME, $PERM)
  - metavariable-comparison:
      metavariable: $PERM
      comparison: $PERM > 0o600
      base: 8
- id: go.lang.correctness.permissions.file_permission.incorrect-default-permission
  message: Expect permissions to be `0600` or less for ioutil.WriteFile()
  metadata:
    cwe: 'CWE-276: Incorrect Default Permissions'
    source_rule_url: https://github.com/securego/gosec
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.correctness.permissions.file_permission.incorrect-default-permission
    semgrep.ruleset: r2c-best-practices
  severity: WARNING
  languages: [go]
  patterns:
  - pattern: |
      os.OpenFile($NAME, $FLAG, $PERM)
  - metavariable-comparison:
      metavariable: $PERM
      comparison: $PERM > 0o600
      base: 8
- id: go.lang.correctness.overflow.overflow.integer-overflow-int16
  message: Potential Integer overflow made by strconv.Atoi result conversion to int16
  languages: [go]
  severity: WARNING
  patterns:
  - pattern: |
      $F, $ERR := strconv.Atoi($NUM)
      ...
      int16($F)
  - metavariable-comparison:
      metavariable: $NUM
      comparison: $NUM > 32767 or $NUM < -32768
      strip: true
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.correctness.overflow.overflow.integer-overflow-int16
    semgrep.ruleset: r2c-best-practices
- id: go.lang.correctness.overflow.overflow.integer-overflow-int32
  message: Potential Integer overflow made by strconv.Atoi result conversion to int32
  languages: [go]
  severity: WARNING
  patterns:
  - pattern: |
      $F, $ERR := strconv.Atoi($NUM)
      ...
      int32($F)
  - metavariable-comparison:
      metavariable: $NUM
      comparison: $NUM > 2147483647 or $NUM < -2147483648
      strip: true
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.correctness.overflow.overflow.integer-overflow-int32
    semgrep.ruleset: r2c-best-practices
- id: go.lang.correctness.useless-eqeq.eqeq-is-bad
  patterns:
  - pattern-not-inside: assert(...)
  - pattern-either:
    - pattern: $X == $X
    - pattern: $X != $X
  - pattern-not: 1 == 1
  message: useless comparison operation `$X == $X` or `$X != $X`
  languages: [go]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.correctness.useless-eqeq.eqeq-is-bad
    semgrep.ruleset: r2c-best-practices
- id: go.lang.correctness.useless-eqeq.hardcoded-eq-true-or-false
  patterns:
  - pattern-either:
    - pattern: if (true) { ... }
    - pattern: if (false) { ... }
  message: useless if statement, always the same behavior
  languages: [go]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.correctness.useless-eqeq.hardcoded-eq-true-or-false
    semgrep.ruleset: r2c-best-practices
- id: go.lang.best-practice.channel-guarded-with-mutex.channel-guarded-with-mutex
  pattern-either:
  - pattern: |
      $MUX.Lock()
      $VALUE <- $CHANNEL
      $MUX.Unlock()
  - pattern: |
      $MUX.Lock()
      $VALUE = <- $CHANNEL
      $MUX.Unlock()
  message: |
    Detected a channel guarded with a mutex. Channels already have
    an internal mutex, so this is unnecessary. Remove the mutex.
    See https://hackmongo.com/page/golang-antipatterns/#guarded-channel
    for more information.
  languages: [go]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.best-practice.channel-guarded-with-mutex.channel-guarded-with-mutex
    semgrep.ruleset: r2c-best-practices
- id: go.lang.best-practice.hidden-goroutine.hidden-goroutine
  patterns:
  - pattern-not: |
      func $FUNC(...) {
        go func() {
          ...
        }(...)
        $MORE
      }
  - pattern: |
      func $FUNC(...) {
        go func() {
          ...
        }(...)
      }
  message: |
    Detected a hidden goroutine. Function invocations are expected to synchronous,
    and this function will execute asynchronously because all it does is call a
    goroutine. Instead, remove the internal goroutine and call the function using 'go'.
  languages: [go]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.best-practice.hidden-goroutine.hidden-goroutine
    semgrep.ruleset: r2c-best-practices
- id: python.flask.maintainability.deprecated.deprecated-apis.flask-deprecated-apis
  patterns:
  - pattern-either:
    - pattern: |
        $F = Flask(...)
        ...
        $F.open_session(...)
    - pattern: |
        $F = Flask(...)
        ...
        $F.save_session(...)
    - pattern: |
        $F = Flask(...)
        ...
        $F.make_null_session(...)
    - pattern: |
        $F = Flask(...)
        ...
        $F.init_jinja_globals(...)
    - pattern: |
        $F = Flask(...)
        ...
        $F.request_globals_class(...)
    - pattern: |
        $F = Flask(...)
        ...
        $F.static_path(...)
    - pattern: app.open_session(...)
    - pattern: app.save_session(...)
    - pattern: app.make_null_session(...)
    - pattern: app.init_jinja_globals(...)
    - pattern: app.request_globals_class(...)
    - pattern: app.static_path(...)
    - pattern: app.config.from_json(...)
    - pattern: flask.json_available
    - pattern: flask.request.module
    - pattern: flask.testing.make_test_environ_builder(...)
  message: deprecated Flask API
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.flask.maintainability.deprecated.deprecated-apis.flask-deprecated-apis
    semgrep.ruleset: r2c-best-practices
- id: python.flask.correctness.same-handler-name.flask-duplicate-handler-name
  pattern: |
    @app.route("...", ...)
    def $R(...):
        ...
    ...
    @app.route("...", ...)
    def $R(...):
        ...
  message: Looks like `$R` is a flask function handler that registered to two different
    routes. This will cause a runtime error
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.flask.correctness.same-handler-name.flask-duplicate-handler-name
    semgrep.ruleset: r2c-best-practices
- id: python.flask.correctness.access-request-in-wrong-handler.avoid-accessing-request-in-wrong-handler
  patterns:
  - pattern-inside: |
      @app.route(..., method="GET")
      def $X(...):
        ...
  - pattern-either:
    - pattern: |
        $Y = flask.request.json
    - pattern: |
        $Y = flask.request.form
    - pattern: |
        $Y = flask.request.data
  message: Accessing request object inside a route handle for HTTP GET command will
    throw due to missing request body.
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.flask.correctness.access-request-in-wrong-handler.avoid-accessing-request-in-wrong-handler
    semgrep.ruleset: r2c-best-practices
- id: python.flask.best-practice.use-jsonify.use-jsonify
  patterns:
  - pattern-inside: |
      @app.route(...)
      def $X():
        ...
  - pattern-either:
    - pattern: return json.dumps(...)
    - pattern: |
        $DATA = json.dumps(...)
        ...
        return <... $DATA ...>
  fix-regex:
    regex: (json\.){0,1}dumps
    replacement: flask.jsonify
    count: 1
  message: flask.jsonify() is a Flask helper method which handles the correct settings
    for returning JSON from Flask routes
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.flask.best-practice.use-jsonify.use-jsonify
    semgrep.ruleset: r2c-best-practices
- id: python.flask.best-practice.get-class-method-with-side-effects.flask-class-method-get-side-effects
  patterns:
  - pattern-either:
    - pattern: |
        def get(self,...):
            ...
            $METHOD(...)
    - pattern: |
        def get(self,...):
            ...
            $VAR = $METHOD(...)
  - metavariable-regex:
      metavariable: $METHOD
      regex: (?i)(create|update|delete).*
  message: |
    Flask class method GET with side effects
  severity: WARNING
  languages: [python]
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.flask.best-practice.get-class-method-with-side-effects.flask-class-method-get-side-effects
    semgrep.ruleset: r2c-best-practices
- id: python.bokeh.maintainability.deprecated.deprecated_apis.bokeh-deprecated-apis
  patterns:
  - pattern-either:
    - pattern: |
        import bokeh.layouts.widgetbox
    - pattern: |
        import bokeh.models.graphs.from_networkx
  message: |
    These APIs are deprecated in Bokeh see https://docs.bokeh.org/en/latest/docs/releases.html#api-deprecations
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.bokeh.maintainability.deprecated.deprecated_apis.bokeh-deprecated-apis
    semgrep.ruleset: r2c-best-practices
- id: python.click.best-practice.echo-style.use-click-secho
  pattern: click.echo(click.style($X, ...))
  message: Use `click.secho($X)` instead. It combines click.echo() and click.style().
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.click.best-practice.echo-style.use-click-secho
    semgrep.ruleset: r2c-best-practices
- id: python.sqlalchemy.correctness.delete-where.delete-where-no-execute
  patterns:
  - pattern: $X.delete().where(...)
  - pattern-not-inside: $X.delete().where(...).execute()
  - pattern-not-inside: $C.execute(...)
  message: .delete().where(...) results in a no-op in SQLAlchemy unless the command
    is executed, use .filter(...).delete() instead.
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.sqlalchemy.correctness.delete-where.delete-where-no-execute
    semgrep.ruleset: r2c-best-practices
- id: python.sqlalchemy.correctness.bad-operator-in-filter.bad-operator-in-filter
  languages: [python]
  message: |
    Only comparison operators should be used inside SQLAlchemy filter expressions. Use `==` instead of `is`,
    `!=` instead of `is not`, `sqlalchemy.and_` instead of `and`, `sqlalchemy.or_` instead of `or`,
    `sqlalchemy.not_` instead of `not`, and `sqlalchemy.in_` instead of `in_`.
  metadata:
    references:
    - https://docs.sqlalchemy.org/en/13/orm/tutorial.html#common-filter-operators
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.sqlalchemy.correctness.bad-operator-in-filter.bad-operator-in-filter
    semgrep.ruleset: r2c-best-practices
  patterns:
  - pattern-inside: |
      def $ANY(...):
          ...
          $MODEL.query
  - pattern-inside: |
      $TARGET.filter(...)
  - pattern-either:
    - pattern: not $A
    - pattern: $A is $B
    - pattern: $A is not $B
    - pattern: $A and $B
    - pattern: $A or $B
    - pattern: $A in $B
    - pattern: $A not in $B
  severity: WARNING
- id: python.sqlalchemy.performance.performance-improvements.len-all-count
  pattern: len($X.all())
  message: Using QUERY.count() instead of len(QUERY.all()) sends less data to the
    client since the SQLAlchemy method is performed server-side.
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.len-all-count
    semgrep.ruleset: r2c-best-practices
- id: python.sqlalchemy.performance.performance-improvements.batch-import
  pattern: |
    for $X in $Y:
      db.session.add($Z)
  message: Rather than adding one element at a time, consider batch loading to improve
    performance.
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.sqlalchemy.performance.performance-improvements.batch-import
    semgrep.ruleset: r2c-best-practices
- id: python.requests.best-practice.use-raise-for-status.use-raise-for-status
  patterns:
  - pattern-either:
    - pattern: requests.request(...)
    - pattern: requests.get(...)
    - pattern: requests.post(...)
    - pattern: requests.put(...)
    - pattern: requests.delete(...)
    - pattern: requests.head(...)
    - pattern: requests.patch(...)
  - pattern-not-inside: |
      $RESP = requests.$METHOD(...)
      $RESP.raise_for_status(...)
  - pattern-not-inside: |
      requests.$METHOD(...).raise_for_status(...)
  - pattern-not-inside: |
      $RESP = requests.$METHOD(...)
      if $RESP.status_code == ...:
        ...
  - pattern-not-inside: |
      $RESP = requests.$METHOD(...)
      if $RESP.status_code != ...:
        ...
  - pattern-not-inside: |
      $RESP = requests.$METHOD(...)
      ...
      if $RESP.ok:
        ...
  - pattern-not-inside: |
      $RESP = requests.$METHOD(...)
      ...
      if not $RESP.ok:
        ...
  message: |-
    There's an HTTP request made with requests,
    but the raise_for_status() utility method isn't used.
    This can result in request errors going unnoticed
    and your code behaving in unexpected ways,
    such as if your authorization API returns a 500 error
    while you're only checking for a 401.
  metadata:
    references:
    - https://requests.readthedocs.io/en/master/api/#requests.Response.raise_for_status
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.requests.best-practice.use-raise-for-status.use-raise-for-status
    semgrep.ruleset: r2c-best-practices
  severity: WARNING
  languages:
  - python
- id: python.requests.best-practice.use-timeout.use-timeout
  patterns:
  - pattern-not: requests.$W(..., timeout=$N, ...)
  - pattern-not: requests.$W(..., **$KWARGS)
  - pattern-either:
    - pattern: requests.request(...)
    - pattern: requests.get(...)
    - pattern: requests.post(...)
    - pattern: requests.put(...)
    - pattern: requests.delete(...)
    - pattern: requests.head(...)
    - pattern: requests.patch(...)
  fix-regex:
    regex: (.*)\)
    replacement: \1, timeout=30)
  message: |
    By default, 'requests' calls wait until the connection is closed.
    This means a 'requests' call without a timeout will hang the program
    if a response is never received. Consider setting a timeout for all
    'requests'.
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.requests.best-practice.use-timeout.use-timeout
    semgrep.ruleset: r2c-best-practices
- id: python.lang.compatibility.python37.python37-compatibility-importlib
  pattern: importlib.source_hash()
  message: this function is only available on Python 3.7+
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib
    semgrep.ruleset: r2c-best-practices
- id: python.lang.compatibility.python37.python37-compatibility-importlib2
  pattern: import importlib.resources
  message: this module is only available on Python 3.7+; use importlib_resources for
    older Python versions
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib2
    semgrep.ruleset: r2c-best-practices
- id: python.lang.compatibility.python37.python37-compatibility-importlib3
  pattern: import importlib.abc.ResourceReader
  message: this module is only available on Python 3.7+
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib3
    semgrep.ruleset: r2c-best-practices
- id: python.lang.compatibility.python37.python37-compatibility-importlib2
  pattern: import importlib.resources
  message: this module is only available on Python 3.7+; use importlib_resources for
    older Python versions
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib2
    semgrep.ruleset: r2c-best-practices
- id: python.lang.compatibility.python37.python37-compatibility-httpconn
  pattern: http.client.HTTPConnection(blocksize=$X,...)
  message: HTTPConnection blocksize keyword argument is Python 3.7+ only
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpconn
    semgrep.ruleset: r2c-best-practices
- id: python.lang.compatibility.python37.python37-compatibility-httpsconn
  pattern: http.client.HTTPSConnection(blocksize=$X,...)
  message: HTTPSConnection blocksize keyword argument is Python 3.7+ only
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-httpsconn
    semgrep.ruleset: r2c-best-practices
- id: python.lang.compatibility.python37.python37-compatibility-importlib3
  pattern: import importlib.abc.ResourceReader
  message: this module is only available on Python 3.7+
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-importlib3
    semgrep.ruleset: r2c-best-practices
- id: python.lang.compatibility.python37.python37-compatibility-textiowrapper
  pattern: TextIOWrapper.reconfigure(...)
  message: this function is only available on Python 3.7+
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-textiowrapper
    semgrep.ruleset: r2c-best-practices
- id: python.lang.compatibility.python37.python37-compatibility-ipv6network1
  pattern: ipaddress.IPv6Network.subnet_of($X)
  message: this function is only available on Python 3.7+
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network1
    semgrep.ruleset: r2c-best-practices
- id: python.lang.compatibility.python37.python37-compatibility-ipv6network2
  pattern: ipaddress.IPv6Network.supernet_of($X)
  message: this function is only available on Python 3.7+
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv6network2
    semgrep.ruleset: r2c-best-practices
- id: python.lang.compatibility.python37.python37-compatibility-ipv4network1
  pattern: ipaddress.IPv4Network.subnet_of($X)
  message: this function is only available on Python 3.7+
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network1
    semgrep.ruleset: r2c-best-practices
- id: python.lang.compatibility.python37.python37-compatibility-ipv4network2
  pattern: ipaddress.IPv4Network.supernet_of($X)
  message: this function is only available on Python 3.7+
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-ipv4network2
    semgrep.ruleset: r2c-best-practices
- id: python.lang.compatibility.python37.python37-compatibility-locale1
  pattern: locale.format_string(monetary=$X, ...)
  message: this function is only available on Python 3.7+
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-locale1
    semgrep.ruleset: r2c-best-practices
- id: python.lang.compatibility.python37.python37-compatibility-math1
  pattern: math.remainder($X, $Y)
  message: this function is only available on Python 3.7+
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-math1
    semgrep.ruleset: r2c-best-practices
- id: python.lang.compatibility.python37.python37-compatibility-multiprocess1
  pattern: multiprocessing.Process.close()
  message: this function is only available on Python 3.7+
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess1
    semgrep.ruleset: r2c-best-practices
- id: python.lang.compatibility.python37.python37-compatibility-multiprocess2
  pattern: multiprocessing.Process.kill()
  message: this function is only available on Python 3.7+
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-multiprocess2
    semgrep.ruleset: r2c-best-practices
- id: python.lang.compatibility.python37.python37-compatibility-os1
  pattern: os.preadv(...)
  message: this function is only available on Python 3.7+
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os1
    semgrep.ruleset: r2c-best-practices
- id: python.lang.compatibility.python37.python37-compatability-os-module
  patterns:
  - pattern-not-inside: |
      if hasattr(os, 'pwrite'):
          ...
  - pattern: os.pwrite(...)
  message: this function is only available on Python 3.7+
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatability-os-module
    semgrep.ruleset: r2c-best-practices
- id: python.lang.compatibility.python37.python37-compatibility-os2-ok2
  patterns:
  - pattern-not-inside: |
      if hasattr(os, 'pwritev'):
          ...
  - pattern: os.pwritev(...)
  message: this function is only available on Python 3.7+
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-os2-ok2
    semgrep.ruleset: r2c-best-practices
- id: python.lang.compatibility.python37.python37-compatibility-pdb
  pattern: pdb.set_trace(header=$X, ...)
  message: this function is only available on Python 3.7+
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.compatibility.python37.python37-compatibility-pdb
    semgrep.ruleset: r2c-best-practices
- id: python.lang.compatibility.python36.python36-compatibility-ssl
  pattern: ssl.get_ciphers()
  message: this function is only available on Python 3.6+
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-ssl
    semgrep.ruleset: r2c-best-practices
- id: python.lang.compatibility.python36.python36-compatibility-Popen1
  pattern: subprocess.Popen(errors=$X, ...)
  message: the `errors` argument to Popen is only available on Python 3.6+
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen1
    semgrep.ruleset: r2c-best-practices
- id: python.lang.compatibility.python36.python36-compatibility-Popen2
  pattern: subprocess.Popen(encoding=$X, ...)
  message: the `encoding` argument to Popen is only available on Python 3.6+
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.compatibility.python36.python36-compatibility-Popen2
    semgrep.ruleset: r2c-best-practices
- id: python.lang.maintainability.useless-ifelse.useless-if-conditional
  patterns:
  - pattern-either:
    - pattern: |
        if $X:
            ...
        elif $X:
            ...
  message: if block checks for the same condition on both branches (`$X`)
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.maintainability.useless-ifelse.useless-if-conditional
    semgrep.ruleset: r2c-best-practices
- id: python.lang.maintainability.useless-ifelse.useless-if-body
  patterns:
  - pattern: |
      if $X:
          $S
      else:
          $S
  message: useless if statment; both blocks have the same body
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.maintainability.useless-ifelse.useless-if-body
    semgrep.ruleset: r2c-best-practices
- id: python.lang.maintainability.return.code-after-unconditional-return
  patterns:
  - pattern: |
      return ...
      $S
  message: code after return statement will not be executed
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.maintainability.return.code-after-unconditional-return
    semgrep.ruleset: r2c-best-practices
- id: python.lang.maintainability.return.return-not-in-function
  patterns:
  - pattern-not-inside: |
      def $F(...):
          ...
      # TODO: first pattern should just automatically include this one
  - pattern-not-inside: |
      def $F(...) ->  $Y:
          ...
  - pattern: return ...
  message: '`return` only makes sense inside a function'
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.maintainability.return.return-not-in-function
    semgrep.ruleset: r2c-best-practices
- id: python.lang.maintainability.useless-literal.useless-literal-dict
  patterns:
  - pattern-either:
    - pattern: |
        {..., $X: $A, ..., $X: $B, ...}
    - pattern: |
        dict(..., ($X, $A), ..., ($X, $B), ...)
  message: key `$X` is uselessly assigned twice
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.maintainability.useless-literal.useless-literal-dict
    semgrep.ruleset: r2c-best-practices
- id: python.lang.maintainability.useless-literal.useless-literal-set
  patterns:
  - pattern: |
      set(..., ($X, $A), ..., ($X, $B), ...)
  message: '`$X` is uselessly assigned twice inside the creation of the set'
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.maintainability.useless-literal.useless-literal-set
    semgrep.ruleset: r2c-best-practices
- id: python.lang.maintainability.useless-assign-keyed.useless-assignment-keyed
  patterns:
  - pattern-either:
    - pattern: |
        $X[$Y] = ...
        $X[$Y] = ...
    - pattern: |
        $X[$Y][$Z] = ...
        $X[$Y][$Z] = ...
  message: key `$Y` in `$X` is assigned twice; the first assignment is useless
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.maintainability.useless-assign-keyed.useless-assignment-keyed
    semgrep.ruleset: r2c-best-practices
- id: python.lang.maintainability.useless-innerfunction.useless-inner-function
  patterns:
  - pattern-not-inside: |
      def $F(...):
          ...
          def $FF(...):
             ...
          ...
          <... $FF ...>
  - pattern-not-inside: |
      def $F(...):
          ...
          class $CLAZZ(...):
            ...
  - pattern-inside: |
      def $F(...):
        ...
        def $FF(...):
           ...
        ...
  # We want to report where the inner function is defined, so
  # we add a "pattern" match for the inner function only
  - pattern: |
      def $FF(...):
        ...
  message: function `$FF` is defined inside a function but never used
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.maintainability.useless-innerfunction.useless-inner-function
    semgrep.ruleset: r2c-best-practices
- id: python.lang.correctness.writing-to-file-in-read-mode.writing-to-file-in-read-mode
  message: |
    The file object '$FD' was opened in read mode, but is being
    written to. This will cause a runtime error.
  patterns:
  - pattern-either:
    - pattern-inside: |
        $FD = open($NAME, "r", ...)
        ...
    - pattern-inside: |
        $FD = open($NAME, "rb", ...)
        ...
    - pattern-inside: |
        with open($NAME, "r", ...) as $FD:
          ...
    - pattern-inside: |
        with open($NAME, "rb", ...) as $FD:
          ...
  - pattern: $FD.write(...)
  severity: ERROR
  languages:
  - python
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.correctness.writing-to-file-in-read-mode.writing-to-file-in-read-mode
    semgrep.ruleset: r2c-best-practices
- id: python.lang.correctness.exit.use-sys-exit
  languages:
  - python
  message: Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper
    for the interactive shell and may not be available on all Python implementations.
    https://stackoverflow.com/questions/6501121/difference-between-exit-and-sys-exit-in-python
  patterns:
  - pattern: exit(...)
  - pattern-not: sys.exit(...)
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.correctness.exit.use-sys-exit
    semgrep.ruleset: r2c-best-practices
- id: python.lang.correctness.pdb.pdb-remove
  pattern-either:
  - pattern: pdb.$X(...)
  - pattern: pdb.Pdb.$X(...)
  message: |
    pdb is an interactive debugging tool and you may have forgotten to remove it before committing your code
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.correctness.pdb.pdb-remove
    semgrep.ruleset: r2c-best-practices
- id: python.lang.correctness.list-modify-iterating.list-modify-while-iterate
  patterns:
  - pattern-either:
    - pattern: |
        for $ELEMENT in $LIST:
          ...
          $LIST.pop(...)
    - pattern: |
        for $ELEMENT in $LIST:
          ...
          $LIST.push(...)
    - pattern: |
        for $ELEMENT in $LIST:
          ...
          $LIST.append(...)
    - pattern: |
        for $ELEMENT in $LIST:
          ...
          $LIST.extend(...)
  message: |
    It appears that `$LIST` is a list that is being modified while in a for loop.
    This will likely cause a runtime error or an infinite loop.
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.correctness.list-modify-iterating.list-modify-while-iterate
    semgrep.ruleset: r2c-best-practices
- id: python.lang.correctness.concurrent.uncaught-executor-exceptions
  patterns:
  - pattern-inside: |
      with concurrent.futures.thread.ThreadPoolExecutor(...) as $EXECUTOR:
        ...
  - pattern-not-inside: |
      $VAR = $EXECUTOR.map(...)
      ...
      for ... in $VAR:
        ...
  - pattern-not-inside: |
      $VAR = $EXECUTOR.map(...)
      ...
      [... for ... in $VAR]
  - pattern-not-inside: |
      [... for ... in $EXECUTOR.map(...)]
  - pattern-not-inside: |
      for $IT in $EXECUTOR.map(...):
        ...
  - pattern: $EXECUTOR.map(...)
  message: |
    Values returned by thread pool map must be read in order to raise exceptions. Consider using `for _ in $EXECUTOR.map(...): pass`.
  fix: |
  severity: WARNING
  languages:
  - python
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.correctness.concurrent.uncaught-executor-exceptions
    semgrep.ruleset: r2c-best-practices
- id: python.lang.correctness.exceptions.exceptions.raise-not-base-exception
  patterns:
  - pattern-either:
    - pattern: raise "..."
    - pattern: |
        $X: BaseException
        raise $X(...)
    - patterns:
      - pattern: raise $EXCEPTION
      - metavariable-regex:
          metavariable: $EXCEPTION
          regex: '[0-9]*\.?[0-9]+'
  message: In Python3, a runtime `TypeError` will be thrown if you attempt to raise
    an object or class which does not inherit from `BaseException`
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.correctness.exceptions.exceptions.raise-not-base-exception
    semgrep.ruleset: r2c-best-practices
- id: python.lang.correctness.return-in-init.return-in-init
  patterns:
  - pattern-inside: |
      class A(...):
          ...
          def __init__(...):
              ...
  - pattern: return ...
  message: '`return` should never appear inside a class __init__ function. This will
    cause a runtime error.'
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.correctness.return-in-init.return-in-init
    semgrep.ruleset: r2c-best-practices
- id: python.lang.correctness.return-in-init.yield-in-init
  patterns:
  - pattern-inside: |
      class $A(...):
          ...
  - pattern-inside: |
      def __init__(...):
          ...
  - pattern-either:
    - pattern: |
        yield ...
    - pattern: |
        yield
  message: '`yield` should never appear inside a class __init__ function. This will
    cause a runtime error.'
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.correctness.return-in-init.yield-in-init
    semgrep.ruleset: r2c-best-practices
- id: python.lang.correctness.file-object-redefined-before-close.file-object-redefined-before-close
  patterns:
  - pattern: |
      $F = open($X, ...)
      ...
      $F = open($Y, ...)
  - pattern-not: |
      $F = open($X, ...)
      ...
      $F.close()
      ...
      $F = open($Y, ...)
  message: |
    Detected a file object that is redefined and never closed. This
    could leak file descriptors and unnecessarily consume system resources.
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.correctness.file-object-redefined-before-close.file-object-redefined-before-close
    semgrep.ruleset: r2c-best-practices
- id: python.lang.correctness.baseclass-attribute-override.baseclass-attribute-override
  patterns:
  - pattern: |
      class $A(...):
        def $F(...):
         ...
      ...
      class $B(...):
        def $F(...):
         ...
      ...
      class $C(..., $A, $B, ...):
         ...
  message: Class $C inherits from both `$A` and `$B` which both have a method named
    `$F`; one of these methods will be overwritten
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.correctness.baseclass-attribute-override.baseclass-attribute-override
    semgrep.ruleset: r2c-best-practices
- id: python.lang.correctness.unchecked-returns.unchecked-subprocess-call
  patterns:
  - pattern: subprocess.call(...)
  - pattern-not-inside: $S = subprocess.call(...)
  - pattern-not-inside: subprocess.call(...) == $X
  - pattern-not-inside: return subprocess.call(...)
  fix: subprocess.check_call(...)
  message: This is not checking the return value of this subprocess call; if it fails
    no exception will be raised. Consider subprocess.check_call() instead
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.correctness.unchecked-returns.unchecked-subprocess-call
    semgrep.ruleset: r2c-best-practices
- id: python.lang.correctness.tempfile.mktemp.tempfile-insecure
  pattern: tempfile.mktemp(...)
  message: 'Use tempfile.NamedTemporaryFile instead. From the official Python documentation:
    THIS FUNCTION IS UNSAFE AND SHOULD NOT BE USED. The file name may refer to a file
    that did not exist at some point, but by the time you get around to creating it,
    someone else may have beaten you to the punch.'
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.correctness.tempfile.mktemp.tempfile-insecure
    semgrep.ruleset: r2c-best-practices
- id: python.lang.correctness.tempfile.flush.tempfile-without-flush
  pattern-either:
  - patterns:
    - pattern-not-inside: |
        $F = tempfile.NamedTemporaryFile(...)
        ...
        $F.write(...)
        ...
        $F.flush()
        ...
        $F.name
    - pattern-not-inside: |
        $F = tempfile.NamedTemporaryFile(...)
        ...
        $F.write(...)
        ...
        $F.close()
        ...
        $F.name
    - pattern-not-inside: |
        $F = tempfile.NamedTemporaryFile(..., delete=False, ...)
        ...
        $F.close()
        ...
        $F.name
    - pattern-inside: |
        $F = tempfile.NamedTemporaryFile(...)
        ...
    - pattern: |
        $F.name
  - patterns:
    - pattern-not-inside: |
        with tempfile.NamedTemporaryFile(...) as $F:
            ...
            $F.write(...)
            ...
            $F.flush()
            ...
            $F.name
    - pattern-not-inside: |
        with tempfile.NamedTemporaryFile(...) as $F:
            ...
            $F.write(...)
            ...
            $F.close()
            ...
            $F.name
    - pattern-inside: |
        with tempfile.NamedTemporaryFile(...) as $F:
            ...
    - pattern: |
        $F.name
  message: >-
    Using '$F.name' without '.flush()' or '.close()' may cause an error because the
    file may not exist
    when '$F.name' is used. Use '.flush()' or close the file before using '$F.name'.
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.correctness.tempfile.flush.tempfile-without-flush
    semgrep.ruleset: r2c-best-practices
- id: python.lang.correctness.dict-modify-iterating.dict-del-while-iterate
  patterns:
  - pattern-either:
    - pattern: |
        for $KEY, $VALUE in $DICT.items():
            ...
            del $DICT[$KEY]
    - pattern: |
        for $KEY in $DICT.keys():
            ...
            del $DICT[$KEY]
  message: 'It appears that `$DICT[$KEY]` is a dict with items being deleted while
    in a for loop. This is usually a bad idea and will likely lead to a RuntimeError:
    dictionary changed size during iteration'
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.correctness.dict-modify-iterating.dict-del-while-iterate
    semgrep.ruleset: r2c-best-practices
- id: python.lang.correctness.common-mistakes.is-not-is-not.is-not-is-not
  patterns:
  - pattern: $S is (not ...)
  message: In python 'X is not ...' is different from 'X is (not ...)'. In the latter
    the 'not' converts the '...' directly to boolean.
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.correctness.common-mistakes.is-not-is-not.is-not-is-not
    semgrep.ruleset: r2c-best-practices
- id: python.lang.correctness.common-mistakes.default-mutable-dict.default-mutable-dict
  patterns:
  - pattern-either:
    - patterns:
      - pattern: |
          def $F(..., $D={}, ...):
            ...
            $D[...] = ...
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = {}
            ...
            $D[...] = ...
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = dict(...)
            ...
            $D[...] = ...
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = $D.copy()
            ...
            $D[...] = ...
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = copy.deepcopy($D)
            ...
            $D[...] = ...
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = copy.copy($D)
            ...
            $D[...] = ...
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = dict.copy($D)
            ...
            $D[...] = ...
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = {... for ... in ...}
            ...
            $D[...] = ...
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = $D or {}
            ...
            $D[...] = ...
      - pattern-not-inside: |
          def $A(...):
            ...
            def $F(..., $D={}, ...):
              ...
              $D[...] = ...
    - patterns:
      - pattern: |
          def $F(..., $D={}, ...):
            ...
            $D.update(...)
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = {}
            ...
            $D.update(...)
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = dict(...)
            ...
            $D.update(...)
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = $D.copy()
            ...
            $D.update(...)
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = copy.deepcopy($D)
            ...
            $D.update(...)
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = copy.copy($D)
            ...
            $D.update(...)
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = dict.copy($D)
            ...
            $D.update(...)
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = {... for ... in ...}
            ...
            $D.update(...)
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = $D or {}
            ...
            $D.update(...)
      - pattern-not-inside: |
          def $A(...):
            ...
            def $F(..., $D={}, ...):
              ...
              $D.update(...)
    - patterns:
      - pattern: |
          def $F(..., $D={}, ...):
            ...
            $D.setdefault(...)
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = {}
            ...
            $D.setdefault(...)
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = dict(...)
            ...
            $D.setdefault(...)
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = $D.copy()
            ...
            $D.setdefault(...)
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = copy.deepcopy($D)
            ...
            $D.setdefault(...)
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = copy.copy($D)
            ...
            $D.setdefault(...)
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = dict.copy($D)
            ...
            $D.setdefault(...)
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = {... for ... in ...}
            ...
            $D.setdefault(...)
      - pattern-not: |
          def $F(..., $D={}, ...):
            ...
            $D = $D or {}
            ...
            $D.setdefault(...)
      - pattern-not-inside: |
          def $A(...):
            ...
            def $F(..., $D={}, ...):
              ...
              $D.setdefault(...)
  message: Function $F mutates default dict $D. Instances of default function arguments
    in Python are shared between function calls.  Mutating a default function argument
    changes the result for all function consumers. This will most likely cause unexpected
    results, or lead to security vulnerabilities whereby one function consumer can
    either view or modify the data of another function consumer.
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.correctness.common-mistakes.default-mutable-dict.default-mutable-dict
    semgrep.ruleset: r2c-best-practices
- id: python.lang.correctness.common-mistakes.string-concat-in-list.string-concat-in-list
  patterns:
  - pattern-either:
    - pattern-inside: |
        [...]
    - pattern-inside: |
        {...}
  - pattern: |
      "..." "..."
  - pattern-not-inside: |
      f"..."
  message: |
    Detected strings that are implicitly concatenated inside a list.
    Python will implicitly concatenate strings when not explicitly delimited.
    Was this supposed to be individual elements of the list?
  severity: WARNING
  languages:
  - python
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.correctness.common-mistakes.string-concat-in-list.string-concat-in-list
    semgrep.ruleset: r2c-best-practices
- id: python.lang.correctness.common-mistakes.is-comparison-string.identical-is-comparison
  pattern: $S is $S
  message: Found identical comparison using is. Ensure this is what you intended.
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.correctness.common-mistakes.is-comparison-string.identical-is-comparison
    semgrep.ruleset: r2c-best-practices
- id: python.lang.correctness.common-mistakes.is-comparison-string.string-is-comparison
  patterns:
  - pattern-not: $S is None
  - pattern-not: type($X) is $T
  - pattern-not: $S is True
  - pattern-not: $S is False
  - pattern-not: $S is ""
  - pattern-either:
    - pattern: $S is "..."
    - pattern: '"..." is $S'
  message: |
    Found string comparison using 'is' operator. The 'is' operator
    is for reference equality, not value equality, and therefore should
    not be used to compare strings. For more information, see
    https://github.com/satwikkansal/wtfpython#-how-not-to-use-is-operator"
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.correctness.common-mistakes.is-comparison-string.string-is-comparison
    semgrep.ruleset: r2c-best-practices
- id: python.lang.correctness.common-mistakes.default-mutable-list.default-mutable-list
  patterns:
  - pattern-either:
    - patterns:
      - pattern: |
          def $F(..., $D=[], ...):
            ...
            $D.append(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = []
            ...
            $D.append(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = [...]
            ...
            $D.append(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = list(...)
            ...
            $D.append(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = copy.deepcopy($D)
            ...
            $D.append(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = copy.copy($D)
            ...
            $D.append(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = list.copy($D)
            ...
            $D.append(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = $D[:]
            ...
            $D.append(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = [... for ... in ...]
            ...
            $D.append(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = $D or []
            ...
            $D.append(...)
      - pattern-not-inside: |
          def $A(...):
            ...
            def $F(..., $D=[], ...):
              ...
              $D.append(...)
    - patterns:
      - pattern: |
          def $F(..., $D=[], ...):
            ...
            $D.extend(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = []
            ...
            $D.extend(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = [...]
            ...
            $D.extend(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = list(...)
            ...
            $D.extend(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = copy.deepcopy($D)
            ...
            $D.extend(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = copy.copy($D)
            ...
            $D.extend(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = list.copy($D)
            ...
            $D.extend(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = $D[:]
            ...
            $D.extend(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = [... for ... in ...]
            ...
            $D.extend(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = $D or []
            ...
            $D.extend(...)
      - pattern-not-inside: |
          def $A(...):
            ...
            def $F(..., $D=[], ...):
              ...
              $D.extend(...)
    - patterns:
      - pattern: |
          def $F(..., $D=[], ...):
            ...
            $D.insert(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = []
            ...
            $D.insert(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = [...]
            ...
            $D.insert(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = list(...)
            ...
            $D.insert(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = copy.deepcopy($D)
            ...
            $D.insert(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = copy.copy($D)
            ...
            $D.insert(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = list.copy($D)
            ...
            $D.insert(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = $D[:]
            ...
            $D.insert(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = [... for ... in ...]
            ...
            $D.insert(...)
      - pattern-not: |
          def $F(..., $D=[], ...):
            ...
            $D = $D or []
            ...
            $D.insert(...)
      - pattern-not-inside: |
          def $A(...):
            ...
            def $F(..., $D=[], ...):
              ...
              $D.insert(...)
  message: Function $F mutates default list $D. Instances of default function arguments
    in Python are shared between function calls.  Mutating a default function argument
    changes the result for all function consumers. This will most likely cause unexpected
    results, or lead to security vulnerabilities whereby one function consumer can
    either view or modify the data of another function consumer.
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.correctness.common-mistakes.default-mutable-list.default-mutable-list
    semgrep.ruleset: r2c-best-practices
- id: python.lang.correctness.useless-comparison.no-strings-as-booleans
  patterns:
  - pattern-either:
    - pattern: |
        if <... "..." and ... ...>:
            ...
    - pattern: |
        if <... "..." or ... ...>:
            ...
    - patterns:
      - pattern-not: |
          if $X in "...":
            ...
      - pattern: |
          if "...":
              ...
  message: |
    Using strings as booleans in Python has unexpected results.
    `"one" and "two"` will return "two".
    `"one" or "two"` will return "one".
     In Python, strings are truthy, evaluating to True.
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.correctness.useless-comparison.no-strings-as-booleans
    semgrep.ruleset: r2c-best-practices
- id: python.lang.correctness.useless-eqeq.useless-eqeq
  patterns:
  - pattern-not-inside: |
      def __eq__(...):
          ...
  - pattern-not-inside: |
      def __cmp__(...):
          ...
  - pattern-not-inside: assert(...)
  - pattern-not-inside: assert ...
  - pattern-not-inside: assert ..., ...
  - pattern-not-inside: assertTrue(...)
  - pattern-not-inside: assertFalse(...)
  - pattern-either:
    - pattern: $X == $X
    - pattern: $X != $X
  - pattern-not: 1 == 1
  message: >-
    This expression is always True: `$X == $X` or `$X != $X`.
    If testing for floating point NaN, use `math.isnan($X)`,
    or `cmath.isnan($X)` if the number is complex.
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.correctness.useless-eqeq.useless-eqeq
    semgrep.ruleset: r2c-best-practices
- id: python.lang.best-practice.pass-body.pass-body-fn
  patterns:
  - pattern-not-inside: |
      def __init__(self, ...):
          ...
  - pattern-not-inside: |
      class $A:
           ...
  - pattern: |
      def $X(...):
          pass
  message: '`pass` is the body of function $X. Consider removing this or raise NotImplementedError()
    if this is a TODO'
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.best-practice.pass-body.pass-body-fn
    semgrep.ruleset: r2c-best-practices
- id: python.lang.best-practice.pass-body.pass-body-range
  pattern: |
    for $X in $Y:
        pass
  message: '`pass` is the body of for $X in $Y. Consider removing this or raise NotImplementedError()
    if this is a TODO'
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.best-practice.pass-body.pass-body-range
    semgrep.ruleset: r2c-best-practices
- id: python.lang.best-practice.pdb.python-debugger-found
  pattern-either:
  - pattern: import pdb
  - pattern: pdb.set_trace()
  message: Importing the python debugger; did you mean to leave this in?
  severity: WARNING
  languages:
  - python
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.best-practice.pdb.python-debugger-found
    semgrep.ruleset: r2c-best-practices
- id: python.lang.best-practice.missing-hash-with-eq.missing-hash-with-eq
  patterns:
  - pattern-not-inside: |
      class A(...):
          ...
          def __hash__(self):
              ...
          ...
          def __eq__(self, $O):
              ...
  - pattern: |
      class A(...):
        ...
        def __eq__(self, $O): ...
        ...
  message: 'Class `$A` has defined `__eq__` which means it should also have defined
    `__hash__`; '
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.best-practice.missing-hash-with-eq.missing-hash-with-eq
    semgrep.ruleset: r2c-best-practices
- id: python.lang.best-practice.sleep.arbitrary-sleep
  patterns:
  - pattern-not: time.sleep($F(...))
  - pattern-either:
    - pattern: |
        time.sleep($X: int)
    - pattern: |
        time.sleep($X: float)
  message: time.sleep() call; did you mean to leave this in?
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.best-practice.sleep.arbitrary-sleep
    semgrep.ruleset: r2c-best-practices
- id: python.lang.best-practice.manual-collections-create.manual-defaultdict-dict-create
  patterns:
  - pattern-either:
    - pattern: |
        $DICT = {}
        ...
        for $KEY, $VALUE in $OTHERDICT.items():
            ...
            if $KEY not in $DICT:
                ...
                $DICT[$KEY] = {}
                ...
            $DICT[$KEY].update(...)
    - pattern: |
        $DICT = {}
        ...
        for $KEY, $VALUE in $OTHERDICT.items():
            ...
            $DICT.setdefault($KEY, {}).update(...)
  message: manually creating a defaultdict - use collections.defaultdict(dict)
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.best-practice.manual-collections-create.manual-defaultdict-dict-create
    semgrep.ruleset: r2c-best-practices
- id: python.lang.best-practice.manual-collections-create.manual-defaultdict-set-create
  patterns:
  - pattern-either:
    - pattern: |
        $DICT = {}
        ...
        for $KEY, $VALUE in $OTHERDICT.items():
            ...
            if $KEY not in $DICT:
                ...
                $DICT[$KEY] = set()
                ...
            $DICT[$KEY].add(...)
    - pattern: |
        $DICT = {}
        ...
        for $KEY, $VALUE in $OTHERDICT.items():
            ...
            $DICT.setdefault($KEY, set()).add(...)
  message: manually creating a defaultdict - use collections.defaultdict(set)
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.best-practice.manual-collections-create.manual-defaultdict-set-create
    semgrep.ruleset: r2c-best-practices
- id: python.lang.best-practice.manual-collections-create.manual-defaultdict-list-create
  patterns:
  - pattern-either:
    - pattern: |
        $DICT = {}
        ...
        for $KEY, $VALUE in $OTHERDICT.items():
            ...
            if $KEY not in $DICT:
                ...
                $DICT[$KEY] = []
                ...
            $DICT[$KEY].append(...)
    - pattern: |
        $DICT = {}
        ...
        for $KEY, $VALUE in $OTHERDICT.items():
            ...
            $DICT.setdefault($KEY, []).append(...)
  message: manually creating a defaultdict - use collections.defaultdict(list)
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.best-practice.manual-collections-create.manual-defaultdict-list-create
    semgrep.ruleset: r2c-best-practices
- id: python.lang.best-practice.manual-collections-create.manual-counter-create
  pattern: |
    $DICT = {}
    ...
    for $KEY, $VALUE in $OTHERDICT.items():
        ...
        if $KEY not in $DICT:
            ...
            $DICT[$KEY] = 0
            ...
        $DICT[$KEY] += 1
  message: manually creating a counter - use collections.Counter
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.best-practice.manual-collections-create.manual-counter-create
    semgrep.ruleset: r2c-best-practices
- id: python.lang.best-practice.hardcoded-tmp-path.hardcoded-tmp-path
  pattern: open("=~/^\/tmp.*/", ...)
  message: |
    Detected hardcoded temp directory. Consider using 'tempfile.TemporaryFile' instead.
  metadata:
    references:
    - https://docs.python.org/3/library/tempfile.html#tempfile.TemporaryFile
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.best-practice.hardcoded-tmp-path.hardcoded-tmp-path
    semgrep.ruleset: r2c-best-practices
  severity: WARNING
  languages:
  - python
- id: python.lang.best-practice.open-never-closed.open-never-closed
  patterns:
  - pattern-not-inside: |
      $F = open(...)
      ...
      $F.close()
  - pattern-not-inside: |
      $F = io.open(...)
      ...
      $F.close()
  - pattern-not-inside: |
      $F = tarfile.open(...)
      ...
      $F.close()
  - pattern-not-inside: |
      $F = ZipFile.open(...)
      ...
      $F.close()
  - pattern-not-inside: |
      $F = tempfile.TemporaryFile(...)
      ...
      $F.close()
  - pattern-not-inside: |
      $F = tempfile.NamedTemporaryFile(...)
      ...
      $F.close()
  - pattern-not-inside: |
      $F = tempfile.SpooledTemporaryFile(...)
      ...
      $F.close()
  - pattern-not-inside: |
      $F = open(...)
      ...
      try:
          ...
      finally:
          $F.close()
  - pattern-not-inside: |
      $F = io.open(...)
      ...
      try:
          ...
      finally:
          $F.close()
  - pattern-not-inside: |
      $F = tarfile.open(...)
      ...
      try:
          ...
      finally:
          $F.close()
  - pattern-not-inside: |
      $F = ZipFile.open(...)
      ...
      try:
          ...
      finally:
          $F.close()
  - pattern-not-inside: |
      $F = tempfile.TemporaryFile(...)
      ...
      try:
          ...
      finally:
          $F.close()
  - pattern-not-inside: |
      $F = tempfile.NamedTemporaryFile(...)
      ...
      try:
          ...
      finally:
          $F.close()
  - pattern-not-inside: |
      $F = tempfile.SpooledTemporaryFile(...)
      ...
      try:
          ...
      finally:
          $F.close()
  - pattern-either:
    - pattern: $F = open(...)
    - pattern: $F = io.open(...)
    - pattern: $F = tarfile.open(...)
    - pattern: $F = ZipFile.open(...)
    - pattern: $F = tempfile.TemporaryFile(...)
    - pattern: $F = tempfile.NamedTemporaryFile(...)
    - pattern: $F = tempfile.SpooledTemporaryFile(...)
  message: file object opened without corresponding close
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.best-practice.open-never-closed.open-never-closed
    semgrep.ruleset: r2c-best-practices
- id: python.attr.correctness.mutable-initializer.attr-mutable-initializer
  patterns:
  - pattern-not-inside: |
      def $Y(...):
        ...
  - pattern-not-inside: |
      def $Y(...) -> $TYPE:
        ...
  - pattern-inside: |
      @attr.s(...,auto_attribs=True, ...)
      class $X(...):
        ...
  - pattern-either:
    - pattern: |
        $M = {...}
    - pattern: $M = [...]
    - pattern: $M = list(...)
    - pattern: $M = set(...)
    - pattern: $M = dict(...)
  message: |
    Unsafe usage of mutable initializer with attr.s decorator.
    Multiple instances of this class will re-use the same data structure, which is likely not the desired behavior.
    Consider instead: replace assignment to mutable initializer (ex. dict() or {}) with attr.ib(factory=type) where type is dict, set, or list
  severity: WARNING
  languages:
  - python
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.attr.correctness.mutable-initializer.attr-mutable-initializer
    semgrep.ruleset: r2c-best-practices
- id: python.django.compatibility.django-2_0-compat.django-compat-2_0-signals-weak
  pattern: django.dispatch.signals.Signal.disconnect(..., weak=$X, ...)
  message: The weak argument to django.dispatch.signals.Signal.disconnect() is removed
    in Django 2.0.
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.compatibility.django-2_0-compat.django-compat-2_0-signals-weak
    semgrep.ruleset: r2c-best-practices
- id: python.django.compatibility.django-2_0-compat.django-compat-2_0-check-aggregate-support
  pattern: django.db.backends.base.BaseDatabaseOperations.check_aggregate_support(...)
  message: django.db.backends.base.BaseDatabaseOperations.check_aggregate_support()
    is removed in Django 2.0.
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.compatibility.django-2_0-compat.django-compat-2_0-check-aggregate-support
    semgrep.ruleset: r2c-best-practices
- id: python.django.compatibility.django-2_0-compat.django-compat-2_0-extra-forms
  patterns:
  - pattern-either:
    - pattern: from django.forms import extras
    - pattern: from django.forms.extras import $X
    - pattern: from django.forms import extras as $Y
    - pattern: from django.forms.extras import $X as $Y
    - pattern: import django.forms.extras
    - pattern: import django.forms.extras.$X
    - pattern: import django.forms.extras as $Y
    - pattern: import django.forms.extras.$X as $Y
  message: The django.forms.extras package is removed in Django 2.0.
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.compatibility.django-2_0-compat.django-compat-2_0-extra-forms
    semgrep.ruleset: r2c-best-practices
- id: python.django.compatibility.django-2_0-compat.django-compat-2_0-assignment-tag
  patterns:
  - pattern-either:
    - pattern: $X.assignment_tag(...)
    - pattern: assignment_tag(...)
  message: The assignment_tag helper is removed in Django 2.0.
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.compatibility.django-2_0-compat.django-compat-2_0-assignment-tag
    semgrep.ruleset: r2c-best-practices
- id: python.django.compatibility.django-2_0-compat.django-compat-2_0-assert-redirects-helper
  patterns:
  - pattern-either:
    - pattern: $X.assertRedirects(..., host=$Y, ...)
    - pattern: assertRedirects(..., host=$Y, ...)
  message: The host argument to assertRedirects is removed in Django 2.0.
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.compatibility.django-2_0-compat.django-compat-2_0-assert-redirects-helper
    semgrep.ruleset: r2c-best-practices
- id: python.django.correctness.string-field-null-checks.no-null-string-field
  patterns:
  - pattern-inside: |
      class $M(...):
        ...
  - pattern-not: $F = django.db.models.CharField(..., null=True, unique=True, blank=True,
      ...)
  - pattern-not: $F = django.db.models.TextField(..., null=True, unique=True, blank=True,
      ...)
  - pattern-either:
    - pattern: $F = django.db.models.CharField(..., null=True, ...)
    - pattern: $F = django.db.models.TextField(..., null=True, ...)
  message: |
    Avoid using null on string-based fields such as CharField and TextField. If a string-based field
    has null=True, that means it has two possible values for "no data": NULL, and the empty string. In
    most cases, it's redundant to have two possible values for "no data;" the Django convention is to
    use the empty string, not NULL.
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.correctness.string-field-null-checks.no-null-string-field
    semgrep.ruleset: r2c-best-practices
- id: python.django.correctness.string-field-null-checks.string-field-must-set-null-true
  patterns:
  - pattern-inside: |
      class $M(...):
        ...
  - pattern-not: $F = django.db.models.CharField(..., unique=True, blank=True, null=True,
      ...)
  - pattern-not: $F = django.db.models.TextField(..., unique=True, blank=True, null=True,
      ...)
  - pattern-either:
    - pattern: $F = django.db.models.CharField(..., unique=True, blank=True, ...)
    - pattern: $F = django.db.models.TextField(..., unique=True, blank=True, ...)
  message: If a text field declares unique=True and blank=True, null=True must also
    be set to avoid unique constraint violations when saving multiple objects with
    blank values.
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.correctness.string-field-null-checks.string-field-must-set-null-true
    semgrep.ruleset: r2c-best-practices
- id: python.django.correctness.use-decimalfield-for-money.use-decimalfield-for-money
  patterns:
  - pattern-inside: |
      class $M(...):
        ...
  - pattern: $F = django.db.models.FloatField(...)
  - metavariable-regex:
      metavariable: $F
      regex: .*(price|amount|subtotal|donation|fee|salary|precio).*
  message: Found a FloatField used for variable $F. Use DecimalField for currency
    fields to avoid float-rounding errors.
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.correctness.use-decimalfield-for-money.use-decimalfield-for-money
    semgrep.ruleset: r2c-best-practices
- id: python.django.correctness.model-save.django-db-model-save-super
  patterns:
  - pattern-inside: |
      class $MODEL(django.db.models.Model):
          ...
  - pattern-not: |
      def save(self, ...):
          ...
          super($MODEL, self).save(...)
  - pattern: |
      def save(self, ...):
          ...
  message: Appears that django model `$MODEL` is not calling super().save() inside
    of the save method
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.correctness.model-save.django-db-model-save-super
    semgrep.ruleset: r2c-best-practices
- id: python.django.correctness.nontext-field-must-set-null-true.nontext-field-must-set-null-true
  patterns:
  - pattern-inside: |
      class $M(...):
        ...
  - pattern-not: $F = django.db.models.CharField(...)
  - pattern-not: $F = django.db.models.TextField(...)
  - pattern-not: $F = django.db.models.SlugField(...)
  - pattern-not: $F = django.db.models.EmailField(...)
  - pattern-not: $F = django.db.models.URLField(...)
  - pattern-not: $F = django.db.models.UUIDField(...)
  - pattern-not: $F = django.db.models.ManyToManyField(...)
  - pattern-not: $F = django.db.models.NullBooleanField(...)
  - pattern-not: $F = $X(..., null=True, blank=True, ...)
  - pattern: $F = $X(..., blank=True, ...)
  message: null=True should be set if blank=True is set on non-text fields.
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.correctness.nontext-field-must-set-null-true.nontext-field-must-set-null-true
    semgrep.ruleset: r2c-best-practices
- id: python.django.performance.access-foreign-keys.access-foreign-keys
  pattern: $X.user.id
  message: You should use ITEM.user_id rather than ITEM.user.id to prevent running
    an extra query.
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.performance.access-foreign-keys.access-foreign-keys
    semgrep.ruleset: r2c-best-practices
- id: python.django.performance.upsell_earliest_latest.use-earliest-or-latest
  patterns:
  - pattern-either:
    - pattern: $X.objects.order_by(...)[0]
    - pattern: $X.objects.$FUNC(...).order_by(...)[0]
    - pattern: $X.objects.$FUNC(...).$FILTER(...).order_by(...)[0]
  message: Looks like you are only accessing first element of an ordered QuerySet.
    Use `latest()` or `earliest()` instead. See https://docs.djangoproject.com/en/3.0/ref/models/querysets/#django.db.models.query.QuerySet.latest
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.performance.upsell_earliest_latest.use-earliest-or-latest
    semgrep.ruleset: r2c-best-practices
- id: python.django.performance.upsell-count.use-count-method
  patterns:
  - pattern-either:
    - pattern: $X.objects.$FUNC(...).len()
    - pattern: $X.objects.$FUNC(...).$FILTER().len()
    - pattern: $X.objects.$FUNC(...).$FILTER().$UPDATE(...).len()
  message: Looks like you need to determine the number of records. Django provides
    the count() method which is more efficient than .len(). See https://docs.djangoproject.com/en/3.0/ref/models/querysets/
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.performance.upsell-count.use-count-method
    semgrep.ruleset: r2c-best-practices
- id: python.django.best-practice.use-onetoonefield.use-onetoonefield
  patterns:
  - pattern-inside: |
      class $M(...):
        ...
  - pattern: $F = django.db.models.ForeignKey(..., unique=True, ...)
  message: |
    Use 'django.db.models.OneToOneField' instead of 'ForeignKey' with unique=True.
    'OneToOneField' is used to create one-to-one relationships.
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.best-practice.use-onetoonefield.use-onetoonefield
    semgrep.ruleset: r2c-best-practices
- id: python.django.best-practice.upsell_django_environ.use-django-environ
  patterns:
  - pattern-not: |
      ...
      import environ
      ...
  - pattern-either:
    - pattern: |
        import django
        ...
        import os
        ...
        $FOO = $M.environ[...]
    - pattern: |
        import os
        ...
        import django
        ...
        $FOO = $M.environ[...]
  message: You are using environment variables inside django app. Use `django-environ`
    as it a better alternative for deployment.
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.best-practice.upsell_django_environ.use-django-environ
    semgrep.ruleset: r2c-best-practices
- id: python.django.best-practice.json_response.use-json-response
  patterns:
  - pattern-inside: |
      def $X(...):
        ...
  - pattern-either:
    - pattern: |
        $Y = json.dumps(...)
        ...
        django.http.HttpResponse($Y, ...)
  message: Use JsonResponse instead
  languages: [python]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.best-practice.json_response.use-json-response
    semgrep.ruleset: r2c-best-practices
- id: java.lang.correctness.no-string-eqeq.no-string-eqeq
  languages: [java]
  equivalences:
  - equivalence: $X == $Y ==> $Y == $X
  patterns:
  - pattern-not: null == (String $Y)
  - pattern: $X == (String $Y)
  message: |
    Strings should not be compared with '=='.
    This is a reference comparison operator.
    Use '.equals()' instead.
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.correctness.no-string-eqeq.no-string-eqeq
    semgrep.ruleset: r2c-best-practices
- id: java.lang.correctness.hardcoded-conditional.hardcoded-conditional
  patterns:
  - pattern-either:
    - pattern: if (<... true ...>) { ... }
    - pattern: if (<... false ...>) { ... }
  message: useless if statement, always the same behavior
  languages: [java]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.correctness.hardcoded-conditional.hardcoded-conditional
    semgrep.ruleset: r2c-best-practices
- id: java.lang.correctness.eqeq.eqeq
  patterns:
  - pattern-not-inside: assert $X;
  - pattern-not-inside: |
      assert $X : $Y;
  - pattern-either:
    - pattern: $X == $X
    - pattern: $X != $X
  - pattern-not: 1 == 1
  message: |
    `$X == $X` or `$X != $X` is always true. (Unless the value compared is a float or double).
    To test if `$X` is not-a-number, use `Double.isNaN($X)`.
  languages: [java]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.correctness.eqeq.eqeq
    semgrep.ruleset: r2c-best-practices
- id: java.lang.correctness.assignment-comparison.assignment-comparison
  patterns:
  - pattern-either:
    - pattern: if ($X=true) { ... }
    - pattern: if ($X=false) { ... }
  message: The value of `$X` is being ignored and will be used in the conditional
    test
  languages: [java]
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.correctness.assignment-comparison.assignment-comparison
    semgrep.ruleset: r2c-best-practices
- id: javascript.lang.correctness.useless-assign.useless-assignment
  patterns:
  - pattern: |
      $X = $Y;
      $X = $Z;
  - pattern-not: |
      $X = $Y;
      $X = <... $X ...>;
  message: '`$X` is assigned twice; the first assignment is useless'
  languages:
  - javascript
  - typescript
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.lang.correctness.useless-assign.useless-assignment
    semgrep.ruleset: r2c-best-practices
- id: javascript.lang.correctness.no-replaceall.no-replaceall
  patterns:
  - pattern: $STRING.replaceAll("...",$NEW)
  message: |
    The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good") instead of mystring.replaceAll("bad", "good") (https://discourse.threejs.org/t/replaceall-is-not-a-function/14585)
  severity: WARNING
  languages:
  - javascript
  - typescript
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.lang.correctness.no-replaceall.no-replaceall
    semgrep.ruleset: r2c-best-practices
- id: javascript.lang.correctness.useless-eqeq.eqeq-is-bad
  patterns:
  - pattern-not-inside: assert(...)
  - pattern-either:
    - pattern: $X == $X
    - pattern: $X != $X
  - pattern-not: 1 == 1
  message: |
    Detected a useless comparison operation `$X == $X` or `$X != $X`. This
    operation is always true.
    If testing for floating point NaN, use `math.isnan`, or
    `cmath.isnan` if the number is complex.
  languages:
  - javascript
  - typescript
  severity: ERROR
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.lang.correctness.useless-eqeq.eqeq-is-bad
    semgrep.ruleset: r2c-best-practices
- id: javascript.lang.best-practice.assigned-undefined.assigned-undefined
  languages:
  - javascript
  - typescript
  message: '`undefined` is not a reserved keyword in Javascript, so this is "valid"
    Javascript but highly confusing and likely to result in bugs.'
  pattern-either:
  - pattern: undefined = $X;
  - pattern: var undefined = $X;
  - pattern: let undefined = $X;
  - pattern: const undefined = $X;
  - pattern: undefined = $X
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.lang.best-practice.assigned-undefined.assigned-undefined
    semgrep.ruleset: r2c-best-practices
- id: javascript.lang.best-practice.leftover_debugging.javascript-alert
  patterns:
  - pattern-either:
    - pattern: alert()
    - pattern: alert($X)
  message: found alert() call; should this be in production code?
  languages:
  - javascript
  - typescript
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.lang.best-practice.leftover_debugging.javascript-alert
    semgrep.ruleset: r2c-best-practices
- id: javascript.lang.best-practice.leftover_debugging.javascript-debugger
  pattern: debugger;
  message: found debugger call; should this be in production code?
  languages:
  - javascript
  - typescript
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.lang.best-practice.leftover_debugging.javascript-debugger
    semgrep.ruleset: r2c-best-practices
- id: javascript.lang.best-practice.leftover_debugging.javascript-confirm
  pattern: confirm(...)
  message: found conform() call; should this be in production code?
  languages:
  - javascript
  - typescript
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.lang.best-practice.leftover_debugging.javascript-confirm
    semgrep.ruleset: r2c-best-practices
- id: javascript.lang.best-practice.leftover_debugging.javascript-prompt
  patterns:
  - pattern-either:
    - pattern: prompt()
    - pattern: prompt($X)
    - pattern: prompt($X, $Y)
  message: found prompt() call; should this be in production code?
  languages:
  - javascript
  - typescript
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.lang.best-practice.leftover_debugging.javascript-prompt
    semgrep.ruleset: r2c-best-practices
- id: c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn
  pattern: gets(...)
  message: |
    Avoid 'gets()'. This function does not consider buffer boundaries and can lead
    to buffer overflows. Use 'fgets()' or 'gets_s()' instead.
  metadata:
    references:
    - https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn
    semgrep.ruleset: r2c-security-audit
  languages: [c]
  severity: ERROR
- id: c.lang.security.insecure-use-printf-fn.insecure-use-printf-fn
  patterns:
  - pattern-either:
    - pattern: |
        $FUNC($BUFFER, argv[$NUM], ...);
        ...
        vsprintf(..., $BUFFER, ...);
    - pattern: vsprintf(..., argv[$NUM], ...)
    - pattern: |
        $FUNC($BUFFER, argv[$NUM], ...);
        ...
        sprintf(..., $BUFFER, ...);
    - pattern: sprintf(...,argv[$NUM],...)
    - pattern: |
        $FUNC($BUFFER, argv[$NUM], ...);
        ...
        printf(..., $BUFFER, ...);
    - pattern: printf(...,argv[$NUM],...)
  message: |
    Avoid using user-controlled format strings passed into 'sprintf', 'printf' and 'vsprintf'.
    These functions put you at risk of buffer overflow vulnerabilities through the use of format string exploits.
    Instead, use 'snprintf' and 'vsnprintf'.
  metadata:
    references:
    - https://doc.castsoftware.com/display/SBX/Never+use+sprintf%28%29+or+vsprintf%28%29+functions
    - https://www.cvedetails.com/cwe-details/134/Uncontrolled-Format-String.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/c.lang.security.insecure-use-printf-fn.insecure-use-printf-fn
    semgrep.ruleset: r2c-security-audit
  languages: [c]
  severity: WARNING
- id: c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn
  pattern: scanf(...)
  message: |
    Avoid using 'scanf()'. This function, when used improperly, does not consider
    buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead
    for reading input.
  metadata:
    references:
    - http://sekrit.de/webdocs/c/beginners-guide-away-from-scanf.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn
    semgrep.ruleset: r2c-security-audit
  languages: [c]
  severity: ERROR
- id: c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn
  pattern-either:
  - pattern: strcat(...)
  - pattern: strncat(...)
  message: |
    Finding triggers whenever there is a strcat or strncat used.
    This is an issue because strcat or strncat can lead to buffer overflow vulns.
    Fix this by using strcat_s instead.
  metadata:
    references:
    - https://nvd.nist.gov/vuln/detail/CVE-2019-12553
    - https://techblog.mediaservice.net/2020/04/cve-2020-2851-stack-based-buffer-overflow-in-cde-libdtsvc/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn
    semgrep.ruleset: r2c-security-audit
  languages: [c]
  severity: WARNING
- id: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn
  pattern-either:
  - pattern: strcpy(...)
  - pattern: strncpy(...)
  message: |
    Finding triggers whenever there is a strcpy or strncpy used.
    This is an issue because strcpy or strncpy can lead to buffer overflow vulns.
    Fix this by using strcpy_s instead.
  metadata:
    references:
    - https://cwe.mitre.org/data/definitions/676
    - https://nvd.nist.gov/vuln/detail/CVE-2019-11365
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn
    semgrep.ruleset: r2c-security-audit
  languages: [c]
  severity: WARNING
- id: c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn
  pattern: strtok(...)
  message: |
    Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the
    delimiter character. Use 'strtok_r()' instead.
  metadata:
    references:
    - https://wiki.sei.cmu.edu/confluence/display/c/STR06-C.+Do+not+assume+that+strtok%28%29+leaves+the+parse+string+unchanged
    - https://man7.org/linux/man-pages/man3/strtok.3.html#BUGS
    - https://stackoverflow.com/a/40335556
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn
    semgrep.ruleset: r2c-security-audit
  languages: [c]
  severity: ERROR
- id: go.jwt-go.security.jwt.hardcoded-jwt-key
  metadata:
    cwe: 'CWE-798: Use of Hard-coded Credentials'
    owasp: 'A2: Broken Authentication'
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.jwt-go.security.jwt.hardcoded-jwt-key
    semgrep.ruleset: r2c-security-audit
  pattern-either:
  - pattern: |
      $X = []byte("...")
      ...
      $Y := $TOKEN.SignedString($X)
  - pattern: |
      $TOKEN.SignedString([]byte("..."))
  message: JWT token is hardcoded
  languages: [go]
  severity: WARNING
- id: go.lang.security.audit.crypto.bad_imports.insecure-module-used
  message: >-
    Detected use of an insecure cryptographic hashing method. This method is known
    to be broken and easily compromised. Use SHA256 or SHA3 instead.
  metadata:
    owasp: 'A9: Using Components with Known Vulnerabilities'
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    source-rule-url: https://github.com/securego/gosec
    references:
    - https://godoc.org/golang.org/x/crypto/sha3
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.bad_imports.insecure-module-used
    semgrep.ruleset: r2c-security-audit
  languages: [go]
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern: |
        md5.$FUNC(...)
    - pattern: |
        des.$FUNC(...)
    - pattern: |
        sha1.$FUNC(...)
    - pattern: |
        rc4.$FUNC(...)
    - pattern: |-
        cgi.$FUNC(...)
- id: go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key
  message: |
    Disabled host key verification detected. This allows man-in-the-middle
    attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do
    host key verification.
    See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/
    to learn more about the problem and how to fix it.
  metadata:
    cwe: 'CWE-322: Key Exchange without Entity Authentication'
    owasp: 'A3: Sensitive Data Exposure'
    source-rule-url: https://github.com/securego/gosec
    references:
    - https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/
    - https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key
    semgrep.ruleset: r2c-security-audit
  languages: [go]
  severity: WARNING
  pattern: |-
    ssh.InsecureIgnoreHostKey()
- id: go.lang.security.audit.crypto.math_random.math-random-used
  metadata:
    cwe: 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)'
    owasp: 'A3: Sensitive Data Exposure'
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used
    semgrep.ruleset: r2c-security-audit
  message: Do not use `math/rand`. Use `crypto/rand` instead.
  languages: [go]
  severity: WARNING
  pattern-either:
  - patterns:
    - pattern-inside: |
        import mrand "math/rand"
        ...
    - pattern-either:
      - pattern: mrand.Int()
      - pattern: mrand.Read(...)
  - patterns:
    - pattern-inside: |
        import "math/rand"
        ...
    - pattern-not-inside: |
        import "crypto/rand"
        ...
    - pattern-either:
      - pattern: rand.Int()
      - pattern: rand.Read(...)
- id: go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure
  message: |
    SSLv3 is insecure because it has known vulnerabilities.
    Starting with go1.14, SSLv3 will be removed. Instead, use
    'tls.VersionTLS13'.
  metadata:
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A9: Using Components with Known Vulnerabilities'
    source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go
    references:
    - https://golang.org/doc/go1.14#crypto/tls
    - https://www.us-cert.gov/ncas/alerts/TA14-290A
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure
    semgrep.ruleset: r2c-security-audit
  languages: [go]
  severity: ERROR
  patterns:
  - pattern: |-
      tls.Config{..., MinVersion: $TLS.VersionSSL30, ...}
  fix-regex:
    regex: VersionSSL30
    replacement: VersionTLS13
- id: go.lang.security.audit.crypto.tls.tls-with-insecure-cipher
  message: |
    Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak.
    Use the function 'tls.CipherSuites()' to get a list of good cipher suites.
    See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites
    for why and what other cipher suites to use.
  metadata:
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A9: Using Components with Known Vulnerabilities'
    source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls.go
    references:
    - https://golang.org/pkg/crypto/tls/#InsecureCipherSuites
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher
    semgrep.ruleset: r2c-security-audit
  languages: [go]
  severity: WARNING
  pattern-either:
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_RC4_128_SHA,...}}
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_AES_128_CBC_SHA256,...}}
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,...}}
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA,...}}
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,...}}
  - pattern: |
      tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,...}}
  - pattern: |
      tls.CipherSuite{..., TLS_RSA_WITH_RC4_128_SHA ,...}
  - pattern: |
      tls.CipherSuite{..., TLS_RSA_WITH_AES_128_CBC_SHA256 ,...}
  - pattern: |
      tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_RC4_128_SHA ,...}
  - pattern: |
      tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_RC4_128_SHA ,...}
  - pattern: |
      tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 ,...}
  - pattern: |-
      tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 ,...}
- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES
  message: |
    Detected DES cipher algorithm which is insecure. The algorithm is
    considered weak and has been deprecated. Use AES instead.
  languages: [go]
  severity: WARNING
  metadata:
    owasp: 'A9: Using Components with Known Vulnerabilities'
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    source-rule-url: https://github.com/securego/gosec#available-rules
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES
    semgrep.ruleset: r2c-security-audit
  pattern-either:
  - pattern: |
      des.NewTripleDESCipher(...)
  - pattern: |
      des.NewCipher(...)
- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5
  message: |
    Detected MD5 hash algorithm which is considered insecure. MD5 is not
    collision resistant and is therefore not suitable as a cryptographic
    signature. Use SHA256 or SHA3 instead.
  languages: [go]
  severity: WARNING
  metadata:
    owasp: 'A9: Using Components with Known Vulnerabilities'
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    source-rule-url: https://github.com/securego/gosec#available-rules
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5
    semgrep.ruleset: r2c-security-audit
  pattern-either:
  - pattern: |
      md5.New()
  - pattern: |
      md5.Sum(...)
- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4
  message: |
    Detected RC4 cipher algorithm which is insecure. The algorithm has many
    known vulnerabilities. Use AES instead.
  languages: [go]
  severity: WARNING
  metadata:
    owasp: 'A9: Using Components with Known Vulnerabilities'
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    source-rule-url: https://github.com/securego/gosec#available-rules
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4
    semgrep.ruleset: r2c-security-audit
  pattern: |-
    rc4.NewCipher(...)
- id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1
  message: |
    Detected SHA1 hash algorithm which is considered insecure. SHA1 is not
    collision resistant and is therefore not suitable as a cryptographic
    signature. Use SHA256 or SHA3 instead.
  languages: [go]
  severity: WARNING
  metadata:
    owasp: 'A9: Using Components with Known Vulnerabilities'
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    source-rule-url: https://github.com/securego/gosec#available-rules
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1
    semgrep.ruleset: r2c-security-audit
  pattern-either:
  - pattern: |
      sha1.New()
  - pattern: |
      sha1.Sum(...)
- id: go.lang.security.audit.database.string-formatted-query.string-formatted-query
  languages: [go]
  message: |
    String-formatted SQL query detected. This could lead to SQL injection if
    the string is not sanitized properly. Audit this call to ensure the
    SQL is not manipulatable by external data.
  severity: WARNING
  metadata:
    owasp: 'A1: Injection'
    cwe: "CWE-89: Improper Neutralization of Special Elements used in an SQL Command\
      \ ('SQL Injection')"
    source-rule-url: https://github.com/securego/gosec
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.database.string-formatted-query.string-formatted-query
    semgrep.ruleset: r2c-security-audit
  patterns:
  - pattern-either:
    - pattern: $OBJ.Exec("..." + $X)
    - pattern: $OBJ.ExecContext($CTX, "..." + $X)
    - pattern: $OBJ.Query("..." + $X)
    - pattern: $OBJ.QueryContext($CTX, "..." + $X)
    - pattern: $OBJ.QueryRow("..." + $X)
    - pattern: $OBJ.QueryRow($CTX, "..." + $X)
    - pattern: $OBJ.QueryRowContext($CTX, "..." + $X)
    - pattern: $OBJ.Exec(fmt.$P("...", ...))
    - pattern: $OBJ.ExecContext($CTX, fmt.$P("...", ...))
    - pattern: $OBJ.Query(fmt.$P("...", ...))
    - pattern: $OBJ.QueryContext($CTX, fmt.$P("...", ...))
    - pattern: $OBJ.QueryRow(fmt.$P("...", ...))
    - pattern: $OBJ.QueryRow($CTX, fmt.$P("...", ...))
    - pattern: $OBJ.QueryRowContext($CTX, fmt.$P("...", ...))
    - pattern: |
        $QUERY = "..."
        ...
        $QUERY = $FXN(..., $QUERY, ...)
        ...
        $OBJ.Exec($QUERY, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $QUERY = $FXN(..., $QUERY, ...)
        ...
        $OBJ.Query($QUERY, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $QUERY = $FXN(..., $QUERY, ...)
        ...
        $OBJ.ExecContext($CTX, $QUERY, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $QUERY = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryContext($CTX, $QUERY, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $QUERY = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryRow($QUERY)
    - pattern: |
        $QUERY = "..."
        ...
        $QUERY = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryRow($CTX, $QUERY)
    - pattern: |
        $QUERY = "..."
        ...
        $QUERY = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryRowContext($CTX, $QUERY, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $OTHER = $FXN(..., $QUERY, ...)
        ...
        $OBJ.Exec($OTHER, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $OTHER = $FXN(..., $QUERY, ...)
        ...
        $OBJ.Query($OTHER, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $OTHER = $FXN(..., $QUERY, ...)
        ...
        $OBJ.ExecContext($CTX, $OTHER, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $OTHER = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryContext($CTX, $OTHER, ...)
    - pattern: |
        $QUERY = "..."
        ...
        $OTHER = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryRow($OTHER)
    - pattern: |
        $QUERY = "..."
        ...
        $OTHER = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryRow($CTX, $OTHER)
    - pattern: |
        $QUERY = "..."
        ...
        $OTHER = $FXN(..., $QUERY, ...)
        ...
        $OBJ.QueryRowContext($CTX, $OTHER, ...)
    - pattern: |
        $QUERY = "..." + $X
        ...
        $OBJ.Exec($QUERY, ...)
    - pattern: |
        $QUERY = "..." + $X
        ...
        $OBJ.Query($QUERY, ...)
    - pattern: |
        $QUERY = "..." + $X
        ...
        $OBJ.ExecContext($CTX, $QUERY, ...)
    - pattern: |
        $QUERY = "..." + $X
        ...
        $OBJ.QueryContext($CTX, $QUERY, ...)
    - pattern: |
        $QUERY = "..." + $X
        ...
        $OBJ.QueryRow($QUERY)
    - pattern: |
        $QUERY = "..." + $X
        ...
        $OBJ.QueryRow($CTX, $QUERY)
    - pattern: |
        $QUERY = "..." + $X
        ...
        $OBJ.QueryRowContext($CTX, $QUERY, ...)
- id: go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces
  message: Listening on 0.0.0.0 or empty string could unexpectedly expose the server
    publicly as it binds to all available interfaces
  languages: [go]
  severity: WARNING
  metadata:
    cwe: 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
    owasp: 'A6: Security Misconfiguration'
    source-rule-url: https://github.com/securego/gosec
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.net.bind_all.avoid-bind-to-all-interfaces
    semgrep.ruleset: r2c-security-audit
  pattern-either:
  - pattern: tls.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...)
  - pattern: net.Listen($NETWORK, "=~/^0.0.0.0:.*$/", ...)
  - pattern: tls.Listen($NETWORK, "=~/^:.*$/", ...)
  - pattern: net.Listen($NETWORK, "=~/^:.*$/", ...)
- id: go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace
  message: |
    Detected a potentially dynamic ClientTrace. This occurred because semgrep could not
    find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous because
    they deserialize function code to run when certain Request events occur, which could lead
    to code being run without your knowledge. Ensure that your ClientTrace is statically defined.
  metadata:
    cwe: 'CWE-913: Improper Control of Dynamically-Managed Code Resources'
    owasp: 'A8: Insecure Deserialization'
    references:
    - https://github.com/returntocorp/semgrep-rules/issues/518
  # Detects when a static ClientTrace is not defined in the same file as
  # WithClientTrace. Not a perfect detection, but sufficiently works in a
  # scan of ~1k repos: https://dev.massive.ret2.co/triager/filter/1007
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.net.dynamic-httptrace-clienttrace.dynamic-httptrace-clienttrace
    semgrep.ruleset: r2c-security-audit
  patterns:
  - pattern-not-inside: |
      ...
      &httptrace.ClientTrace { ... }
      ...
  - pattern: httptrace.WithClientTrace($ANY, $TRACE)

  severity: WARNING
  languages:
  - go
- id: go.lang.security.audit.net.formatted-template-string.formatted-template-string
  message: |
    Found a formatted template string passed to 'template.HTML()'.
    'template.HTML()' does not escape contents. Be absolutely sure
    there is no user-controlled data in this template. If user data
    can reach this template, you may have a XSS vulnerability.
  metadata:
    cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site\
      \ Scripting')"
    owasp: 'A1: Injection'
    references:
    - https://golang.org/pkg/html/template/#HTML
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.net.formatted-template-string.formatted-template-string
    semgrep.ruleset: r2c-security-audit
  languages: [go]
  severity: WARNING
  patterns:
  - pattern-not: template.HTML("..." + "...")
  - pattern-either:
    - pattern: template.HTML($T + $X, ...)
    - pattern: template.HTML(fmt.$P("...", ...), ...)
    - pattern: |
        $T = "..."
        ...
        $T = $FXN(..., $T, ...)
        ...
        template.HTML($T, ...)
    - pattern: |
        $T = fmt.$P("...", ...)
        ...
        template.HTML($T, ...)
    - pattern: |
        $T, $ERR = fmt.$P("...", ...)
        ...
        template.HTML($T, ...)
    - pattern: |
        $T = $X + $Y
        ...
        template.HTML($T, ...)
    - pattern: |
        $T = "..."
        ...
        $OTHER, $ERR = fmt.$P(..., $T, ...)
        ...
        template.HTML($OTHER, ...)
- id: go.lang.security.audit.net.pprof.pprof-debug-exposure
  metadata:
    cwe: 'CWE-489: Active Debug Code'
    owasp: 'A6: Security Misconfiguration'
    source-rule-url: https://github.com/securego/gosec#available-rules
    references:
    - https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.net.pprof.pprof-debug-exposure
    semgrep.ruleset: r2c-security-audit
  message: |
    The profiling 'pprof' endpoint is automatically exposed on /debug/pprof.
    This could leak information about the server.
    Instead, use `import "net/http/pprof"`. See
    https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/
    for more information and mitigation.
  languages: [go]
  severity: WARNING
  patterns:
  - pattern-inside: |
      import _ "net/http/pprof"
      ...
  - pattern-inside: |
      func $ANY(...) {
        ...
      }
  - pattern-not: http.ListenAndServe("=~/^localhost.*/", ...)
  - pattern-not: http.ListenAndServe("=~/^127[.]0[.]0[.]1.*/", ...)
  - pattern: http.ListenAndServe(...)
- id: go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr
  message: |
    Found a formatted template string passed to 'template.HTMLAttr()'.
    'template.HTMLAttr()' does not escape contents. Be absolutely sure
    there is no user-controlled data in this template.
  metadata:
    cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site\
      \ Scripting')"
    owasp: 'A1: Injection'
    references:
    - https://golang.org/pkg/html/template/#HTMLAttr
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-htmlattr.unescaped-data-in-htmlattr
    semgrep.ruleset: r2c-security-audit
  languages: [go]
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern: template.HTMLAttr($T + $X, ...)
    - pattern: template.HTMLAttr(fmt.$P("...", ...), ...)
    - pattern: |
        $T = "..."
        ...
        $T = $FXN(..., $T, ...)
        ...
        template.HTMLAttr($T, ...)
    - pattern: |
        $T = fmt.$P("...", ...)
        ...
        template.HTMLAttr($T, ...)
    - pattern: |
        $T, $ERR = fmt.$P("...", ...)
        ...
        template.HTMLAttr($T, ...)
    - pattern: |
        $T = $X + $Y
        ...
        template.HTMLAttr($T, ...)
    - pattern: |
        $T = "..."
        ...
        $OTHER, $ERR = fmt.$P(..., $T, ...)
        ...
        template.HTMLAttr($OTHER, ...)
- id: go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js
  message: |
    Found a formatted template string passed to 'template.JS()'.
    'template.JS()' does not escape contents. Be absolutely sure
    there is no user-controlled data in this template.
  metadata:
    cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site\
      \ Scripting')"
    owasp: 'A1: Injection'
    references:
    - https://golang.org/pkg/html/template/#JS
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-js.unescaped-data-in-js
    semgrep.ruleset: r2c-security-audit
  languages: [go]
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern: template.JS($T + $X, ...)
    - pattern: template.JS(fmt.$P("...", ...), ...)
    - pattern: |
        $T = "..."
        ...
        $T = $FXN(..., $T, ...)
        ...
        template.JS($T, ...)
    - pattern: |
        $T = fmt.$P("...", ...)
        ...
        template.JS($T, ...)
    - pattern: |
        $T, $ERR = fmt.$P("...", ...)
        ...
        template.JS($T, ...)
    - pattern: |
        $T = $X + $Y
        ...
        template.JS($T, ...)
    - pattern: |
        $T = "..."
        ...
        $OTHER, $ERR = fmt.$P(..., $T, ...)
        ...
        template.JS($OTHER, ...)
- id: go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url
  message: |
    Found a formatted template string passed to 'template.URL()'.
    'template.URL()' does not escape contents. Be absolutely sure
    there is no user-controlled data in this template.
  metadata:
    cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site\
      \ Scripting')"
    owasp: 'A1: Injection'
    references:
    - https://golang.org/pkg/html/template/#URL
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.net.unescaped-data-in-url.unescaped-data-in-url
    semgrep.ruleset: r2c-security-audit
  languages: [go]
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern: template.URL($T + $X, ...)
    - pattern: template.URL(fmt.$P("...", ...), ...)
    - pattern: |
        $T = "..."
        ...
        $T = $FXN(..., $T, ...)
        ...
        template.URL($T, ...)
    - pattern: |
        $T = fmt.$P("...", ...)
        ...
        template.URL($T, ...)
    - pattern: |
        $T, $ERR = fmt.$P("...", ...)
        ...
        template.URL($T, ...)
    - pattern: |
        $T = $X + $Y
        ...
        template.URL($T, ...)
    - pattern: |
        $T = "..."
        ...
        $OTHER, $ERR = fmt.$P(..., $T, ...)
        ...
        template.URL($OTHER, ...)
- id: go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf
  patterns:
  - pattern-inside: |
      func $FUNC(..., $W http.ResponseWriter, ...) {
          ...
      }
  - pattern-inside: |
      ...
      var $T = "..."
      ...
      $W.Write([]byte(fmt.$PRINTF($T, ...)), ...)
  - pattern-either:
    - pattern: |
        $PARAMS = r.URL.Query()
        ...
        $DATA, $ERR := $PARAMS[...]
        ...
        $INTERM = $ANYTHING(..., $DATA, ...)
        ...
        $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...)))
    - pattern: |
        $PARAMS = r.URL.Query()
        ...
        $DATA, $ERR := $PARAMS[...]
        ...
        $INTERM = $DATA[...]
        ...
        $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...)))
    - pattern: |
        $DATA, $ERR := r.URL.Query()[...]
        ...
        $INTERM = $DATA[...]
        ...
        $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...)))
    - pattern: |
        $DATA, $ERR := r.URL.Query()[...]
        ...
        $INTERM = $ANYTHING(..., $DATA, ...)
        ...
        $W.Write([]byte(fmt.$PRINTF(..., $INTERM, ...)))
    - pattern: |
        $PARAMS = r.URL.Query()
        ...
        $DATA, $ERR := $PARAMS[...]
        ...
        $W.Write([]byte(fmt.$PRINTF(..., $DATA, ...)))
  message: |
    Found data going from url query parameters into formatted data written to ResponseWriter.
    This could be XSS and should not be done. If you must do this, ensure your data is
    sanitized or escaped.
  metadata:
    cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site\
      \ Scripting')"
    owasp: "A7: Cross-Site Scripting ('XSS')"
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.net.wip-xss-using-responsewriter-and-printf.wip-xss-using-responsewriter-and-printf
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - go
- id: go.lang.security.audit.reflect-makefunc.reflect-makefunc
  message: |
    'reflect.MakeFunc' detected. This will sidestep protections that are
    normally afforded by Go's type system. Audit this call and be sure that
    user input cannot be used to affect the code generated by MakeFunc;
    otherwise, you will have a serious security vulnerability.
  metadata:
    owasp: 'A8: Insecure Deserialization'
    cwe: 'CWE-913: Improper Control of Dynamically-Managed Code Resources'
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.reflect-makefunc.reflect-makefunc
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  pattern: reflect.MakeFunc(...)
  languages:
  - go
- id: go.lang.security.audit.unsafe.use-of-unsafe-block
  message: Using the unsafe package in Go gives you low-level memory management and
    many of the strengths of the C language but also gives flexibility to the attacker
    of your application.
  languages: [go]
  severity: WARNING
  metadata:
    cwe: 'CWE-242: Use of Inherently Dangerous Function'
    source_rule_url: https://github.com/securego/gosec/blob/master/rules/unsafe.go
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.audit.unsafe.use-of-unsafe-block
    semgrep.ruleset: r2c-security-audit
  patterns:
  - pattern: unsafe.$FUNC(...)
- id: go.lang.security.bad_tmp.bad-tmp-file-creation
  message: File creation in shared tmp directory without using ioutil.Tempfile
  languages: [go]
  severity: WARNING
  metadata:
    cwe: 'CWE-377: Insecure Temporary File'
    source_rule_url: https://github.com/securego/gosec
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.bad_tmp.bad-tmp-file-creation
    semgrep.ruleset: r2c-security-audit
  pattern-either:
  - pattern: ioutil.WriteFile("=~//tmp/.*$/", ...)
  - pattern: os.Create("=~//tmp/.*$/", ...)
- id: go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb
  message: >-
    Detected a possible denial-of-service via a zip bomb attack. By limiting the max
    bytes read, you can mitigate this attack.
    `io.CopyN()` can specify a size. Refer to https://bomb.codes/ to learn more about
    this attack and other ways to mitigate
    it.
  severity: WARNING
  languages: [go]
  patterns:
  - pattern-either:
    - pattern: io.Copy(...)
    - pattern: io.CopyBuffer(...)
  - pattern-either:
    - pattern-inside: |
        gzip.NewReader(...)
        ...
    - pattern-inside: |
        zlib.NewReader(...)
        ...
    - pattern-inside: |
        zlib.NewReaderDict(...)
        ...
    - pattern-inside: |
        bzip2.NewReader(...)
        ...
    - pattern-inside: |
        flate.NewReader(...)
        ...
    - pattern-inside: |
        flate.NewReaderDict(...)
        ...
    - pattern-inside: |
        lzw.NewReader(...)
        ...
    - pattern-inside: |
        tar.NewReader(...)
        ...
    - pattern-inside: |
        zip.NewReader(...)
        ...
    - pattern-inside: |
        zip.OpenReader(...)
        ...
  fix-regex:
    regex: (.*)(Copy|CopyBuffer)\((.*?),(.*?)(\)|,.*\))
    replacement: \1CopyN(\3, \4, 1024*1024*256)
  metadata:
    cwe: 'CWE-400: Uncontrolled Resource Consumption'
    source-rule-url: https://github.com/securego/gosec
    references:
    - https://bomb.codes/
    - https://golang.org/pkg/io/#CopyN
    - https://github.com/securego/gosec/blob/master/rules/decompression-bomb.go
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb
    semgrep.ruleset: r2c-security-audit
- id: go.lang.security.zip.path-traversal-inside-zip-extraction
  message: File traversal when extracting zip archive
  metadata:
    cwe: |
      CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    source_rule_url: https://github.com/securego/gosec/issues/205
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.lang.security.zip.path-traversal-inside-zip-extraction
    semgrep.ruleset: r2c-security-audit
  languages: [go]
  severity: WARNING
  patterns:
  - pattern: |-
      reader, $ERR := zip.OpenReader($ARCHIVE)
      ...
      for _, $FILE := range reader.File {
        ...
        path := filepath.Join($TARGET, $FILE.Name)
        ...
      }
- id: go.otto.security.audit.dangerous-execution.dangerous-execution
  message: |
    Detected non-static script inside otto VM. Audit the input to 'VM.Run'.
    If unverified user data can reach this call site, this is a code injection
    vulnerability. A malicious actor can inject a malicious script to execute
    arbitrary code.
  metadata:
    cwe: "CWE-94: Improper Control of Generation of Code ('Code Injection')"
    owasp: 'A1: Injection'
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/go.otto.security.audit.dangerous-execution.dangerous-execution
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  patterns:
  - pattern-inside: |
      $VM = otto.New(...)
      ...
  - pattern-not: $VM.Run("...", ...)
  - pattern: $VM.Run(...)
  languages:
  - go
- id: java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal
  metadata:
    owasp: 'A1: Injection'
    cwe: "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path\
      \ Traversal')"
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN
    references:
    - https://www.owasp.org/index.php/Path_Traversal
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal
    semgrep.ruleset: r2c-security-audit
  message: |
    Detected a potential path traversal. A malicious actor
    could control the location of this file, to include going backwards
    in the directory with '../'. To address this, ensure that user-controlled
    variables in file paths are sanitized. You may aslso consider using a utility
    method such as org.apache.commons.io.FilenameUtils.getName(...) to only
    retrieve the file name from the path.
  patterns:
  - pattern-either:
    - pattern: |
        $RETURNTYPE $FUNC (..., @PathParam(...) $TYPE $VAR, ...) {
          ...
          new File(..., $VAR, ...);
          ...
        }
    - pattern: |-
        $RETURNTYPE $FUNC (..., @javax.ws.rs.PathParam(...) $TYPE $VAR, ...) {
          ...
          new File(..., $VAR, ...);
          ...
        }
  severity: WARNING
  languages:
  - java
- id: java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind
  metadata:
    cwe: 'CWE-287: Improper Authentication'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#LDAP_ANONYMOUS
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind
    semgrep.ruleset: r2c-security-audit
  message: |
    Detected anonymous LDAP bind.
    This permits anonymous users to execute LDAP statements. Consider enforcing
    authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html
    for more information.
  severity: WARNING
  pattern: |
    $ENV.put($CTX.SECURITY_AUTHENTICATION, "none");
    ...
    $DCTX = new InitialDirContext($ENV, ...);
  languages:
  - java
- id: java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion
  metadata:
    cwe: 'CWE-704: Incorrect Type Conversion or Cast'
    owasp: 'A3: Sensitive Data Exposure'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#BAD_HEXA_CONVERSION
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion
    semgrep.ruleset: r2c-security-audit
  message: |
    'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte.
    This mistake weakens the hash value computed since it introduces more collisions.
    Use 'String.format("%02X", ...)' instead.
  severity: WARNING
  languages: [java]
  pattern: |-
    $X $METHOD(...) {
      ...
      MessageDigest $MD = ...;
      ...
      $MD.digest(...);
      ...
      Integer.toHexString(...);
    }
- id: java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle
  message: |
    Using CBC with PKCS5Padding is susceptible to padding orcale attacks. A malicious actor
    could discern the difference between plaintext with valid or invalid padding. Further,
    CBC mode does not include any integrity checks. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY.
    Use 'AES/GCM/NoPadding' instead.
  metadata:
    cwe: 'CWE-696: Incorrect Behavior Order'
    owasp: 'A3: Sensitive Data Exposure'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PADDING_ORACLE
    references:
    - https://capec.mitre.org/data/definitions/463.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  patterns:
  - pattern: $CIPHER.getInstance("=~/.*\/CBC\/PKCS5Padding/");
  fix: $CIPHER.getInstance("AES/GCM/NoPadding");
  languages:
  - java
- id: java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call
  patterns:
  - pattern-either:
    - pattern: $RUNTIME.exec($X + $Y);
    - pattern: $RUNTIME.exec(String.format(...));
    - pattern: $RUNTIME.loadLibrary($X + $Y);
    - pattern: $RUNTIME.loadLibrary(String.format(...));
  message: |
    A formatted or concatenated string was detected as input to a java.lang.Runtime call.
    This is dangerous if a variable is controlled by user input and could result in a
    command injection. Ensure your variables are not controlled by users or sufficiently sanitized.
  metadata:
    cwe: "CWE-78: Improper Neutralization of Special Elements used in an OS Command\
      \ ('OS Command Injection')"
    owasp: 'A1: Injection'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#COMMAND_INJECTION.
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - java
- id: java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly
  metadata:
    cwe: "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag"
    owasp: 'A3: Sensitive Data Exposure'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#HTTPONLY_COOKIE
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly
    semgrep.ruleset: r2c-security-audit
  message: |
    A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag
    for cookies instructs the browser to forbid client-side scripts from reading the
    cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'
  severity: WARNING
  languages: [java]
  patterns:
  - pattern-not-inside: $COOKIE.setValue(""); ...
  - pattern-either:
    - pattern: $COOKIE.setHttpOnly(false);
    - patterns:
      - pattern-not-inside: $COOKIE.setHttpOnly(...); ...
      - pattern: $RESPONSE.addCookie($COOKIE);
- id: java.lang.security.audit.cookie-missing-samesite.cookie-missing-samesite
  metadata:
    cwe: 'CWE-352: Cross-Site Request Forgery (CSRF)'
    owasp: 'A6: Security Misconfiguration'
    references:
    - https://stackoverflow.com/questions/42717210/samesite-cookie-in-java-application
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.cookie-missing-samesite.cookie-missing-samesite
    semgrep.ruleset: r2c-security-audit
  message: |
    Detected cookie without the SameSite attribute.
  severity: WARNING
  languages: [java]
  patterns:
  - pattern-not-inside: |
      $RETURNTYPE $METHOD(..., HttpServletResponse $RESP, ...) {
        ...
        $RESP.setHeader("Set-Cookie", "=~/.*SameSite=.*/");
        ...
      }
  - pattern-either:
    - pattern: $RESP.addCookie(...);
    - pattern: $RESP.setHeader("Set-Cookie", ...);
- id: java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag
  metadata:
    cwe: "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"
    owasp: 'A3: Sensitive Data Exposure'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#INSECURE_COOKIE
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag
    semgrep.ruleset: r2c-security-audit
  message: |
    A cookie was detected without setting the 'secure' flag. The 'secure' flag
    for cookies prevents the client from transmitting the cookie over insecure
    channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'
  severity: WARNING
  languages: [java]
  patterns:
  - pattern-not-inside: $COOKIE.setValue(""); ...
  - pattern-either:
    - pattern: $COOKIE.setSecure(false);
    - patterns:
      - pattern-not-inside: $COOKIE.setSecure(...); ...
      - pattern: $RESPONSE.addCookie($COOKIE);
- id: java.lang.security.audit.crlf-injection-logs.crlf-injection-logs
  message: |
    When data from an untrusted source is put into a logger and not neutralized correctly,
    an attacker could forge log entries or include malicious content.
  metadata:
    cwe: "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')"
    owasp: 'A1: Injection'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#CRLF_INJECTION_LOGS
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages: [java]
  patterns:
    # Enumerate possible enclosing scopes that define request and logger
  - pattern-either:
      # Logger is defined as a field on a class
    - patterns:
      - pattern-inside: |
          class $CLASS {
            ...
            Logger $LOG = ...;
            ...
          }
      - pattern-either:
        - pattern-inside: |
            $X $METHOD(...,HttpServletRequest $REQ,...) {
              ...
            }
        - pattern-inside: |
            $X $METHOD(...,ServletRequest $REQ,...) {
              ...
            }
        - pattern-inside: |
            $X $METHOD(...) {
              ...
              HttpServletRequest $REQ = ...;
              ...
            }
        - pattern-inside: |
            $X $METHOD(...) {
              ...
              ServletRequest $REQ = ...;
              ...
            }
      # Logger is defined as local variable in a method
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          Logger $LOG = ...;
          ...
          HttpServletRequest $REQ = ...;
          ...
        }
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          Logger $LOG = ...;
          ...
          ServletRequest $REQ = ...;
          ...
        }
  - pattern-either:
    # Enumerate possible injection sites
    - pattern: |
        String $VAL = $REQ.getParameter(...);
        ...
        $LOG.$LEVEL(<... $VAL ...>);
    - pattern: |
        String $VAL = $REQ.getParameter(...);
        ...
        $LOG.log($LEVEL,<... $VAL ...>);
    - pattern: |
        $LOG.$LEVEL(<... $REQ.getParameter(...) ...>);
    - pattern: |
        $LOG.log($LEVEL,<... $REQ.getParameter(...) ...>);
- id: java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated
  message: |
    DES is considered deprecated. AES is the recommended cipher.
    Upgrade to use AES.
    See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information.
  metadata:
    cwe: 'CWE-326: Inadequate Encryption Strength'
    owasp: 'A3: Sensitive Data Exposure'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#DES_USAGE
    references:
    - https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  pattern: $CIPHER.getInstance("=~/DES/.*/");
  fix: $CIPHER.getInstance("AES/GCM/NoPadding");
  languages:
  - java
- id: java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated
  message: |
    Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher.
    Upgrade to use AES.
    See https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA for more information.
  metadata:
    cwe: 'CWE-326: Inadequate Encryption Strength'
    owasp: 'A3: Sensitive Data Exposure'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#TDES_USAGE
    references:
    - https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  pattern: $CIPHER.getInstance("=~/DESede.*/");
  fix: Cipher.getInstance("AES/GCM/NoPadding");
  languages:
  - java
- id: java.lang.security.audit.crypto.no-null-cipher.no-null-cipher
  pattern: new NullCipher(...);
  metadata:
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A3: Sensitive Data Exposure'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#NULL_CIPHER
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher
    semgrep.ruleset: r2c-security-audit
  message: |
    NullCipher was detected. This will not encrypt anything;
    the cipher text will be the same as the plain text. Use
    a valid, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING").
    See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions
    for more information.
  severity: WARNING
  languages:
  - java
- id: java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector
  message: |
    Initialization Vectors (IVs) for block ciphers should be randomly generated
    each time they are used. Using a static IV means the same plaintext
    encrypts to the same ciphertext every time, weakening the strength
    of the encryption.
  metadata:
    cwe: 'CWE-329: Not Using a Random IV with CBC Mode'
    owasp: 'A3: Sensitive Data Exposure'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#STATIC_IV
    references:
    - https://cwe.mitre.org/data/definitions/329.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages: [java]
  patterns:
  - pattern-either:
    - pattern: |
        byte[] $IV = {
            ...
        };
        ...
        new IvParameterSpec($IV, ...);
    - pattern: |
        class $CLASS {
            byte[] $IV = {
                ...
            };
            ...
            $METHOD(...) {
                ...
                new IvParameterSpec($IV, ...);
                ...
            }
        }
- id: java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding
  metadata:
    cwe: 'CWE-326: Inadequate Encryption Strength'
    owasp: 'A3: Sensitve Data Exposure'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#RSA_NO_PADDING
    references: https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding
    semgrep.ruleset: r2c-security-audit
  message: |
    Using RSA without OAEP mode weakens the encryption.
  severity: WARNING
  languages: [java]
  pattern: $CIPHER.getInstance("RSA/NONE/NoPadding")
- id: java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests
  metadata:
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A3: Sensitive Data Exposure'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#CUSTOM_MESSAGE_DIGEST
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#custom-algorithms
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests
    semgrep.ruleset: r2c-security-audit
  message: |
    Cryptographic algorithms are notoriously difficult to get right. By implementing
    a custom message digest, you risk introducing security issues into your program.
    Use one of the many sound message digests already available to you:
    MessageDigest sha256Digest = MessageDigest.getInstance("SHA256");
  severity: WARNING
  languages: [java]
  pattern: |-
    class $CLASS extends MessageDigest {
      ...
    }
- id: java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated
  metadata:
    cwe: 'CWE-326: Inadequate Encryption Strength'
    owasp: 'A3: Sensitive Data Exposure'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#DEFAULT_HTTP_CLIENT
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.defaulthttpclient-is-deprecated.defaulthttpclient-is-deprecated
    semgrep.ruleset: r2c-security-audit
  message: |
    DefaultHttpClient is deprecated. Further, it does not support connections
    using TLS1.2, which makes using DefaultHttpClient a security hazard.
    Use SystemDefaultHttpClient instead, which supports TLS1.2.
  severity: WARNING
  languages: [java]
  pattern: new DefaultHttpClient(...);
  fix-regex:
    regex: DefaultHttpClient
    replacement: SystemDefaultHttpClient
- id: java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier
  message: |
    Insecure HostnameVerifier implementation detected. This will accept
    any SSL certificate with any hostname, which creates the possibility
    for man-in-the-middle attacks.
  metadata:
    cwe: 'CWE-295: Improper Certificate Validation'
    owasp: 'A6: Security Misconfiguration'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_HOSTNAME_VERIFIER
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages: [java]
  patterns:
  - pattern-either:
    - pattern: |
        class $CLASS implements HostnameVerifier {
          ...
          public boolean verify(...) { return true; }
        }
    - pattern: |-
        new HostnameVerifier(...){
          public boolean verify(...) {
            return true;
          }
        }
- id: java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager
  metadata:
    cwe: 'CWE-295: Improper Certificate Validation'
    owasp: 'A3: Sensitive Data Exposure'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_TRUST_MANAGER
    references:
    - https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager
    semgrep.ruleset: r2c-security-audit
  message: |
    Detected empty trust manager implementations. This is dangerous because it accepts any
    certificate, enabling man-in-the-middle attacks. Consider using a KeyStore
    and TrustManagerFactory isntead.
    See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https
    for more information.
  severity: WARNING
  languages: [java]
  patterns:
  - pattern-either:
    - pattern-inside: |
        class $CLASS implements X509TrustManager {
          ...
        }
    - pattern-inside: |
        new X509TrustManager() {
          ...
        }
    - pattern-inside: |
        class $CLASS implements X509ExtendedTrustManager {
          ...
        }
    - pattern-inside: |
        new X509ExtendedTrustManager() {
          ...
        }
  - pattern-not: public void checkClientTrusted(...) { $SOMETHING; }
  - pattern-not: public void checkServerTrusted(...) { $SOMETHING; }
  - pattern-either:
    - pattern: public void checkClientTrusted(...) {}
    - pattern: public void checkServerTrusted(...) {}
    - pattern: public X509Certificate[] getAcceptedIssuers(...) { return null; }
- id: java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket
  metadata:
    cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp: 'A3: Sensitive Data Exposure'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNENCRYPTED_SOCKET
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket
    semgrep.ruleset: r2c-security-audit
  message: |
    This socket is not encrypted.
    The traffic could be read by an attacker intercepting the network traffic.
    Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory'
    instead
  severity: WARNING
  languages: [java]
  pattern-either:
  - pattern: new ServerSocket(...)
  - pattern: new Socket(...)
- id: java.lang.security.audit.crypto.weak-hash.use-of-md5
  message: |
    Detected MD5 hash algorithm which is considered insecure. MD5 is not
    collision resistant and is therefore not suitable as a cryptographic
    signature. Use SHA256 or SHA3 instead.
  languages: [java]
  severity: WARNING
  metadata:
    owasp: 'A9: Using Components with Known Vulnerabilities'
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_MD5
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.crypto.weak-hash.use-of-md5
    semgrep.ruleset: r2c-security-audit
  pattern-either:
  - pattern: |
      MessageDigest $VAR = $MD.getInstance("MD5");
  - pattern: |
      $DU.getMd5Digest().digest(...)
- id: java.lang.security.audit.crypto.weak-hash.use-of-sha1
  message: |
    Detected SHA1 hash algorithm which is considered insecure. SHA1 is not
    collision resistant and is therefore not suitable as a cryptographic
    signature. Use SHA256 or SHA3 instead.
  languages: [java]
  severity: WARNING
  metadata:
    owasp: 'A9: Using Components with Known Vulnerabilities'
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_SHA1
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.crypto.weak-hash.use-of-sha1
    semgrep.ruleset: r2c-security-audit
  pattern-either:
  - pattern: |
      MessageDigest $VAR = $MD.getInstance("SHA1");
  - pattern: |
      $DU.getSha1Digest().digest(...)
- id: java.lang.security.audit.el-injection.el-injection
  metadata:
    cwe: "CWE-94: Improper Control of Generation of Code ('Code Injection')"
    owasp: 'A1: Injection'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#EL_INJECTION
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.el-injection.el-injection
    semgrep.ruleset: r2c-security-audit
  message: |
    An expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.
  severity: WARNING
  languages: [java]
  patterns:
  - pattern-either:
    - pattern: |
        class $CLASS {
          ...
          ExpressionFactory $EF;
          ...
          $X $METHOD(...) {
            ...
            $EF.createValueExpression($CTX,$INPUT,...);
            ...
          }
          ...
        }
    - pattern: |
        class $CLASS {
          ...
          ExpressionFactory $EF = ...;
          ...
          $X $METHOD(...) {
            ...
            $EF.createValueExpression($CTX,$INPUT,...);
            ...
          }
          ...
        }
    - pattern: |
        $X $METHOD(...) {
          ...
          ExpressionFactory $EF = ...;
          ...
          $EF.createValueExpression($CTX,$INPUT,...);
          ...
        }
    - pattern: |
        $X $METHOD(...,ExpressionFactory $EF,...) {
          ...
          $EF.createValueExpression($CTX,$INPUT,...);
          ...
        }
    - pattern: |
        class $CLASS {
          ...
          ExpressionFactory $EF;
          ...
          $X $METHOD(...) {
            ...
            $EF.createMethodExpression($CTX,$INPUT,...);
            ...
          }
          ...
        }
    - pattern: |
        class $CLASS {
          ...
          ExpressionFactory $EF = ...;
          ...
          $X $METHOD(...) {
            ...
            $EF.createMethodExpression($CTX,$INPUT,...);
            ...
          }
          ...
        }
    - pattern: |
        $X $METHOD(...) {
          ...
          ExpressionFactory $EF = ...;
          ...
          $EF.createMethodExpression($CTX,$INPUT,...);
          ...
        }
    - pattern: |
        $X $METHOD(...,ExpressionFactory $EF,...) {
          ...
          $EF.createMethodExpression($CTX,$INPUT,...);
          ...
        }
  - pattern-not: |
      $X $METHOD(...) {
        ...
        $EF.createValueExpression($CTX,"...",...);
        ...
      }
  - pattern-not: |
      $X $METHOD(...) {
        ...
        String $S = "...";
        ...
        $EF.createValueExpression($CTX,$S,...);
        ...
      }
  - pattern-not: |
      $X $METHOD(...) {
        ...
        $EF.createMethodExpression($CTX,"...",...);
        ...
      }
  - pattern-not: |
      $X $METHOD(...) {
        ...
        String $S = "...";
        ...
        $EF.createMethodExpression($CTX,$S,...);
        ...
      }
- id: java.lang.security.audit.formatted-sql-string.formatted-sql-string
  metadata:
    cwe: "CWE-89: Improper Neutralization of Special Elements used in an SQL Command\
      \ ('SQL Injection')"
    owasp: 'A1: Injection'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SQL_INJECTION
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
    - https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps
    - https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string
    semgrep.ruleset: r2c-security-audit
  message: |
    Detected a formatted string in a SQL statement. This could lead to SQL
    injection if variables in the SQL statement are not properly sanitized.
    Use a prepared statements (java.sql.PreparedStatement) instead. You
    can obtain a PreparedStatement using 'connection.prepareStatement'.
  patterns:
  - pattern-not: $W.execute(<... "=~/.*TABLE *$/" ...>);
  - pattern-not: $W.execute(<... "=~/.*TABLE %s$/" ...>);
  - pattern-either:
    - pattern: $W.execute($X + $Y, ...);
    - pattern: |
        String $SQL = $X + $Y;
        ...
        $W.execute($SQL, ...);
    - pattern: |
        String $SQL = $X;
        ...
        $SQL += $Y;
        ...
        $W.execute($SQL, ...);
    - pattern: $W.execute(String.format($X, ...), ...);
    - pattern: |
        String $SQL = String.format($X, ...);
        ...
        $W.execute($SQL, ...);
    - pattern: |
        String $SQL = $X;
        ...
        $SQL += String.format(...);
        ...
        $W.execute($SQL, ...);
    - pattern: $W.executeQuery($X + $Y, ...);
    - pattern: |
        String $SQL = $X + $Y;
        ...
        $W.executeQuery($SQL, ...);
    - pattern: |
        String $SQL = $X;
        ...
        $SQL += $Y;
        ...
        $W.executeQuery($SQL, ...);
    - pattern: $W.executeQuery(String.format($X, ...), ...);
    - pattern: |
        String $SQL = String.format($X, ...);
        ...
        $W.executeQuery($SQL, ...);
    - pattern: |
        String $SQL = $X;
        ...
        $SQL += String.format(...);
        ...
        $W.executeQuery($SQL, ...);
    - pattern: $W.createQuery($X + $Y, ...);
    - pattern: |
        String $SQL = $X + $Y;
        ...
        $W.createQuery($SQL, ...);
    - pattern: |
        String $SQL = $X;
        ...
        $SQL += $Y;
        ...
        $W.createQuery($SQL, ...);
    - pattern: $W.createQuery(String.format($X, ...), ...);
    - pattern: |
        String $SQL = String.format($X, ...);
        ...
        $W.createQuery($SQL, ...);
    - pattern: |
        String $SQL = $X;
        ...
        $SQL += String.format(...);
        ...
        $W.createQuery($SQL, ...);
    - pattern: $W.query($X + $Y, ...);
    - pattern: |
        String $SQL = $X + $Y;
        ...
        $W.query($SQL, ...);
    - pattern: |
        String $SQL = $X;
        ...
        $SQL += $Y;
        ...
        $W.query($SQL, ...);
    - pattern: $W.query(String.format($X, ...), ...);
    - pattern: |
        String $SQL = String.format($X, ...);
        ...
        $W.query($SQL, ...);
    - pattern: |
        String $SQL = $X;
        ...
        $SQL += String.format(...);
        ...
        $W.query($SQL, ...);
  severity: WARNING
  languages:
  - java
- id: java.lang.security.audit.http-response-splitting.http-response-splitting
  metadata:
    cwe: "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP\
      \ Response Splitting')"
    owasp: 'A1: Injection'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#HTTP_RESPONSE_SPLITTING
    references:
    - https://www.owasp.org/index.php/HTTP_Response_Splitting
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.http-response-splitting.http-response-splitting
    semgrep.ruleset: r2c-security-audit
  message: |
    Older Java application servers are vulnreable to HTTP response splitting, which may occur if an HTTP
    request can be injected with CRLF characters. This finding is reported for completeness; it is recommended
    to ensure your environment is not affected by testing this yourself.
  severity: INFO
  patterns:
  - pattern-either:
    - pattern: |
        $VAR = $REQ.getParameter(...);
        ...
        $COOKIE = new Cookie(..., $VAR, ...);
        ...
        $RESP.addCookie($COOKIE, ...);
    - patterns:
      - pattern-inside: |
          $RETTYPE $FUNC(...,@PathVariable $TYPE $VAR, ...) {
            ...
          }
      - pattern: |
          $COOKIE = new Cookie(..., $VAR, ...);
          ...
          $RESP.addCookie($COOKIE, ...);
  languages:
  - java
- id: java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection
  metadata:
    cwe: 'CWE-297: Improper Validation of Certificate with Host Mismatch'
    owasp: 'A6: Security Misconfiguration'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#INSECURE_SMTP_SSL
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection
    semgrep.ruleset: r2c-security-audit
  message: |
    Insecure SMTP connection detected. This connection will trust any SSL certificate.
    Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'.
  severity: WARNING
  patterns:
  - pattern-not-inside: |
      $EMAIL.setSSLCheckServerIdentity(true);
      ...
  - pattern-inside: |
      $EMAIL = new SimpleEmail(...);
      ...
  - pattern: |-
      $EMAIL.send(...);
  languages:
  - java
- id: java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string
  metadata:
    cwe: "CWE-89: Improper Neutralization of Special Elements used in an SQL Command\
      \ ('SQL Injection')"
    owasp: 'A1: Injection'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SQL_INJECTION_SPRING_JDBC
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string
    semgrep.ruleset: r2c-security-audit
  message: |
    Possible JDBC injection detected. Use the parameterized query
    feature available in queryForObject instead of concatenating or formatting strings:
    'jdbc.queryForObject("select * from table where name = ?", Integer.class, parameterName);'
  patterns:
  - pattern-inside: |
      $JDBC = new JdbcTemplate(...);
      ...
  - pattern-either:
# Unsafe queryForObject
    - pattern: $JDBC.queryForObject($STR + $VAR, ...);
    - pattern: $JDBC.queryForObject(String.format(...), ...);
    - pattern: |
        String $Q = $STR + $VAR;
        ...
        $JDBC.queryForObject($Q, ...);
    - pattern: |
        String $Q = String.format(...);
        ...
        $JDBC.queryForObject($Q, ...);
    - pattern: |
        StringBuilder $Q = new StringBuilder(...);
        ...
        $Q.append($STR + $VAR);
        ...
        $JDBC.queryForObject($Q, ...);
# Unsafe queryForList
    - pattern: $JDBC.queryForList($STR + $VAR);
    - pattern: $JDBC.queryForList(String.format(...));
    - pattern: |
        String $Q = $STR + $VAR;
        ...
        $JDBC.queryForList($Q);
    - pattern: |
        String $Q = String.format(...);
        ...
        $JDBC.queryForList($Q);
    - pattern: |
        StringBuilder $Q = new StringBuilder(...);
        ...
        $Q.append($STR + $VAR);
        ...
        $JDBC.queryForList($Q, ...);
# Unsafe update
    - pattern: $JDBC.update($STR + $VAR);
    - pattern: $JDBC.update(String.format(...));
    - pattern: |
        String $Q = $STR + $VAR;
        ...
        $JDBC.update($Q);
    - pattern: |
        String $Q = String.format(...);
        ...
        $JDBC.update($Q);
    - pattern: |
        StringBuilder $Q = new StringBuilder(...);
        ...
        $Q.append($STR + $VAR);
        ...
        $JDBC.update($Q, ...);
# Unsafe execute
    - pattern: $JDBC.execute($STR + $VAR);
    - pattern: $JDBC.execute(String.format(...));
    - pattern: |
        String $Q = $STR + $VAR;
        ...
        $JDBC.execute($Q);
    - pattern: |
        String $Q = String.format(...);
        ...
        $JDBC.execute($Q);
    - pattern: |
        StringBuilder $Q = new StringBuilder(...);
        ...
        $Q.append($STR + $VAR);
        ...
        $JDBC.execute($Q, ...);
# Unsafe insert
    - pattern: $JDBC.insert($STR + $VAR);
    - pattern: $JDBC.insert(String.format(...));
    - pattern: |
        String $Q = $STR + $VAR;
        ...
        $JDBC.insert($Q);
    - pattern: |
        String $Q = String.format(...);
        ...
        $JDBC.insert($Q);
    - pattern: |
        StringBuilder $Q = new StringBuilder(...);
        ...
        $Q.append($STR + $VAR);
        ...
        $JDBC.insert($Q, ...);
  severity: WARNING
  languages:
  - java
- id: java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning
  metadata:
    owasp: 'A1: Injection'
    cwe: "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query\
      \ ('LDAP Injection')"
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#LDAP_ENTRY_POISONING
    references:
    - https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf
    - https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning
    semgrep.ruleset: r2c-security-audit
  message: |
    An object-returning LDAP search will allow attackers to control the LDAP response. This could
    lead to Remote Code Execution.
  severity: WARNING
  pattern-either:
      # SearchControls(int scope, long countlim, int timelim, String[] attrs, boolean retobj, boolean deref)
  - pattern: |
      new SearchControls($S, $CL, $TL, $AT, true, $DEREF)
  - pattern: |
      SearchControls $VAR = new SearchControls();
      ...
      $VAR.setReturningObjFlag(true);
  languages:
  - java
- id: java.lang.security.audit.ldap-injection.ldap-injection
  message: |
    Detected non-constant data passed into an LDAP query. If this data can be
    controlled by an external user, this is an LDAP injection.
    Ensure data passed to an LDAP query is not controllable; or properly sanitize
    the data.
  metadata:
    cwe: "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query\
      \ ('LDAP Injection')"
    owasp: 'A1: Injection'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#LDAP_INJECTION
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.ldap-injection.ldap-injection
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages: [java]
  patterns:
  - pattern-either:
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          InitialDirContext $CTX = ...;
          ...
        }
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          DirContext $CTX = ...;
          ...
        }
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          InitialLdapContext $CTX = ...;
          ...
        }
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          LdapContext $CTX = ...;
          ...
        }
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          LdapCtx $CTX = ...;
          ...
        }
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          EventDirContext $CTX = ...;
          ...
        }
  - pattern: |
      $X $METHOD(...) {
        ...
        $CTX.search($Y,$INPUT,...);
        ...
      }
  - pattern-not: |
      $X $METHOD(...) {
        ...
        $CTX.search($Y,"...",...);
        ...
      }
- id: java.lang.security.audit.object-deserialization.object-deserialization
  metadata:
    cwe: 'CWE-502: Deserialization of Untrusted Data'
    owasp: 'A8: Insecure Deserialization'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#OBJECT_DESERIALIZATION
    references:
    - https://www.owasp.org/index.php/Deserialization_of_untrusted_data
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.object-deserialization.object-deserialization
    semgrep.ruleset: r2c-security-audit
  message: |
    Found object deserialization using ObjectInputStream. Deserializing entire
    Java objects is dangerous because malicious actors can create Java object
    streams with unintended consequences. Ensure that the objects being deserialized
    are not user-controlled. If this must be done, consider using HMACs to sign
    the data stream to make sure it is not tampered with, or consider only
    transmitting object fields and populating a new object.
  patterns:
  - pattern: new ObjectInputStream(...);
  severity: WARNING
  languages:
  - java
- id: java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission
  message: |
    It is generally a bad practices to set overly permissive file permission such as read+write+exec for all users.
    If the file affected is a configuration, a binary, a script or sensitive data, it can lead to privilege escalation or information leakage.
  severity: WARNING
  languages: [java]
  metadata:
    cwe: 'CWE-276: Incorrect Default Permissions'
    owasp: 'A6: Security Misconfiguration'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#OVERLY_PERMISSIVE_FILE_PERMISSION
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission
    semgrep.ruleset: r2c-security-audit
  pattern-either:
  - pattern: java.nio.file.Files.setPosixFilePermissions($FILE, java.nio.file.attribute.PosixFilePermissions.fromString("=~/(^......r..$)|(^.......w.$)|(^........x$)/"));
  - pattern: |
      $TYPE $P = java.nio.file.attribute.PosixFilePermissions.fromString("=~/(^......r..$)|(^.......w.$)|(^........x$)/");
      ...
      java.nio.file.Files.setPosixFilePermissions($FILE, $P);
  - pattern: |
      $P.add(java.nio.file.attribute.PosixFilePermission.OTHERS_READ);
      ...
      java.nio.file.Files.setPosixFilePermissions($FILE, $P);
  - pattern: |
      $P.add(java.nio.file.attribute.PosixFilePermission.OTHERS_WRITE);
      ...
      java.nio.file.Files.setPosixFilePermissions($FILE, $P);
  - pattern: |-
      $P.add(java.nio.file.attribute.PosixFilePermission.OTHERS_EXECUTE);
      ...
      java.nio.file.Files.setPosixFilePermissions($FILE, $P);
- id: java.lang.security.audit.permissive-cors.permissive-cors
  message: |
    https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS
    Permissive CORS policy will allow a malicious application to communicate with the victim application in an inappropriate way, leading to spoofing, data theft, relay and other attacks.
  severity: WARNING
  languages: [java]
  pattern-either:
  - pattern: |
      HttpServletResponse $RES = ...;
      ...
      $RES.addHeader("=~/access-control-allow-origin/i", "=~/^*|null$/i");
  - pattern: |
      HttpServletResponse $RES = ...;
      ...
      $RES.setHeader("=~/access-control-allow-origin/i", "=~/^*|null$/i");
  - pattern: |
      ServerHttpResponse $RES = ...;
      ...
      $RES.getHeaders().add("=~/access-control-allow-origin/i", "=~/^*|null$/i");
  - pattern: |
      HttpHeaders $HEADERS = ...;
      ...
      $HEADERS.set("=~/access-control-allow-origin/i", "=~/^*|null$/i");
  - pattern: |
      ServerWebExchange $SWE = ...;
      ...
      $SWE.getResponse().getHeaders().add("Access-Control-Allow-Origin", "*");
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...) {
        ...
        $RES.addHeader("=~/access-control-allow-origin/i", "=~/^*|null$/i");
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...) {
        ...
        $RES.setHeader("=~/access-control-allow-origin/i", "=~/^*|null$/i");
        ...
      }
  - pattern: |
      $X $METHOD(...,ServerHttpResponse $RES,...) {
        ...
        $RES.getHeaders().add("=~/access-control-allow-origin/i", "=~/^*|null$/i");
        ...
      }
  - pattern: |
      $X $METHOD(...,ServerWebExchange $SWE,...) {
        ...
        $SWE.getResponse().getHeaders().add("=~/access-control-allow-origin/i", "=~/^*|null$/i");
        ...
      }
  - pattern: ResponseEntity.$RES().header("=~/access-control-allow-origin/i", "=~/^*|null$/i")
  - pattern: ServerResponse.$RES().header("=~/access-control-allow-origin/i", "=~/^*|null$/i")
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.permissive-cors.permissive-cors
    semgrep.ruleset: r2c-security-audit
- id: java.lang.security.audit.script-engine-injection.script-engine-injection
  message: |
    Detected potential code injection using ScriptEngine. Ensure
    user-controlled data cannot enter '.eval()', otherwise, this is
    a code injection vulnerability.
  metadata:
    cwe: "CWE-94: Improper Control of Generation of Code ('Code Injection')"
    owasp: 'A1: Injection'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SCRIPT_ENGINE_INJECTION
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.script-engine-injection.script-engine-injection
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages: [java]
  patterns:
  - pattern-either:
    - pattern-inside: |
        class $CLASS {
          ...
          ScriptEngine $SE;
          ...
        }
    - pattern-inside: |
        class $CLASS {
          ...
          ScriptEngine $SE = ...;
          ...
        }
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          ScriptEngine $SE = ...;
          ...
        }
  - pattern: |
      $X $METHOD(...) {
        ...
        $SE.eval(...);
        ...
      }
  - pattern-not: |
      $X $METHOD(...) {
        ...
        $SE.eval("...");
        ...
      }
  - pattern-not: |
      $X $METHOD(...) {
        ...
        String $S = "...";
        ...
        $SE.eval($S);
        ...
      }
- id: java.lang.security.audit.unvalidated-redirect.unvalidated-redirect
  message: |
    Application redirects to a destination URL specified by a user-supplied
    parameter that is not validated. This could direct users to malicious locations.
    Consider using a whitelist to validate URLs.
  metadata:
    cwe: "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"
    owasp: 'A1: Injection'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNVALIDATED_REDIRECT
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages: [java]
  pattern-either:
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...,String $URL,...) {
        ...
        $RES.sendRedirect($URL);
        ...
      }
  - pattern: |
      $X $METHOD(...,String $URL,...,HttpServletResponse $RES,...) {
        ...
        $RES.sendRedirect($URL);
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) {
        ...
        String $URL = $REQ.getParameter(...);
        ...
        $RES.sendRedirect($URL);
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) {
        ...
        String $URL = $REQ.getParameter(...);
        ...
        $RES.sendRedirect($URL);
        ...
      }
  - pattern: |
      $X $METHOD(...,String $URL,...) {
        ...
        HttpServletResponse $RES = ...;
        ...
        $RES.sendRedirect($URL);
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) {
        ...
        $RES.sendRedirect($REQ.getParameter(...));
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) {
        ...
        $RES.sendRedirect($REQ.getParameter(...));
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...,String $URL,...) {
        ...
        $RES.addHeader("Location",$URL);
        ...
      }
  - pattern: |
      $X $METHOD(...,String $URL,...,HttpServletResponse $RES,...) {
        ...
        $RES.addHeader("Location",$URL);
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) {
        ...
        String $URL = $REQ.getParameter(...);
        ...
        $RES.addHeader("Location",$URL);
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) {
        ...
        String $URL = $REQ.getParameter(...);
        ...
        $RES.addHeader("Location",$URL);
        ...
      }
  - pattern: |
      $X $METHOD(...,String $URL,...) {
        ...
        HttpServletResponse $RES = ...;
        ...
        $RES.addHeader("Location",$URL);
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) {
        ...
        $RES.addHeader("Location",$REQ.getParameter(...));
        ...
      }
  - pattern: |-
      $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) {
        ...
        $RES.addHeader("Location",$REQ.getParameter(...));
        ...
      }
- id: java.lang.security.audit.url-rewriting.url-rewriting
  message: |
    URL rewriting has significant security risks.
    Since session ID appears in the URL, it may be easily seen by third parties.
  metadata:
    cwe: 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#URL_REWRITING
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.url-rewriting.url-rewriting
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages: [java]
  pattern-either:
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...) {
        ...
        $RES.encodeURL(...);
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...) {
        ...
        $RES.encodeUrl(...);
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...) {
        ...
        $RES.encodeRedirectURL(...);
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...) {
        ...
        $RES.encodeRedirectUrl(...);
        ...
      }
  - pattern: |
      $X $METHOD(...) {
        ...
        HttpServletResponse $RES = ...;
        ...
        $RES.encodeURL(...);
        ...
      }
  - pattern: |
      $X $METHOD(...) {
        ...
        HttpServletResponse $RES = ...;
        ...
        $RES.encodeUrl(...);
        ...
      }
  - pattern: |
      $X $METHOD(...) {
        ...
        HttpServletResponse $RES = ...;
        ...
        $RES.encodeRedirectURL(...);
        ...
      }
  - pattern: |-
      $X $METHOD(...) {
        ...
        HttpServletResponse $RES = ...;
        ...
        $RES.encodeRedirectUrl(...);
        ...
      }
- id: java.lang.security.audit.weak-ssl-context.weak-ssl-context
  metadata:
    cwe: 'CWE-326: Inadequate Encryption Strength'
    owasp: 'A3: Sensitive Data Exposure'
    source_rule_url: https://find-sec-bugs.github.io/bugs.htm#SSL_CONTEXT
    references:
    - https://tools.ietf.org/html/rfc7568
    - https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.weak-ssl-context.weak-ssl-context
    semgrep.ruleset: r2c-security-audit
  message: |
    An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions
    are considered weak encryption and are deprecated.
    Use SSLContext.getInstance("TLSv1.2") for the best security.
  severity: WARNING
  languages: [java]
  patterns:
  - pattern-not: SSLContext.getInstance("TLS1.3")
  - pattern-not: SSLContext.getInstance("TLS1.2")
  - pattern: SSLContext.getInstance("...")
  fix-regex:
    regex: (.*?)\.getInstance\(.*?\)
    replacement: \1.getInstance("TLS1.2")
- id: java.lang.security.audit.xml-decoder.xml-decoder
  message: |
    XMLDecoder should not be used to parse untrusted data.
    Deserializing user input can lead to arbitrary code execution.
    Use an alternative and explicitly disable external entities.
    See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
    for alternatives and vulnerability prevention.
  metadata:
    cwe: 'CWE-611: Improper Restriction of XML External Entity Reference'
    owasp: 'A4: XML External Entities (XXE)'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XML_DECODER
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.xml-decoder.xml-decoder
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages: [java]
  patterns:
  - pattern: |
      $X $METHOD(...) {
        ...
        new XMLDecoder(...);
        ...
      }
  - pattern-not: |
      $X $METHOD(...) {
        ...
        new XMLDecoder("...");
        ...
      }
  - pattern-not: |-
      $X $METHOD(...) {
        ...
        String $STR = "...";
        ...
        new XMLDecoder($STR);
        ...
      }
- id: java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure
  metadata:
    owasp: 'A7: Cross-Site Scripting (XSS)'
    cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site\
      \ Scripting')"
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XSS_REQUEST_WRAPPER
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure
    semgrep.ruleset: r2c-security-audit
  message: |
    It looks like you're using an implementation of XSSRequestWrapper from dzone.
    (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html)
    The XSS filtering in this code is not secure and can be bypassed by malicious actors.
    It is recommended to use a stack that automatically escapes in your view or templates
    instead of filtering yourself.
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern: |
        class XSSRequestWrapper extends HttpServletRequestWrapper {
          ...
        }
    - pattern: |-
        $P = $X.compile("</script>", $X.CASE_INSENSITIVE);
        $V = $P.matcher(...).replaceAll("");
  languages:
  - java
- id: java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal
  metadata:
    cwe: "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path\
      \ Traversal')"
    owasp: 'A1: Injection'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN
    references:
    - https://www.owasp.org/index.php/Path_Traversal
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal
    semgrep.ruleset: r2c-security-audit
  message: |
    Detected a potential path traversal. A malicious actor
    could control the location of this file, to include going backwards
    in the directory with '../'. To address this, ensure that user-controlled
    variables in file paths are sanitized. You may aslso consider using a utility
    method such as org.apache.commons.io.FilenameUtils.getName(...) to only
    retrieve the file name from the path.
  patterns:
  - pattern-inside: |
      $RETURNTYPE $FUNC (..., HttpServletRequest $REQ, ...) {
        ...
      }
  - pattern-either:
    - pattern: |
        $VAR = ($TYPE)$REQ.getParameter(...);
        ...
        new File(..., $VAR, ...);
    - pattern: |
        $VAR = $REQ.getParameter(...);
        ...
        new File(..., $VAR, ...);
  severity: ERROR
  languages:
  - java
- id: java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss
  message: |
    Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User
    input was detected going directly from the HttpServletRequest into output. Ensure your
    data is properly encoded using org.owasp.encoder.Encode.forHtml: 'Encode.forHtml($VAR)'.
  metadata:
    cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site\
      \ Scripting')"
    owasp: "A7: Cross-Site Scripting ('XSS')"
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XSS_SERVLET
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss
    semgrep.ruleset: r2c-security-audit
  severity: ERROR
  patterns:
  - pattern-inside: $TYPE $FUNC(..., HttpServletResponse $RESP, ...) { ... }
  - pattern-inside: $VAR = $REQ.getParameter(...); ...
  - pattern-either:
    - pattern: $RESP.getWriter(...).write(..., $VAR, ...);
    - pattern: |
        $WRITER = $RESP.getWriter(...);
        ...
        $WRITER.write(..., $VAR, ...);
  languages:
  - java
- id: java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled
  severity: ERROR
  metadata:
    cwe: 'CWE-611: Improper Restriction of XML External Entity Reference'
    owasp: 'A4: XML External Entities (XXE)'
    references:
    - https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled
    semgrep.ruleset: r2c-security-audit
  message: |
    XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity
    attacks. Disable external entities by setting "javax.xml.stream.isSupportingExternalEntities" to false.
  pattern: $XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities",
    true);
  languages:
  - java
- id: java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe
  severity: WARNING
  metadata:
    cwe: 'CWE-611: Improper Restriction of XML External Entity Reference'
    owasp: 'A4: XML External Entities (XXE)'
    references:
    - https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf
    - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe
    semgrep.ruleset: r2c-security-audit
  message: |
    XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity
    vulnerabilities. Explicitly disable external entities by setting "javax.xml.stream.isSupportingExternalEntities" to false.
  patterns:
  - pattern-not-inside: |
      $RETURNTYPE $METHOD(...) {
        ...
        $XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", false);
        ...
      }
  - pattern-not-inside: |
      $RETURNTYPE $METHOD(...) {
        ...
        $XMLFACTORY.setProperty(java.xml.stream.XMLFactoryInput.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
        ...
      }
  - pattern-either:
    - pattern: $XMLFACTORY = $W.newFactory(...);
    - pattern: $XMLFACTORY = new XMLInputFactory(...);
  languages:
  - java
- id: java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization
  severity: ERROR
  metadata:
    cwe: 'CWE-502: Deserialization of Untrusted Data'
    owasp: 'A8: Insecure Deserialization'
    references:
    - https://mogwailabs.de/blog/2019/03/attacking-java-rmi-services-after-jep-290/
    - https://frohoff.github.io/appseccali-marshalling-pickles/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization
    semgrep.ruleset: r2c-security-audit
  message: |
    Using an arbitrary object ('Object $PARAM') with Java RMI is an insecure deserialization
    vulnerability. This object can be manipulated by a malicious actor allowing them to execute
    code on your system. Instead, use an integer ID to look up your object, or consider alternative
    serializiation schemes such as JSON.
  patterns:
  - pattern: |
      interface $INTERFACE extends Remote {
        $RETURNTYPE $METHOD(Object $PARAM) throws RemoteException;
      }
  languages:
  - java
- id: java.spring.security.audit.spel-injection.spel-injection
  message: |
    A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.
  metadata:
    cwe: "CWE-94: Improper Control of Generation of Code ('Code Injection')"
    owasp: 'A1: Injection'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SPEL_INJECTION
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.spring.security.audit.spel-injection.spel-injection
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages: [java]
  patterns:
  - pattern-either:
    - pattern-inside: |
        class $CLASS {
          ...
          ExpressionParser $PARSER;
          ...
        }
    - pattern-inside: |
        class $CLASS {
          ...
          ExpressionParser $PARSER = ...;
          ...
        }
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          ExpressionParser $PARSER = ...;
          ...
        }
    - pattern-inside: |
        class $CLASS {
          ...
          SpelExpressionParser $PARSER;
          ...
        }
    - pattern-inside: |
        class $CLASS {
          ...
          SpelExpressionParser $PARSER = ...;
          ...
        }
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          SpelExpressionParser $PARSER = ...;
          ...
        }
    - pattern-inside: |
        class $CLASS {
          ...
          TemplateAwareExpressionParser $PARSER;
          ...
        }
    - pattern-inside: |
        class $CLASS {
          ...
          TemplateAwareExpressionParser $PARSER = ...;
          ...
        }
    - pattern-inside: |
        $X $METHOD(...) {
          ...
          TemplateAwareExpressionParser $PARSER = ...;
          ...
        }
  - pattern: |
      $X $METHOD(...) {
        ...
        $PARSER.parseExpression(...);
        ...
      }
  - pattern-not: |
      $X $METHOD(...) {
        ...
        $PARSER.parseExpression("...");
        ...
      }
  - pattern-not: |
      $X $METHOD(...) {
        ...
        String $S = "...";
        ...
        $PARSER.parseExpression($S);
        ...
      }
- id: java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled
  message: |
    CSRF is disabled for this configuration. This is a security risk.
  metadata:
    cwe: 'CWE-352: Cross-Site Request Forgery (CSRF)'
    owasp: 'A6: Security Misconfiguration'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_PROTECTION_DISABLED
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages: [java]
  pattern: $OBJ.csrf(...).disable(...)
- id: java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect
  message: |
    Application redirects a user to a destination URL specified by a user supplied parameter that is not validated.
  metadata:
    cwe: "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"
    owasp: 'A1: Injection'
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNVALIDATED_REDIRECT
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages: [java]
  pattern-either:
  - pattern: |
      $X $METHOD(...,String $URL,...) {
        return "redirect:" + $URL;
      }
  - pattern: |
      $X $METHOD(...,String $URL,...) {
        ...
        String $REDIR = "redirect:" + $URL;
        ...
        return $REDIR;
        ...
      }
  - pattern: |
      $X $METHOD(...,String $URL,...) {
        ...
        new ModelAndView("redirect:" + $URL);
        ...
      }
  - pattern: |-
      $X $METHOD(...,String $URL,...) {
        ...
        String $REDIR = "redirect:" + $URL;
        ...
        new ModelAndView($REDIR);
        ...
      }
- id: javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection
  message: |
    Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker
    could tamper with the gRPC message, which could compromise the machine.
  metadata:
    owasp: 'A8: Insecure Deserialization'
    cwe: 'CWE-502: Deserialization of Untrusted Data'
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection
    semgrep.ruleset: r2c-security-audit
  severity: ERROR
  languages: [javascript]
  pattern-either:
  - pattern: |
      require('grpc');
      ...
      $GRPC($ADDR,...,$CREDENTIALS.createInsecure(),...);
  - pattern: |-
      require('grpc');
      ...
      $CREDS = <... $CREDENTIALS.createInsecure() ...>;
      ...
      $GRPC($ADDR,...,$CREDS,...);
- id: javascript.jose.security.jwt-exposed-credentials.jwt-exposed-credentials
  languages:
  - javascript
  metadata:
    cwe: 'CWE-522: Insufficiently Protected Credentials'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    references:
    - https://cwe.mitre.org/data/definitions/522.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.jose.security.jwt-exposed-credentials.jwt-exposed-credentials
    semgrep.ruleset: r2c-security-audit
  message: |
    Password is exposed through JWT token payload. This is not encrypted and
    the password could be compromised. Do not store passwords in JWT tokens.
  patterns:
  - pattern-either:
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $T = JWT.sign({password:...},...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $T = JWT.sign({password:...},...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $P = {password:...};
        ...
        var $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $P = {password:...};
        ...
        $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P = {password:...};
        ...
        var $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P = {password:...};
        ...
        $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P.password = ...;
        ...
        var $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P.password = ...;
        ...
        $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $P = Object.assign(...,{password:...},...);
        ...
        var $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $P = Object.assign(...,{password:...},...);
        ...
        $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P = Object.assign(...,{password:...},...);
        ...
        var $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P = Object.assign(...,{password:...},...);
        ...
        $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $T = JWT.sign(Object.assign(...,{password:...},...),...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $T = JWT.sign(Object.assign(...,{password:...},...),...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $T = JWT.sign({$U:{password:...}},...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $T = JWT.sign({$U:{password:...}},...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $P = {$U:{password:...}};
        ...
        var $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $P = {$U:{password:...}};
        ...
        $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P = {$U:{password:...}};
        ...
        var $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P = {$U:{password:...}};
        ...
        $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P.$U.password = ...;
        ...
        var $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P.$U.password = ...;
        ...
        $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $P = Object.assign(...,{$U:{password:...}},...);
        ...
        var $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $P = Object.assign(...,{$U:{password:...}},...);
        ...
        $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P = Object.assign(...,{$U:{password:...}},...);
        ...
        var $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $P = Object.assign(...,{$U:{password:...}},...);
        ...
        $T = JWT.sign($P,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $T = JWT.sign(Object.assign(...,{$U:{password:...}},...),...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        $T = JWT.sign(Object.assign(...,{$U:{password:...}},...),...);
  severity: ERROR
- id: javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret
  message: |
    Hardcoded JWT secret or private key is used.
    This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html
    Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables: process.env.SECRET)
  metadata:
    cwe: 'CWE-522: Insufficiently Protected Credentials'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret
    semgrep.ruleset: r2c-security-audit
  patterns:
  - pattern-either:
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        JWT.verify($P, "...", ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $T = JWT.sign($P, "...", ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $T = JWT.verify($P, "...", ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        JWT.verify($P, JWK.asKey("..."), ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $KEY = JWK.asKey("...");
        ...
        JWT.verify($P, $KEY, ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $T = JWT.sign($P, JWK.asKey("..."), ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $T = JWT.verify($P, JWK.asKey("..."), ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $KEY = JWK.asKey("...");
        ...
        var $T = JWT.sign($P, $KEY, ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $KEY = JWK.asKey("...");
        ...
        var $T = JWT.verify($P, $KEY, ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $SECRET = "...";
        ...
        JWT.verify($P, $SECRET, ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $SECRET = "...";
        ...
        var $T = JWT.sign($P, $SECRET, ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWT } = $JOSE;
        ...
        var $SECRET = "...";
        ...
        var $T = JWT.verify($P, $SECRET, ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $SECRET = "...";
        ...
        JWT.verify($P, JWK.asKey($SECRET), ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $SECRET = "...";
        ...
        var $KEY = JWK.asKey($SECRET);
        ...
        JWT.verify($P, $KEY, ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $SECRET = "...";
        ...
        var $T = JWT.sign($P, JWK.asKey($SECRET), ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $SECRET = "...";
        ...
        var $KEY = JWK.asKey($SECRET);
        ...
        var $T = JWT.sign($P, $KEY, ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $SECRET = "...";
        ...
        var $T = JWT.verify($P, JWK.asKey($SECRET), ...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $SECRET = "...";
        ...
        var $KEY = JWK.asKey($SECRET);
        ...
        var $T = JWT.verify($P, $KEY, ...);
  languages: [javascript]
  severity: ERROR
- id: javascript.jose.security.jwt-none-alg.jwt-none-alg
  message: |
    Detected use of the 'none' algorithm in a JWT token.
    The 'none' algorithm assumes the integrity of the token has already
    been verified. This would allow a malicious actor to forge a JWT token
    that will automatically be verified. Do not explicitly use the 'none'
    algorithm. Instead, use an algorithm such as 'HS256'.
  metadata:
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg
    semgrep.ruleset: r2c-security-audit
  languages: [javascript]
  severity: ERROR
  patterns:
  - pattern-either:
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        var $T = JWT.verify($P, JWK.None,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        $T = JWT.verify($P, JWK.None,...);
    - pattern: |
        var $JOSE = require("jose");
        ...
        var { JWK, JWT } = $JOSE;
        ...
        JWT.verify($P, JWK.None,...);
- id: javascript.jsonwebtoken.security.jwt-exposed-credentials.jwt-exposed-credentials
  languages:
  - javascript
  metadata:
    cwe: 'CWE-522: Insufficiently Protected Credentials'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    references:
    - https://cwe.mitre.org/data/definitions/522.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-exposed-credentials.jwt-exposed-credentials
    semgrep.ruleset: r2c-security-audit
  message: |
    Password is exposed through JWT token payload. This is not encrypted and
    the password could be compromised. Do not store passwords in JWT tokens.
  patterns:
  - pattern-either:
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $T = $JWT.sign({password:...},...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $T = $JWT.sign({password:...},...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $JWT.sign({password:...},...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = {password:...};
        ...
        var $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = {password:...};
        ...
        $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = {password:...};
        ...
        $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = {password:...};
        ...
        var $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = {password:...};
        ...
        $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = {password:...};
        ...
        $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P.password = ...;
        ...
        var $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P.password = ...;
        ...
        $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P.password = ...;
        ...
        $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = Object.assign(...,{password:...},...);
        ...
        var $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = Object.assign(...,{password:...},...);
        ...
        $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = Object.assign(...,{password:...},...);
        ...
        $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = Object.assign(...,{password:...},...);
        ...
        var $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = Object.assign(...,{password:...},...);
        ...
        $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = Object.assign(...,{password:...},...);
        ...
        $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $T = $JWT.sign(Object.assign(...,{password:...},...),...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $T = $JWT.sign(Object.assign(...,{password:...},...),...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $JWT.sign(Object.assign(...,{password:...},...),...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $T = $JWT.sign({$U:{password:...}},...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $T = $JWT.sign({$U:{password:...}},...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $JWT.sign({$U:{password:...}},...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = {$U:{password:...}};
        ...
        var $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = {$U:{password:...}};
        ...
        $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = {$U:{password:...}};
        ...
        $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = {$U:{password:...}};
        ...
        var $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = {$U:{password:...}};
        ...
        $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = {$U:{password:...}};
        ...
        $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P.$U.password = ...;
        ...
        var $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P.$U.password = ...;
        ...
        $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P.$U.password = ...;
        ...
        $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = Object.assign(...,{$U:{password:...}},...);
        ...
        var $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = Object.assign(...,{$U:{password:...}},...);
        ...
        $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $P = Object.assign(...,{$U:{password:...}},...);
        ...
        $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = Object.assign(...,{$U:{password:...}},...);
        ...
        var $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = Object.assign(...,{$U:{password:...}},...);
        ...
        $T = $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $P = Object.assign(...,{$U:{password:...}},...);
        ...
        $JWT.sign($P,...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $T = $JWT.sign(Object.assign(...,{$U:{password:...}},...),...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $T = $JWT.sign(Object.assign(...,{$U:{password:...}},...),...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $JWT.sign(Object.assign(...,{$U:{password:...}},...),...);
  severity: ERROR
- id: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret
  message: |
    Hardcoded JWT secret or private key is used.
    This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html
    Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables: process.env.SECRET)
  metadata:
    cwe: 'CWE-522: Insufficiently Protected Credentials'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret
    semgrep.ruleset: r2c-security-audit
  patterns:
  - pattern-either:
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $T = $JWT.sign($P, "...", ...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $T = $JWT.verify($P, "...", ...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $JWT.sign($P, "...", ...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $JWT.verify($P, "...", ...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $SECRET = "...";
        ...
        var $T = $JWT.sign($P, $SECRET, ...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $SECRET = "...";
        ...
        var $T = $JWT.verify($P, $SECRET, ...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $SECRET = "...";
        ...
        $JWT.sign($P, $SECRET, ...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $SECRET = "...";
        ...
        $JWT.verify($P, $SECRET, ...);
  languages: [javascript]
  severity: ERROR
- id: javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg
  message: |
    Detected use of the 'none' algorithm in a JWT token.
    The 'none' algorithm assumes the integrity of the token has already
    been verified. This would allow a malicious actor to forge a JWT token
    that will automatically be verified. Do not explicitly use the 'none'
    algorithm. Instead, use an algorithm such as 'HS256'.
  metadata:
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://r2c.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg
    semgrep.ruleset: r2c-security-audit
  languages: [javascript]
  severity: ERROR
  patterns:
  - pattern-either:
          # jsonwebtoken
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        var $T = $JWT.verify($P, $X, {algorithms:[...,'none',...]},...);
    - pattern: |
        var $JWT = require("jsonwebtoken");
        ...
        $T = $JWT.verify($P, $X, {algorithms:[...,'none',...]},...);
    - pattern: |-
        var $JWT = require("jsonwebtoken");
        ...
        $JWT.verify($P, $X, {algorithms:[...,'none',...]},...);
- id: javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert
  metadata:
    cwe: 'CWE-119: Improper Restriction of Operations within the Bounds of a Memory
      Buffer'
    source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-buffer-noassert.js
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.lang.security.detect-buffer-noassert.detect-buffer-noassert
    semgrep.ruleset: r2c-security-audit
  message: |
    Detected usage of noassert in Buffer API, which allows the offset the be beyond the
    end of the buffer. This could result in writing or reading beyond the end of the buffer.
  pattern-either:
  - pattern: $OBJ.readUInt8(..., true)
  - pattern: $OBJ.readUInt16LE(..., true)
  - pattern: $OBJ.readUInt16BE(..., true)
  - pattern: $OBJ.readUInt32LE(..., true)
  - pattern: $OBJ.readUInt32BE(..., true)
  - pattern: $OBJ.readInt8(..., true)
  - pattern: $OBJ.readInt16LE(..., true)
  - pattern: $OBJ.readInt16BE(..., true)
  - pattern: $OBJ.readInt32LE(..., true)
  - pattern: $OBJ.readInt32BE(..., true)
  - pattern: $OBJ.readFloatLE(..., true)
  - pattern: $OBJ.readFloatBE(..., true)
  - pattern: $OBJ.readDoubleLE(..., true)
  - pattern: $OBJ.readDoubleBE(..., true)
  - pattern: $OBJ.writeUInt8(..., true)
  - pattern: $OBJ.writeUInt16LE(..., true)
  - pattern: $OBJ.writeUInt16BE(..., true)
  - pattern: $OBJ.writeUInt32LE(..., true)
  - pattern: $OBJ.writeUInt32BE(..., true)
  - pattern: $OBJ.writeInt8(..., true)
  - pattern: $OBJ.writeInt16LE(..., true)
  - pattern: $OBJ.writeInt16BE(..., true)
  - pattern: $OBJ.writeInt32LE(..., true)
  - pattern: $OBJ.writeInt32BE(..., true)
  - pattern: $OBJ.writeFloatLE(..., true)
  - pattern: $OBJ.writeFloatBE(..., true)
  - pattern: $OBJ.writeDoubleLE(..., true)
  - pattern: $OBJ.writeDoubleBE(..., true)
  severity: WARNING
  languages:
  - javascript
  - typescript
- id: javascript.lang.security.detect-child-process.detect-child-process
  metadata:
    cwe: "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code\
      \ ('Eval Injection')"
    owasp: 'A1: Injection'
    source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-child-process.js
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.lang.security.detect-child-process.detect-child-process
    semgrep.ruleset: r2c-security-audit
  message: |
    Detected non-literal calls to child_process.exec(). This could lead to a command
    injection vulnerability.
  patterns:
  - pattern: child_process.exec(...)
  - pattern-not: child_process.exec('...')
  severity: WARNING
  languages:
  - javascript
  - typescript
- id: javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape
  metadata:
    cwe: 'CWE-116: Improper Encoding or Escaping of Output'
    owasp: 'A7: Cross-Site Scripting XSS'
    source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-disable-mustache-escape.js
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape
    semgrep.ruleset: r2c-security-audit
  message: |
    Markup escaping disabled. This can be used with some template engines to escape
    disabling of HTML entities, which can lead to XSS attacks.
  pattern: $OBJ.escapeMarkup = false
  severity: WARNING
  languages:
  - javascript
  - typescript
- id: javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression
  metadata:
    cwe: "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code\
      \ ('Eval Injection')"
    owasp: 'A1: Injection'
    source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-eval-with-expression.js
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression
    semgrep.ruleset: r2c-security-audit
  message: |
    Detected eval(variable), which could allow a malicious actor to run arbitrary code.
  patterns:
  - pattern: eval($OBJ)
  - pattern-not: eval("...")
  severity: WARNING
  languages:
  - javascript
  - typescript
- id: javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override
  metadata:
    cwe: 'CWE-352: Cross-Site Request Forgery (CSRF)'
    source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-no-csrf-before-method-override.js
    references:
    - https://github.com/nodesecurity/eslint-plugin-security/blob/master/docs/bypass-connect-csrf-protection-by-abusing.md
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.lang.security.detect-no-csrf-before-method-override.detect-no-csrf-before-method-override
    semgrep.ruleset: r2c-security-audit
  message: |
    Detected use of express.csrf() middleware before express.methodOverride(). This can
    allow GET requests (which are not checked by csrf) to turn into POST requests later.
  pattern: |
    express.csrf();
    ...
    express.methodOverride();
  severity: WARNING
  languages:
  - javascript
  - typescript
- id: javascript.lang.security.detect-non-literal-require.detect-non-literal-require
  metadata:
    cwe: "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code\
      \ ('Eval Injection')"
    owasp: 'A1: Injection'
    source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-non-literal-require.js
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.lang.security.detect-non-literal-require.detect-non-literal-require
    semgrep.ruleset: r2c-security-audit
  message: |
    Detected the use of require(variable). Calling require with a non-literal argument might
    allow an attacker to load an run arbitrary code, or access arbitrary files.
  patterns:
  - pattern: require($OBJ)
  - pattern-not: require('...')
  severity: WARNING
  languages:
  - javascript
  - typescript
- id: javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes
  metadata:
    cwe: 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)'
    owasp: 'A9: Using Components with Known Vulnerabilities'
    source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-pseudoRandomBytes.js
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes
    semgrep.ruleset: r2c-security-audit
  message: |
    Detected usage of crypto.pseudoRandomBytes, which does not produce secure random numbers.
  pattern: crypto.pseudoRandomBytes
  severity: WARNING
  languages:
  - javascript
  - typescript
- id: javascript.lang.security.spawn-git-clone.spawn-git-clone
  message: |
    Git allows shell commands to be specified in ext URLs for remote repositories.
    For example, git clone 'ext::sh -c whoami% >&2' will execute the whoami command to try to connect to a remote repository.
    Make sure that the URL is not controlled by external input.
  metadata:
    cwe: "CWE-78: Improper Neutralization of Special Elements used in an OS Command\
      \ ('OS Command Injection')"
    owasp: 'A1: Injection'
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.lang.security.spawn-git-clone.spawn-git-clone
    semgrep.ruleset: r2c-security-audit
  languages:
  - javascript
  - typescript
  severity: ERROR
  patterns:
  - pattern-either:
    - pattern: spawn('git', ['clone',...,$F])
    - pattern: $X.spawn('git', ['clone',...,$F])
    - pattern: spawn('git', ['clone',...,$P,$F])
    - pattern: $X.spawn('git', ['clone',...,$P,$F])
  - pattern-not: spawn('git', ['clone',...,"..."])
  - pattern-not: $X.spawn('git', ['clone',...,"..."])
  - pattern-not: spawn('git', ['clone',...,"...","..."])
  - pattern-not: $X.spawn('git', ['clone',...,"...","..."])
- id: javascript.node-expat.security.audit.expat-xxe.expat-xxe
  message: |
    If unverified user data can reach the XML Parser it can result in XML External or
    Internal Entity (XXE) Processing vulnerabilities
  metadata:
    owasp: 'A4: XML External Entities (XXE)'
    cwe: 'CWE-611: Improper Restriction of XML External Entity Reference'
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.node-expat.security.audit.expat-xxe.expat-xxe
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages: [javascript]
  patterns:
  - pattern-either:
    - pattern: |
        var $EXPAT = require('node-expat');
        ...
        new $EXPAT.Parser(...);
        ...
        $PARSER.parse(...);
    - pattern: |
        var $EXPAT = require('node-expat');
        ...
        new $EXPAT.Parser(...);
        ...
        $PARSER.write(...);
    - pattern: |
        require('node-expat');
        ...
        new Parser(...);
        ...
        $PARSER.parse(...);
    - pattern: |
        require('node-expat');
        ...
        new Parser(...);
        ...
        $PARSER.write(...);
  - pattern-not: |
      var $EXPAT = require('node-expat');
      ...
      new $EXPAT.Parser(...);
      ...
      $PARSER.parse("...");
  - pattern-not: |
      var $EXPAT = require('node-expat');
      ...
      new $EXPAT.Parser(...);
      ...
      $PARSER.write("...");
  - pattern-not: |
      require('node-expat');
      ...
      new Parser(...);
      ...
      $PARSER.parse("...");
  - pattern-not: |
      require('node-expat');
      ...
      new Parser(...);
      ...
      $PARSER.write("...");
  - pattern-not: |
      $X = "...";
      ...
      $PARSER.parse($X);
  - pattern-not: |-
      $X = "...";
      ...
      $PARSER.write($X);
- id: javascript.sax.security.audit.sax-xxe.sax-xxe
  message: |
    Use of 'ondoctype' in 'sax' library detected. By default, 'sax'
    won't do anything with custom DTD entity definitions. If you're
    implementing a custom DTD entity definition, be sure not to introduce
    XML External Entity (XXE) vulnerabilities, or be absolutely sure that
    external entities received from a trusted source while processing XML.
  metadata:
    owasp: 'A4: XML External Entities (XXE)'
    cwe: 'CWE-611: Improper Restriction of XML External Entity Reference'
    references:
    - https://github.com/Leonidas-from-XIV/node-xml2js/issues/415
    - https://github.com/isaacs/sax-js
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.sax.security.audit.sax-xxe.sax-xxe
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages: [javascript]
  pattern-either:
  - pattern: |
      require('sax');
      ...
      $PARSER.ondoctype = ...;
  - pattern: |-
      require('sax');
      ...
      $PARSER.on('doctype',...);
- id: javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe
  message: |
    If unverified user data can reach the XML Parser it can result in XML External or
    Internal Entity (XXE) Processing vulnerabilities
  metadata:
    owasp: 'A4: XML External Entities (XXE)'
    cwe: 'CWE-611: Improper Restriction of XML External Entity Reference'
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages: [javascript]
  patterns:
  - pattern: |
      var $XML = require('xml2json');
      ...
      $XML.toJson(...);
  - pattern-not: |
      var $XML = require('xml2json');
      ...
      $XML.toJson("...",...);
  - pattern-not: |-
      var $XML = require('xml2json');
      ...
      var $S = "...";
      ...
      $XML.toJson($S,...);
- id: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag
  patterns:
  - pattern-inside: |
      $UNK = $ANYFUNC(...);
      ...
      $OTHERFUNC(..., <... $UNK ...>, ...);
  - pattern: $OTHERFUNC(..., <... "=~/.*<script.*/" ...>, ...)
  message: |
    Cannot determine what '$UNK' is and it is used with a '<script>' tag. This
    could be susceptible to cross-site scripting (XSS). Ensure '$UNK' is not
    externally controlled, or sanitize this data.
  metadata:
    owasp: 'A7: Cross-site Scripting (XSS)'
    cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site\
      \ Scripting')"
    references:
    - https://www.developsec.com/2017/11/09/xss-in-a-script-tag/
    - https://github.com/bkimminich/juice-shop/blob/master/routes/videoHandler.js#L64
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - javascript
  - typescript
- id: javascript.express.security.audit.possible-user-input-redirect.unknown-value-in-redirect
  patterns:
  - pattern-either:
    - pattern-inside: |
        $UNK = query.$B;
        ...
    - pattern-inside: |
        $UNK = $A.query.$B;
        ...
    - pattern-inside: |
        $UNK = req.$SOMETHING;
        ...
  - pattern: $RES.redirect(..., <... $UNK ...>, ...)
  message: |
    It looks like '$UNK' is read from user input and it is used to as a redirect. Ensure
    '$UNK' is not externally controlled, otherwise this is an open redirect.
  metadata:
    owasp: 'A1: Injection'
    cwe: "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/javascript.express.security.audit.possible-user-input-redirect.unknown-value-in-redirect
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - javascript
- id: python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator
  patterns:
  - pattern-either:
    - pattern: |
        airflow.operators.bash_operator.BashOperator(..., bash_command="..." + $CONCAT, ...)
    - pattern: |
        airflow.operators.bash_operator.BashOperator(..., bash_command="...".format(...), ...)
    - pattern: |
        airflow.operators.bash_operator.BashOperator(..., bash_command=f"...", ...)
    - pattern: |
        airflow.operators.bash_operator.BashOperator(..., bash_command="..." % $PARAMS, ...)
    - pattern: |
        $CMD = "..." % $PARAMS
        ...
        airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...)
    - pattern: |
        $CMD = $STR.format(...)
        ...
        airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...)
    - pattern: |
        $CMD = f"..."
        ...
        airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...)
    - pattern: |
        $CMD = "..." + $CONCAT
        ...
        airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...)
    - pattern: |
        $CMD = "..."
        ...
        $CMD += $CONCAT
        ...
        airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...)
  message: |
    Found a formatted string in BashOperator: $CMD.
    This could be vulnerable to injection.
    Be extra sure your variables are not controllable by external sources.
  metadata:
    cwe: "CWE-78: Improper Neutralization of Special Elements used in an OS Command\
      \ ('OS Command Injection')"
    owasp: 'A1: Injection'
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator
    semgrep.ruleset: r2c-security-audit
  languages:
  - python
  severity: WARNING
- id: python.boto3.security.hardcoded-token.hardcoded-token
  message: |
    Hardcoded AWS access token detected. Use environment variables
    to access tokens (e.g., os.environ.get(...)) or use non version-controlled
    configuration files.
  metadata:
    cwe: 'CWE-798: Use of Hard-coded Credentials'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://pypi.org/project/flake8-boto3/
    references:
    - https://bento.dev/checks/boto3/hardcoded-access-token/
    - https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token
    semgrep.ruleset: r2c-security-audit
  patterns:
  - pattern-either:
    - pattern: $W(..., aws_secret_access_key="=~/^[A-Za-z0-9/+=]+$/", ...)
    - pattern: $W(..., aws_access_key_id="=~/^AKI/", ...)
    - pattern: $W(..., aws_session_token="...", ...)
  languages: [python]
  severity: WARNING
- id: python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-blowfish
  pattern: cryptography.hazmat.primitives.ciphers.algorithms.Blowfish(...)
  message: |
    Detected Blowfish cipher algorithm which is considered insecure. The algorithm has many
    known vulnerabilities. Use AES instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L96
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A3: Sensitive Data Exposure'
    bandit-code: B304
    references:
    - https://sweet32.info/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-blowfish
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - python
- id: python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea
  pattern: cryptography.hazmat.primitives.ciphers.algorithms.IDEA(...)
  message: |
    Detected IDEA cipher algorithm which is considered insecure. The algorithm is
    considered weak and has been deprecated. Use AES instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A3: Sensitive Data Exposure'
    bandit-code: B304
    references:
    - https://tools.ietf.org/html/rfc5469
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - python
- id: python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-rc4
  pattern: cryptography.hazmat.primitives.ciphers.algorithms.ARC4(...)
  message: |
    Detected RC4 cipher algorithm which is considered insecure. The algorithm has many
    known vulnerabilities. Use AES instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L94
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A3: Sensitive Data Exposure'
    bandit-code: B304
    references:
    - https://crypto.stackexchange.com/questions/853/google-is-using-rc4-but-isnt-rc4-considered-unsafe
    - https://sweet32.info/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-rc4
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - python
- id: python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb
  pattern: cryptography.hazmat.primitives.ciphers.modes.ECB(...)
  message: |
    Detected ECB cipher mode which is considered insecure. The algorithm can
    potentially leak information about the plaintext. Use CBC mode instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L101
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A3: Sensitive Data Exposure'
    bandit-code: B305
    references:
    - https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - python
- id: python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-md5
  pattern: cryptography.hazmat.primitives.hashes.MD5(...)
  message: |
    Detected MD5 hash algorithm which is considered insecure. MD5 is not
    collision resistant and is therefore not suitable as a cryptographic
    signature. Use SHA256 or SHA3 instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A3: Sensitive Data Exposure'
    bandit-code: B303
    references:
    - https://tools.ietf.org/html/rfc6151
    - https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision
    - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-md5
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - python
- id: python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1
  pattern: cryptography.hazmat.primitives.hashes.SHA1(...)
  message: |
    Detected SHA1 hash algorithm which is considered insecure. SHA1 is not
    collision resistant and is therefore not suitable as a cryptographic
    signature. Use SHA256 or SHA3 instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A3: Sensitive Data Exposure'
    bandit-code: B303
    references:
    - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html
    - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability
    - http://2012.sharcs.org/slides/stevens.pdf
    - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - python
- id: python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size
  patterns:
  - pattern-inside: cryptography.hazmat.primitives.asymmetric.ec.generate_private_key(...)
  - pattern-either:
    - pattern: cryptography.hazmat.primitives.asymmetric.ec.SECP192R1
    - pattern: cryptography.hazmat.primitives.asymmetric.ec.SECT163K1
    - pattern: cryptography.hazmat.primitives.asymmetric.ec.SECT163R2
  message: |
    Detected an insufficient curve size for EC. NIST recommends
    a key size of 224 or higher. For example, use 'ec.SECP256R1'.
  metadata:
    cwe: 'CWE-326: Inadequate Encryption Strength'
    owasp: 'A3: Sensitive Data Exposure'
    source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py
    references:
    - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf
    - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#elliptic-curves
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization
  metadata:
    owasp: 'A8: Insecure Deserialization'
    cwe: 'CWE-502: Deserialization of Untrusted Data'
    references: https://docs.python.org/3/library/pickle.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization
    semgrep.ruleset: r2c-security-audit
  message: Avoid using insecure deserialization library, backed by `pickle`, `_pickle`,
    `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code
    execution vulnerabilities.
  languages:
  - python
  severity: ERROR
  patterns:
  - pattern-inside: |
      def $X(..., request, ...):
        ...
  - pattern-either:
    - pattern: |
        $VAR = <... request.$Y.get(...) ...>
        ...
        pickle.$FUNC(<... $VAR ...>)
    - pattern: pickle.$FUNC(<... request.$Y.get(...) ...>)
    - pattern: |
        $VAR = <... request.$Y.get(...) ...>
        ...
        _pickle.$FUNC(<... $VAR ...>)
    - pattern: _pickle.$FUNC(<... request.$Y.get(...) ...>)
    - pattern: |
        $VAR = <... request.$Y.get(...) ...>
        ...
        cPickle.$FUNC(<... $VAR ...>)
    - pattern: cPickle.$FUNC(<... request.$Y.get(...) ...>)
    - pattern: |
        $VAR = <... request.$Y.get(...) ...>
        ...
        dill.$FUNC(<... $VAR ...>)
    - pattern: dill.$FUNC(<... request.$Y.get(...) ...>)
    - pattern: |
        $VAR = <... request.$Y.get(...) ...>
        ...
        shelve.$FUNC(<... $VAR ...>)
    - pattern: shelve.$FUNC(<... request.$Y.get(...) ...>)
    - pattern: |
        $VAR = <... request.$Y.get(...) ...>
        ...
        yaml.$FUNC(<... $VAR ...>)
    - pattern: yaml.$FUNC(<... request.$Y.get(...) ...>)
- id: python.django.security.audit.avoid-mark-safe.avoid-mark-safe
  patterns:
  - pattern-not-inside: django.utils.html.format_html(...)
  - pattern-not: django.utils.safestring.mark_safe("...")
  - pattern: django.utils.safestring.mark_safe(...)
  message: |
    'mark_safe()' is used to mark a string as "safe" for HTML output.
    This disables escaping and could therefore subject the content to
    XSS attacks. Use 'django.utils.html.format_html()' to build HTML
    for rendering instead.
  metadata:
    cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site\
      \ Scripting')"
    owasp: 'A7: Cross-Site Scripting (XSS)'
    references:
    - https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.safestring.mark_safe
    - https://docs.djangoproject.com/en/3.0/ref/utils/#django.utils.html.format_html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.security.audit.avoid-mark-safe.avoid-mark-safe
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.django.security.audit.csrf-exempt.no-csrf-exempt
  pattern: |
    @django.views.decorators.csrf.csrf_exempt
    def $R(...):
      ...
  message: There is rarely a good reason to use @csrf_exempt as is used for `$R`.
  metadata:
    cwe: 'CWE-352: Cross-Site Request Forgery (CSRF)'
    owasp: 'A6: Security Misconfiguration'
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.security.audit.csrf-exempt.no-csrf-exempt
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql
  languages:
  - python
  message: Detected a Custom Expression ''$EXPRESSION'' calling ''as_sql(...).'' Ensure
    no user input enters this function because it is susceptible to SQL injection.
    See https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.Func.as_sql
    for more information.
  metadata:
    cwe: "CWE-89: Improper Neutralization of Special Elements used in an SQL Command\
      \ ('SQL Injection')"
    owasp: 'A1: Injection'
    references:
    - https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.Func.as_sql
    - https://blog.r2c.dev/2020/preventing-sql-injection-a-django-authors-perspective/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql
    semgrep.ruleset: r2c-security-audit
  pattern: $EXPRESSION.as_sql(...)
  severity: WARNING
- id: python.django.security.audit.extends-custom-expression.extends-custom-expression
  languages:
  - python
  message: |
    Found extension of custom expression: $CLASS. Extending expressions
    in this way could inadvertently expose a SQL injection vulnerability.
    See https://docs.djangoproject.com/en/3.0/ref/models/expressions/#avoiding-sql-injection
    for more information.
  metadata:
    cwe: "CWE-89: Improper Neutralization of Special Elements used in an SQL Command\
      \ ('SQL Injection')"
    owasp: 'A1: Injection'
    references:
    - https://docs.djangoproject.com/en/3.0/ref/models/expressions/#avoiding-sql-injection
    - https://blog.r2c.dev/2020/preventing-sql-injection-a-django-authors-perspective/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.security.audit.extends-custom-expression.extends-custom-expression
    semgrep.ruleset: r2c-security-audit
  patterns:
  - pattern-either:
    - pattern: |
        class $CLASS(..., django.db.models.Func, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.expressions.Func, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.Expression, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.expressions.Expression, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.Value, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.expressions.Value, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.DurationValue, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.expressions.DurationValue, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.RawSQL, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.expressions.RawSQL, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.Star, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.expressions.Star, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.Random, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.expressions.Random, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.Col, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.expressions.Col, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.Ref, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.expressions.Ref, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.ExpressionList, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.expressions.ExpressionList, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.ExpressionWrapper, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.expressions.ExpressionWrapper, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.When, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.expressions.When, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.Case, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.expressions.Case, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.Subquery, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.expressions.Subquery, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.Exists, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.expressions.Exists, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.Window, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.expressions.Window, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.WindowFrame, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.expressions.WindowFrame, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.RowRange, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.expressions.RowRange, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.ValueRange, ...):
            ...
    - pattern: |
        class $CLASS(..., django.db.models.expressions.ValueRange, ...):
            ...
  severity: WARNING
- id: python.django.security.audit.query-set-extra.avoid-query-set-extra
  patterns:
  - pattern-either:
    - pattern: $X.objects.$FUNC(...).extra(...)
    - pattern: $X.objects.$FUNC(...).$FILTER(...).extra(...)
    - pattern: $X.objects.$FUNC(...).$FILTER(...).$UPDATE(...).extra(...)
  message: This is a last resort. You should be careful when using QuerySet.extra
    due to SQLi https://docs.djangoproject.com/en/3.0/ref/models/querysets/#django.db.models.query.QuerySet.extra
  metadata:
    cwe: "CWE-89: Improper Neutralization of Special Elements used in an SQL Command\
      \ ('SQL Injection')"
    owasp: 'A1: Injection'
    references:
    - https://docs.djangoproject.com/en/3.0/ref/models/querysets/#django.db.models.query.QuerySet.extra
    - https://blog.r2c.dev/2020/preventing-sql-injection-a-django-authors-perspective/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.security.audit.query-set-extra.avoid-query-set-extra
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: ERROR
- id: python.django.security.audit.raw-query.avoid-raw-sql
  patterns:
  - pattern-either:
    - pattern: $MODEL.objects.raw($QUERY, ...)
    - pattern: django.db.models.expressions.RawSQL(...)
  message: You should be very careful whenever you write raw SQL. Consider using Django
    ORM before raw SQL. See https://docs.djangoproject.com/en/3.0/topics/db/sql/#passing-parameters-into-raw
  metadata:
    cwe: "CWE-89: Improper Neutralization of Special Elements used in an SQL Command\
      \ ('SQL Injection')"
    owasp: 'A1: Injection'
    references:
    - https://docs.djangoproject.com/en/3.0/ref/models/expressions/#raw-sql-expressions
    - https://blog.r2c.dev/2020/preventing-sql-injection-a-django-authors-perspective/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.security.audit.raw-query.avoid-raw-sql
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: ERROR
- id: python.django.security.audit.secure-cookies.django-secure-set-cookie
  patterns:
  - pattern-either:
    - pattern-inside: |
        import django.http.HttpResponse
        ...
    - pattern-inside: |
        import django.shortcuts.render
        ...
      # Exclude vendored i18n code
  - pattern-not-inside: |
      LANGUAGE_QUERY_PARAMETER = 'language'
      ...
      def set_language(request):
          ...
      # Exclude vendored contrib/messages/storage/cookie.py
  - pattern-not-inside: |
      class CookieStorage(django.contrib.messages.storage.base.BaseStorage):
          ...
      # Exclude cookies handled by vendored middleware
  - pattern-not: response.set_cookie(django.conf.settings.SESSION_COOKIE_NAME, ...)
  - pattern-not: response.set_cookie(django.conf.settings.CSRF_COOKIE_NAME, ...)
  - pattern-not: response.set_cookie(django.conf.settings.LANGUAGE_COOKIE_NAME, ...)
  - pattern-not: response.set_cookie(rest_framework_jwt.settings.api_settings.JWT_AUTH_COOKIE,
      ...)
  - pattern-not: response.set_cookie(..., secure=$A, httponly=$B, samesite=$C, ...)
  - pattern-not: response.set_cookie(..., **$A)
  - pattern: response.set_cookie(...)
  message: |
    Django cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in
    response.set_cookie(...). If your situation calls for different settings, explicitly disable the setting.
    If you want to send the cookie over http, set secure=False.  If you want to let client-side JavaScript
    read the cookie, set httponly=False. If you want to attach cookies to requests for external sites,
    set samesite=None.
  metadata:
    cwe: "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"
    owasp: 'A3: Sensitive Data Exposure'
    references:
    - https://docs.djangoproject.com/en/3.0/ref/request-response/#django.http.HttpResponse.set_cookie
    - https://blog.r2c.dev/2020/bento-check-keeping-cookies-safe-in-flask/
    - https://bento.dev/checks/flask/secure-set-cookie/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.security.audit.secure-cookies.django-secure-set-cookie
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.django.security.audit.unvalidated-password.unvalidated-password
  patterns:
  - pattern-not-inside: |
      if <... django.contrib.auth.password_validation.validate_password(...) ...>:
          ...
  - pattern-not-inside: |
      django.contrib.auth.password_validation.validate_password(...)
      ...
  - pattern-not-inside: |
      try:
        ...
        django.contrib.auth.password_validation.validate_password(...)
        ...
      except $EX:
        ...
      ...
  - pattern-not-inside: |
      try:
        ...
        django.contrib.auth.password_validation.validate_password(...)
        ...
      except $EX as $E:
        ...
      ...
  - pattern-not: UserModel().set_password($X)
  - pattern: $MODEL.set_password($X)
  fix: |
    if django.contrib.auth.password_validation.validate_password($X, user=$MODEL):
        $MODEL.set_password($X)
  message: |
    The password on '$MODEL' is being set without validating the password.
    Call django.contrib.auth.password_validation.validate_password() with
    validation functions before setting the password. See
    https://docs.djangoproject.com/en/3.0/topics/auth/passwords/
    for more information.
  metadata:
    cwe: 'CWE-521: Weak Password Requirements'
    owasp: 'A2: Broken Authentication'
    references:
    - https://docs.djangoproject.com/en/3.0/topics/auth/passwords/#module-django.contrib.auth.password_validation
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.security.audit.unvalidated-password.unvalidated-password
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution
  message: |
    Found request data as an index to 'globals()'. This is extremely
    dangerous because it allows an attacker to execute arbirary code
    on the system. Refactor your code not to use 'globals()'.
  metadata:
    cwe: "CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static\
      \ Code Injection')"
    owasp: 'A1: Injection'
    references:
    - https://github.com/mpirnat/lets-be-bad-guys/blob/d92768fb3ade32956abd53bd6bb06e19d634a084/badguys/vulnerable/views.py#L181-L186
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
  patterns:
  - pattern-inside: |
      def $FUNC(...):
        ...
  - pattern-either:
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = globals().get($DATA, ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = globals().get("..." % $DATA, ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = globals().get(f"...{$DATA}...", ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = globals().get("...".format(..., $DATA, ...), ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = globals()[$DATA]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = globals()["..." % $DATA]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = globals()[f"...{$DATA}..."]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = globals()["...".format(..., $DATA, ...)]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = globals().get($DATA, ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = globals().get("..." % $DATA, ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = globals().get(f"...{$DATA}...", ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = globals().get("...".format(..., $DATA, ...), ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = globals()[$DATA]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = globals()["..." % $DATA]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = globals()[f"...{$DATA}..."]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = globals()["...".format(..., $DATA, ...)]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = globals().get($DATA, ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = globals().get("..." % $DATA, ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = globals().get(f"...{$DATA}...", ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = globals().get("...".format(..., $DATA, ...), ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = globals()[$DATA]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = globals()["..." % $DATA]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = globals()[f"...{$DATA}..."]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = globals()["...".format(..., $DATA, ...)]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = globals().get($DATA, ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = globals().get("..." % $DATA, ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = globals().get(f"...{$DATA}...", ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = globals().get("...".format(..., $DATA, ...), ...)
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = globals()[$DATA]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = globals()["..." % $DATA]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = globals()[f"...{$DATA}..."]
        ...
        $INTERM(...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = globals()["...".format(..., $DATA, ...)]
        ...
        $INTERM(...)
- id: python.django.security.injection.code.user-eval.user-eval
  message: |
    Found user data in a call to 'eval'. This is extremely dangerous because
    it can enable an attacker to execute remote code. See
    https://owasp.org/www-community/attacks/Code_Injection for more information
  metadata:
    cwe: "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code\
      \ ('Eval Injection')"
    owasp: 'A1: Injection'
    references:
    - https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.security.injection.code.user-eval.user-eval
    semgrep.ruleset: r2c-security-audit
  patterns:
  - pattern-inside: |
      def $F(...):
        ...
  - pattern-either:
    - pattern: eval(..., request.$W.get(...), ...)
    - pattern: |
        $V = request.$W.get(...)
        ...
        eval(..., $V, ...)
    - pattern: eval(..., request.$W(...), ...)
    - pattern: |
        $V = request.$W(...)
        ...
        eval(..., $V, ...)
    - pattern: eval(..., request.$W[...], ...)
    - pattern: |
        $V = request.$W[...]
        ...
        eval(..., $V, ...)
  languages: [python]
  severity: WARNING
- id: python.django.security.injection.code.user-exec.user-exec
  message: |
    Found user data in a call to 'exec'. This is extremely dangerous because
    it can enable an attacker to execute remote code. See
    https://owasp.org/www-community/attacks/Code_Injection for more information.
  metadata:
    cwe: "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code\
      \ ('Eval Injection')"
    owasp: 'A1: Injection'
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.security.injection.code.user-exec.user-exec
    semgrep.ruleset: r2c-security-audit
  patterns:
  - pattern-inside: |
      def $F(...):
        ...
  - pattern-either:
    - pattern: exec(..., request.$W.get(...), ...)
    - pattern: |
        $V = request.$W.get(...)
        ...
        exec(..., $V, ...)
    - pattern: exec(..., request.$W(...), ...)
    - pattern: |
        $V = request.$W(...)
        ...
        exec(..., $V, ...)
    - pattern: exec(..., request.$W[...], ...)
    - pattern: |
        $V = request.$W[...]
        ...
        exec(..., $V, ...)
  languages: [python]
  severity: WARNING
- id: python.django.security.injection.mass-assignment.mass-assignment
  languages: [python]
  severity: WARNING
  message: |
    Mass assignment detected. This can result in assignment to
    model fields that are unintended and can be exploited by
    an attacker. Instead of using '**request.$W', assign each field you
    want to edit individually to prevent mass assignment. You can read
    more about mass assignment at
    https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html.
  metadata:
    cwe: 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object
      Attributes'
    owasp: 'A1: Injection'
    owaspapi: 'API6: Mass Assignment'
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.security.injection.mass-assignment.mass-assignment
    semgrep.ruleset: r2c-security-audit
  patterns:
  - pattern-either:
    - pattern: $MODEL.objects.create(**request.$W)
    - pattern: |
        $OBJ.update(**request.$W)
        ...
        $OBJ.save()
- id: python.django.security.passwords.use-none-for-password-default.use-none-for-password-default
  message: |
    '$VAR' is using the empty string as its default and is being used to set
    the password on '$MODEL'. If you meant to set an unusable password, set
    the default value to 'None' or call 'set_unusable_password()'.
  metadata:
    cwe: 'CWE-521: Weak Password Requirements'
    owasp: 'A2: Broken Authentication'
    references:
    - https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default
    semgrep.ruleset: r2c-security-audit
  patterns:
  - pattern-either:
    - pattern: |
        $VAR = request.$W.get($X, "")
        ...
        $MODEL.set_password($VAR)
        ...
        $MODEL.save(...)
    - pattern: |
        def $F(..., $VAR="", ...):
          ...
          $MODEL.set_password($VAR)
  fix-regex:
    regex: (def.*|request.*)(""|'')
    replacement: \1None
  languages: [python]
  severity: ERROR
- id: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host
  patterns:
  - pattern-either:
    - pattern: app.run(..., host="0.0.0.0", ...)
    - pattern: app.run(..., "0.0.0.0", ...)
  message: Running flask app with host 0.0.0.0 could expose the server publicly.
  metadata:
    cwe: 'CWE-668: Exposure of Resource to Wrong Sphere'
    owasp: 'A6: Security Misconfiguration'
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly
  patterns:
  - pattern-not-inside: |
      if __name__ == '__main__':
        ...
  - pattern-not-inside: |
      def $X(...):
        ...
  - pattern: app.run(...)
  message: top-level app.run(...) is ignored by flask. Consider putting app.run(...)
    behind a guard, like inside a function
  metadata:
    cwe: 'CWE-668: Exposure of Resource to Wrong Sphere'
    owasp: 'A6: Security Misconfiguration'
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.flask.security.audit.debug-enabled.debug-enabled
  patterns:
  - pattern-inside: |
      import flask
      ...
  - pattern: $APP.run(..., debug=True, ...)
  message: |
    Detected Flask app with debug=True. Do not deploy to production with this flag enabled
    as it will leak sensitive information. Instead, consider using Flask configuration
    variables or setting 'debug' using system environment variables.
  metadata:
    cwe: 'CWE-489: Active Debug Code'
    owasp: 'A6: Security Misconfiguration'
    references:
    - https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - python
- id: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG
  pattern-either:
  - pattern: $M.update(DEBUG=True)
  - pattern: $M.update(DEBUG=False)
  - pattern: $M.config['DEBUG'] = True
  - pattern: $M.config['DEBUG'] = False
  message: Hardcoded variable `DEBUG` detected. Set this by using FLASK_DEBUG environment
    variable
  metadata:
    cwe: 'CWE-489: Active Debug Code'
    owasp: 'A6: Security Misconfiguration'
    references:
    - https://bento.dev/checks/flask/avoid-hardcoded-config/
    - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values
    - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV
  pattern-either:
  - pattern: $M.update(ENV="=~/^development|production$/")
  - pattern: $M.config['ENV'] = "=~/^development|production$/"
  message: Hardcoded variable `ENV` detected. Set this by using FLASK_ENV environment
    variable
  metadata:
    cwe: 'CWE-489: Active Debug Code'
    owasp: 'A6: Security Misconfiguration'
    references:
    - https://bento.dev/checks/flask/avoid-hardcoded-config/
    - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values
    - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY
  pattern-either:
  - pattern: $M.update(SECRET_KEY="=~/.*/")
  - pattern: $M.config['SECRET_KEY'] = "=~/.*/"
  message: Hardcoded variable `SECRET_KEY` detected. Use environment variables or
    config files instead
  metadata:
    cwe: 'CWE-798: Use of Hard-coded Credentials'
    owasp: 'A2: Broken Authentication'
    references:
    - https://bento.dev/checks/flask/avoid-hardcoded-config/
    - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values
    - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: ERROR
- id: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING
  pattern-either:
  - pattern: $M.config['TESTING'] = True
  - pattern: $M.config['TESTING'] = False
  - pattern: $M.update(TESTING=True, ...)
  - pattern: $M.update(TESTING=False, ...)
  message: Hardcoded variable `TESTING` detected. Use environment variables or config
    files instead
  metadata:
    cwe: 'CWE-489: Active Debug Code'
    owasp: 'A6: Security Misconfiguration'
    references:
    - https://bento.dev/checks/flask/avoid-hardcoded-config/
    - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values
    - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.flask.security.audit.render-template-string.render-template-string
  pattern: flask.render_template_string(...)
  metadata:
    cwe: "CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static\
      \ Code Injection')"
    owasp: 'A1: Injection'
    references:
    - https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.flask.security.audit.render-template-string.render-template-string
    semgrep.ruleset: r2c-security-audit
  message: Found a template created with string formatting. This is susceptible to
    server-side template injection and cross-site scripting attacks.
  languages: [python]
  severity: WARNING
- id: python.flask.security.audit.secure-set-cookie.secure-set-cookie
  patterns:
  - pattern-either:
    - pattern-inside: |
        $RESP = flask.make_response(...)
        ...
    - pattern-inside: |
        $RESP = flask.Response(...)
        ...
  - pattern-not: $RESPONSE.set_cookie(..., secure=$A, httponly=$B, samesite=$C, ...)
  - pattern-not: $RESPONSE.set_cookie(..., **$A)
  - pattern: $RESPONSE.set_cookie(...)
  message: |
    Flask cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in
    response.set_cookie(...). If your situation calls for different settings, explicitly disable the setting.
    If you want to send the cookie over http, set secure=False.  If you want to let client-side JavaScript
    read the cookie, set httponly=False. If you want to attach cookies to requests for external sites,
    set samesite=None.
  metadata:
    cwe: "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"
    owasp: 'A3: Sensitive Data Exposure'
    references:
    - https://blog.r2c.dev/2020/bento-check-keeping-cookies-safe-in-flask/
    - https://bento.dev/checks/flask/secure-set-cookie/
    - https://flask.palletsprojects.com/en/1.1.x/security/#set-cookie-options
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.flask.security.audit.secure-set-cookie.secure-set-cookie
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled
  patterns:
  - pattern: |
      $APP.config['WTF_CSRF_ENABLED'] = False
  message: |
    `$APP.config['WTF_CSRF_ENABLED'] = False` is probably not what you want in production because it disables https://flask-wtf.readthedocs.io/en/stable/csrf.html CSRF protection
  metadata:
    cwe: 'CWE-352: Cross-Site Request Forgery (CSRF)'
    owasp: 'A6: Security Misconfiguration'
    references:
    - https://flask-wtf.readthedocs.io/en/stable/csrf.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - python
- id: python.flask.security.dangerous-template-string.dangerous-template-string
  patterns:
  - pattern-either:
    - pattern: |
        $V = "...".format(...)
        ...
        flask.render_template_string($V, ...)
    - pattern: |
        $V = "...".format(...)
        ...
        return flask.render_template_string($V, ...), $MORE
    - pattern: |
        $V = "..." % $S
        ...
        flask.render_template_string($V, ...)
    - pattern: |
        $V = "..." % $S
        ...
        return flask.render_template_string($V, ...), $MORE
    - pattern: |
        $V = "..."
        ...
        $V += $O
        ...
        flask.render_template_string($V, ...)
    - pattern: |
        $V = "..."
        ...
        $V += $O
        ...
        return flask.render_template_string($V, ...), $MORE
    - pattern: |
        $V = f"...{$X}..."
        ...
        flask.render_template_string($V, ...)
    - pattern: |
        $V = f"...{$X}..."
        ...
        return flask.render_template_string($V, ...), $CODE
  message: |
    Found a template created with string formatting.
    This is susceptible to server-side template injection
    and cross-site scripting attacks.
  metadata:
    cwe: "CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static\
      \ Code Injection')"
    owasp: 'A1: Injection'
    references:
    - https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html
    - https://pequalsnp-team.github.io/cheatsheet/flask-jinja2-ssti
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.flask.security.dangerous-template-string.dangerous-template-string
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: ERROR
- id: python.flask.security.injection.user-eval.eval-injection
  languages:
  - python
  severity: ERROR
  message: Detected user data flowing into eval. This is code injection and should
    be avoided.
  metadata:
    cwe: "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code\
      \ ('Eval Injection')"
    owasp: 'A1: Injection'
    references:
    - https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.flask.security.injection.user-eval.eval-injection
    semgrep.ruleset: r2c-security-audit
  patterns:
  - pattern-either:
    - patterns:
      - pattern-inside: |
          @$APP.route($ROUTE, ...)
          def $FUNC(..., $ROUTEVAR, ...):
            ...
      - pattern-either:
        - pattern: eval(..., <... $ROUTEVAR ...>, ...)
        - pattern: |
            $INTERM = <... $ROUTEVAR ...>
            ...
            eval(..., <... $INTERM ...>, ...)
    - patterns:
      - pattern-either:
        - pattern: eval(..., <... flask.request.$W.get(...) ...>, ...)
        - pattern: eval(..., <... flask.request.$W[...] ...>, ...)
        - pattern: eval(..., <... flask.request.$W(...) ...>, ...)
        - pattern: eval(..., <... flask.request.$W ...>, ...)
    - patterns:
      - pattern-either:
        - patterns:
          - pattern-inside: |
              $INTERM = <... flask.request.$W.get(...) ...>
              ...
          - pattern: eval(..., <... $INTERM ...>, ...)
        - patterns:
          - pattern-inside: |
              $INTERM = <... flask.request.$W[...] ...>
              ...
          - pattern: eval(..., <... $INTERM ...>, ...)
        - patterns:
          - pattern-inside: |
              $INTERM = <... flask.request.$W(...) ...>
              ...
          - pattern: eval(..., <... $INTERM ...>, ...)
        - patterns:
          - pattern-inside: |
              $INTERM = <... flask.request.$W ...>
              ...
          - pattern: eval(..., <... $INTERM ...>, ...)
- id: python.flask.security.injection.user-exec.exec-injection
  languages:
  - python
  severity: ERROR
  message: |
    Found user data in a call to 'exec'. This is extremely dangerous because
    it can enable an attacker to execute remote code.
  metadata:
    cwe: "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code\
      \ ('Eval Injection')"
    owasp: 'A1: Injection'
    references:
    - https://owasp.org/www-community/attacks/Code_Injection
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.flask.security.injection.user-exec.exec-injection
    semgrep.ruleset: r2c-security-audit
  patterns:
  - pattern-either:
    - patterns:
      - pattern-inside: |
          @$APP.route($ROUTE, ...)
          def $FUNC(..., $ROUTEVAR, ...):
            ...
      - pattern-either:
        - pattern: exec(..., <... $ROUTEVAR ...>, ...)
        - pattern: |
            $INTERM = <... $ROUTEVAR ...>
            ...
            exec(..., <... $INTERM ...>, ...)
    - patterns:
      - pattern-either:
        - pattern: exec(..., <... flask.request.$W.get(...) ...>, ...)
        - pattern: exec(..., <... flask.request.$W[...] ...>, ...)
        - pattern: exec(..., <... flask.request.$W(...) ...>, ...)
        - pattern: exec(..., <... flask.request.$W ...>, ...)
    - patterns:
      - pattern-either:
        - patterns:
          - pattern-inside: |
              $INTERM = <... flask.request.$W.get(...) ...>
              ...
          - pattern: exec(..., <... $INTERM ...>, ...)
        - patterns:
          - pattern-inside: |
              $INTERM = <... flask.request.$W[...] ...>
              ...
          - pattern: exec(..., <... $INTERM ...>, ...)
        - patterns:
          - pattern-inside: |
              $INTERM = <... flask.request.$W(...) ...>
              ...
          - pattern: exec(..., <... $INTERM ...>, ...)
        - patterns:
          - pattern-inside: |
              $INTERM = <... flask.request.$W ...>
              ...
          - pattern: exec(..., <... $INTERM ...>, ...)
- id: python.flask.security.insecure-deserialization.insecure-deserialization
  metadata:
    owasp: 'A8: Insecure Deserialization'
    cwe: 'CWE-502: Deserialization of Untrusted Data'
    references:
    - https://docs.python.org/3/library/pickle.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.flask.security.insecure-deserialization.insecure-deserialization
    semgrep.ruleset: r2c-security-audit
  message: |
    Detected the use of an insecure deserizliation library in a Flask route. These libraries
    are prone to code execution vulnerabilities. Ensure user data does not enter this function.
    To fix this, try to avoid serializing whole objects. Consider instead using a serializer
    such as JSON.
  languages:
  - python
  severity: ERROR
  patterns:
  - pattern-inside: |
      @app.route(...)
      def $X(...):
        ...
  - pattern-not: $MODULE.$FUNC("...")
  - pattern-not: $MODULE.$FUNC(open("...", ...))
  - pattern-either:
    - pattern: pickle.$FUNC(...)
    - pattern: _pickle.$FUNC(...)
    - pattern: cPickle.$FUNC(...)
    - pattern: dill.$FUNC(...)
    - pattern: shelve.$FUNC(...)
    - pattern: yaml.load(...)
- id: python.flask.security.open-redirect.open-redirect
  patterns:
  - pattern-inside: |
      @$APP.route(...)
      def $X():
        ...
  - pattern-not-inside: |
      ...
      if <... werkzeug.urls.url_parse($V) ...>:
        ...
  - pattern-either:
    - pattern: flask.redirect(<... flask.request.$W.get(...) ...>, ...)
    - pattern: flask.redirect(<... flask.request.$W[...] ...>, ...)
    - pattern: flask.redirect(<... flask.request.$W(...) ...>, ...)
    - pattern: flask.redirect(<... flask.request.$W ...>, ...)
    - pattern: |
        $V = flask.request.$W.get(...)
        ...
        flask.redirect(<... $V ...>, ...)
    - pattern: |
        $V = flask.request.$W[...]
        ...
        flask.redirect(<... $V ...>, ...)
    - pattern: |
        $V = flask.request.$W(...)
        ...
        flask.redirect(<... $V ...>, ...)
    - pattern: |
        $V = flask.request.$W
        ...
        flask.redirect(<... $V ...>, ...)
  message: |
    Data from request is passed to redirect().
    This is an open redirect and could be exploited.
    Consider using 'url_for()' to generate links to known locations.
    If you must use a URL to unknown pages, consider using 'urlparse()'
    or similar and checking if the 'netloc' property is the same as
    your site's host name. See the references for more information.
  metadata:
    cwe: "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"
    owasp: 'A1: Injection'
    references:
    - https://flask-login.readthedocs.io/en/latest/#login-example
    - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html#dangerous-url-redirect-example-1
    - https://docs.python.org/3/library/urllib.parse.html#url-parsing
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.flask.security.open-redirect.open-redirect
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: ERROR
- id: python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization
  patterns:
  - pattern-inside: |
      @app.route(...)
      def $X(filename):
        ...
  - pattern-either:
    - pattern: flask.send_file(filename, ...)
  message: Looks like `filename` could flow to `flask.send_file()` function. Make
    sure to properly sanitize filename or use `flask.send_from_directory`
  metadata:
    cwe: 'CWE-73: External Control of File Name or Path'
    owasp: 'A1: Injection'
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.flask.security.unescaped-template-extension.unescaped-template-extension
  message: |
    Flask does not automatically escape Jinja templates unless they have
    .html, .htm, .xml, or .xhtml extensions. This could lead to XSS attacks.
    Use .html, .htm, .xml, or .xhtml for your template extensions.
    See https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup
    for more information.
  metadata:
    cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site\
      \ Scripting')"
    owasp: 'A7: Cross-Site Scripting (XSS)'
    source-rule-url: https://pypi.org/project/flake8-flask/
    references:
    - https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup
    - https://blog.r2c.dev/2020/bento-check-unescaped-template-extensions-in-flask/
    - https://bento.dev/checks/flask/unescaped-file-extension/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.flask.security.unescaped-template-extension.unescaped-template-extension
    semgrep.ruleset: r2c-security-audit
  patterns:
  - pattern-not: flask.render_template("=~/.+\.html$/", ...)
  - pattern-not: flask.render_template("=~/.+\.xml$/", ...)
  - pattern-not: flask.render_template("=~/.+\.htm$/", ...)
  - pattern-not: flask.render_template("=~/.+\.xhtml$/", ...)
  - pattern-not: flask.render_template($X + "=~/\.html$/", ...)
  - pattern-not: flask.render_template($X + "=~/\.xml$/", ...)
  - pattern-not: flask.render_template($X + "=~/\.htm$/", ...)
  - pattern-not: flask.render_template($X + "=~/\.xhtml$/", ...)
  - pattern-not: flask.render_template("=~/.+\.html$/" % $X, ...)
  - pattern-not: flask.render_template("=~/.+\.xml$/" % $X, ...)
  - pattern-not: flask.render_template("=~/.+\.htm$/" % $X, ...)
  - pattern-not: flask.render_template("=~/.+\.xhtml$/" % $X, ...)
  - pattern-not: flask.render_template("=~/.+\.html$/".format(...), ...)
  - pattern-not: flask.render_template("=~/.+\.xml$/".format(...), ...)
  - pattern-not: flask.render_template("=~/.+\.htm$/".format(...), ...)
  - pattern-not: flask.render_template("=~/.+\.xhtml$/".format(...), ...)
  - pattern-not: flask.render_template($TEMPLATE)
  - pattern-either:
    - pattern: flask.render_template("...", ...)
    - pattern: flask.render_template($X + "...", ...)
    - pattern: flask.render_template("..." % $Y, ...)
    - pattern: flask.render_template("...".format(...), ...)
  languages: [python]
  severity: WARNING
- id: python.flask.security.unsanitized-input.response-contains-unsanitized-input
  patterns:
  - pattern-either:
    - pattern: |
        $X = flask.request.args.get(...)
        ...
        flask.make_response("...".format($X))
    - pattern: |
        $X = flask.request.args.get(...)
        ...
        flask.make_response(f"...{$X}...")
    - pattern: |
        $X = flask.request.args.get(...)
        ...
        flask.make_response(f"...{$X}")
    - pattern: |
        $X = flask.request.args.get(...)
        ...
        flask.make_response(f"{$X}...")
  message: |
    Flask response reflects unsanitized user input. This could lead to a
    cross-site scripting vulnerability (https://owasp.org/www-community/attacks/xss/)
    in which an attacker causes arbitrary code to be executed in the user's browser.
    To prevent, please sanitize the user input, e.g. by rendering the response
    in a Jinja2 template (see considerations in https://flask.palletsprojects.com/en/1.0.x/security/).
  metadata:
    cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site\
      \ Scripting')"
    owasp: 'A7: Cross-Site Scripting (XSS)'
    references:
    - https://flask.palletsprojects.com/en/1.0.x/security/
    - https://owasp.org/www-community/attacks/xss/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.flask.security.unsanitized-input.response-contains-unsanitized-input
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.jinja2.security.audit.autoescape-disabled.autoescape-disabled
  patterns:
  - pattern-not: jinja2.Environment(..., autoescape=True, ...)
  - pattern-not: jinja2.Environment(..., autoescape=jinja2.select_autoescape(...),
      ...)
  - pattern: jinja2.Environment(...)
  fix-regex:
    regex: (.*)\)
    replacement: \1, autoescape=True)
  message: >-
    Detected a Jinja2 environment without autoescaping. Jinja2 does not autoescape
    by default.
    This is dangerous if you are rendering to a browser because this allows for cross-site
    scripting (XSS) attacks. If you are in a web context, enable autoescaping by setting
    'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to
    only enable
    automatic escaping for certain file extensions.
  metadata:
    cwe: 'CWE-116: Improper Encoding or Escaping of Output'
    owasp: 'A6: Security Misconfiguration'
    references:
    - https://jinja.palletsprojects.com/en/2.11.x/api/#basics
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.jinja2.security.audit.autoescape-disabled.autoescape-disabled
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.lang.security.audit.conn_recv.multiprocessing-recv
  languages:
  - python
  message: 'The Connection.recv() method automatically unpickles the data it receives,
    which can be a security risk unless you can trust the process which sent the message.
    Therefore, unless the connection object was produced using Pipe() you should only
    use the recv() and send() methods after performing some sort of authentication.
    See more dettails: https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection'
  metadata:
    cwe: 'CWE-502: Deserialization of Untrusted Data'
    owasp: 'A8: Insecure Deserialization'
    references:
    - https://docs.python.org/3/library/multiprocessing.html?highlight=security#multiprocessing.connection.Connection
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.audit.conn_recv.multiprocessing-recv
    semgrep.ruleset: r2c-security-audit
  pattern-either:
  - pattern: multiprocessing.connection.Connection.recv(...)
  - pattern: multiprocessing.connection.Client.recv(...)
  - pattern: |
      $C = multiprocessing.connection.Client(...)
      ...
      $C.recv(...)
  severity: WARNING
- id: python.lang.security.audit.dangerous-spawn-process.dangerous-spawn-process
  patterns:
  - pattern-either:
    - patterns:
      - pattern-not: os.$W("...", ...)
      - pattern-either:
        - pattern: os.execl(...)
        - pattern: os.execle(...)
        - pattern: os.execlp(...)
        - pattern: os.execlpe(...)
        - pattern: os.execv(...)
        - pattern: os.execve(...)
        - pattern: os.execvp(...)
        - pattern: os.execvpe(...)
        - pattern: os.startfile(...)
    - patterns:
      - pattern-not: os.$W($MODE, "...", ...)
      - pattern-either:
        - pattern: os.spawnl(...)
        - pattern: os.spawnle(...)
        - pattern: os.spawnlp(...)
        - pattern: os.spawnlpe(...)
        - pattern: os.spawnv(...)
        - pattern: os.spawnve(...)
        - pattern: os.spawnvp(...)
        - pattern: os.spawnvpe(...)
  message: |
    Found dynamic content when spawning a process. This is dangerous if external
    data can reach this function call because it allows a malicious actor to
    execute commands. Ensure no external data reaches here.
  metadata:
    cwe: "CWE-78: Improper Neutralization of Special Elements used in an OS Command\
      \ ('OS Command Injection')"
    owasp: 'A1: Injection'
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.audit.dangerous-spawn-process.dangerous-spawn-process
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.lang.security.audit.dangerous-system-call.dangerous-system-call
  patterns:
  - pattern-not: os.$W("...", ...)
  - pattern-either:
    - pattern: os.system(...)
    - pattern: os.popen(...)
    - pattern: os.popen2(...)
    - pattern: os.popen3(...)
    - pattern: os.popen4(...)
  message: >-
    Found dynamic content used in a system call. This is dangerous if external
    data can reach this function call because it allows a malicious actor to
    execute commands. Use the 'subprocess' module instead, which is easier
    to use without accidentally exposing a command injection vulnerability.
  metadata:
    cwe: "CWE-78: Improper Neutralization of Special Elements used in an OS Command\
      \ ('OS Command Injection')"
    owasp: 'A1: Injection'
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.audit.dangerous-system-call.dangerous-system-call
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected
  patterns:
  - pattern-not: urllib.$W("...")
  - pattern-not: urllib.request.$W("...")
  - pattern-not: $OPENER.$W("...")
  - pattern-either:
    - patterns:
      - pattern-either:
        - pattern: urllib.urlopen(...)
        - pattern: urllib.request.urlopen(...)
        - pattern: urllib.urlretrieve(...)
        - pattern: urllib.request.urlretrieve(...)
    - patterns:
      - pattern-either:
        - pattern-inside: |
            $OPENER = urllib.URLopener(...)
            ...
        - pattern-inside: |
            $OPENER = urllib.request.URLopener(...)
            ...
        - pattern-inside: |
            $OPENER = urllib.FancyURLopener(...)
            ...
        - pattern-inside: |
            $OPENER = urllib.request.FancyURLopener(...)
            ...
      - pattern-either:
        - pattern: $OPENER.open(...)
        - pattern: $OPENER.retrieve(...)
  message: >-
    Detected a dynamic value being used with urllib. urllib supports 'file://' schemes,
    so a dynamic value controlled by a malicious actor may allow them to read arbitrary
    files.
    Audit uses of urllib calls to ensure user data cannot control the URLs, or consider
    using the 'requests' library instead.
  metadata:
    cwe: 'CWE-939: Improper Authorization in Handler for Custom URL Scheme'
    owasp: 'A1: Injection'
    source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/blacklists/calls.py#L163
    bandit-code: B310
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.lang.security.audit.eval-detected.eval-detected
  patterns:
  - pattern-not: eval("...")
  - pattern: eval(...)
  message: |
    Detected the use of eval(). eval() can be dangerous if used to evaluate
    dynamic content. If this content can be input from outside the program, this
    may be a code injection vulnerability. Ensure evaluated content is not definable
    by external sources.
  metadata:
    cwe: "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code\
      \ ('Eval Injection')"
    owasp: 'A1: Injection'
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.audit.eval-detected.eval-detected
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.lang.security.audit.exec-detected.exec-detected
  patterns:
  - pattern-not: exec("...")
  - pattern: exec(...)
  message: |
    Detected the use of exec(). exec() can be dangerous if used to evaluate
    dynamic content. If this content can be input from outside the program, this
    may be a code injection vulnerability. Ensure evaluated content is not definable
    by external sources.
  metadata:
    cwe: "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code\
      \ ('Eval Injection')"
    owasp: 'A1: Injection'
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.audit.exec-detected.exec-detected
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.lang.security.audit.ftplib.ftplib
  pattern: ftplib.$ANYTHING(...)
  message: |
    FTP does not encrypt communications by default. This can lead to sensitive
    data being exposed. Ensure use of FTP here does not expose sensitive data.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L265
    cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp: 'A3: Sensitive Data Exposure'
    bandit-code: B321
    references:
    - https://docs.python.org/3/library/telnetlib.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.audit.ftplib.ftplib
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - python
- id: python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument
  patterns:
  - pattern: |
      def $FUNC(..., password="...", ...):
        ...
  message: |
    Hardcoded password is used as a default argument to '$FUNC'. This could be dangerous if
    a real password is not supplied.
  languages: [python]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument
    semgrep.ruleset: r2c-security-audit
- id: python.lang.security.audit.httpsconnection-detected.httpsconnection-detected
  patterns:
  - pattern-either:
    - pattern: httplib.HTTPSConnection(...)
    - pattern: http.client.HTTPSConnection(...)
    - pattern: six.moves.http_client.HTTPSConnection(...)
  message: |
    The HTTPSConnection API has changed frequently with minor releases of Python.
    Ensure you are using the API for your version of Python securely.
    For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default.
    See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection
    for more information.
  metadata:
    owasp: 'A6: Security Misconfiguration'
    cwe: 'CWE-295: Improper Certificate Validation'
    references:
    - https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.audit.httpsconnection-detected.httpsconnection-detected
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - python
- id: python.lang.security.audit.logging.listeneval.listen-eval
  languages:
  - python
  message: |
    Because portions of the logging configuration are passed through eval(),
    use of this function may open its users to a security risk. While the
    function only binds to a socket on localhost, and so does not accept
    connections from remote machines, there are scenarios where untrusted
    code could be run under the account of the process which calls listen().
    See more details at https://docs.python.org/3/library/logging.config.html?highlight=security#logging.config.listen
  metadata:
    cwe: "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code\
      \ ('Eval Injection')"
    owasp: 'A6: Security Misconfiguration'
    references:
    - https://docs.python.org/3/library/logging.config.html?highlight=security#logging.config.listen
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.audit.logging.listeneval.listen-eval
    semgrep.ruleset: r2c-security-audit
  patterns:
  - pattern: logging.config.listen(...)
  severity: WARNING
- id: python.lang.security.audit.mako-templates-detected.mako-templates-detected
  pattern: mako.template.Template(...)
  message: |
    Mako templates do not provide a global HTML escaping mechanism.
    This means you must escape all sensitive data in your templates
    using '| u' for URL escaping or '| h' for HTML escaping.
    If you are using Mako to serve web content, consider using
    a system such as Jinja2 which enables global escaping.
  metadata:
    cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site\
      \ Scripting')"
    owasp: 'A7: Cross-Site Scripting (XSS)'
    source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/mako_templates.py
    references:
    - https://docs.makotemplates.org/en/latest/syntax.html#expression-escaping
    - https://jinja.palletsprojects.com/en/2.11.x/intro/#
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.audit.mako-templates-detected.mako-templates-detected
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: INFO
- id: python.lang.security.audit.marshal.marshal-usage
  languages:
  - python
  message: |
    The marshal module is not intended to be secure against erroneous or maliciously constructed data.
    Never unmarshal data received from an untrusted or unauthenticated source.
    See more details: https://docs.python.org/3/library/marshal.html?highlight=security
  metadata:
    cwe: 'CWE-502: Deserialization of Untrusted Data'
    owasp: 'A8: Insecure Deserialization'
    references:
    - https://docs.python.org/3/library/marshal.html?highlight=security
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.audit.marshal.marshal-usage
    semgrep.ruleset: r2c-security-audit
  pattern-either:
  - pattern: marshal.dump(...)
  - pattern: marshal.dumps(...)
  - pattern: marshal.load(...)
  - pattern: marshal.loads(...)
  severity: WARNING
- id: python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces
  patterns:
  - pattern-either:
    - pattern: |
        $S = socket.socket(...)
        ...
        $S.bind(("0.0.0.0", ...))
    - pattern: |
        $S = socket.socket(...)
        ...
        $S.bind(("::", ...))
    - pattern: |
        $S = socket.socket(...)
        ...
        $S.bind(("", ...))
  message: |
    Running `socket.bind` to 0.0.0.0, ::, or empty string could unexpectedly
    expose the server publicly as it binds to all available interfaces. Consider
    instead getting correct address from an environment variable or
    configuration file.
  metadata:
    cwe: 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
    owasp: 'A6: Security Misconfiguration'
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: INFO
- id: python.lang.security.audit.network.http-not-https-connection.http-not-https-connection
  patterns:
  - pattern-either:
    - pattern: urllib3.HTTPConnectionPool(...)
    - pattern: urllib3.connectionpool.HTTPConnectionPool(...)
  message: |
    Detected HTTPConnectionPool. This will transmit data in cleartext.
    It is recommended to use HTTPSConnectionPool instead for to encrypt
    communications.
  metadata:
    cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp: 'A3: Sensitive Data Exposure'
    references:
    - https://urllib3.readthedocs.io/en/1.2.1/pools.html#urllib3.connectionpool.HTTPSConnectionPool
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: ERROR
- id: python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key
  patterns:
  - pattern-inside: |
      $CLIENT = paramiko.client.SSHClient(...)
      ...
      $CLIENT.set_missing_host_key_policy(...)
  - pattern-either:
    - pattern: paramiko.client.AutoAddPolicy
    - pattern: paramiko.client.WarningPolicy
  message: |
    Detected a paramiko host key policy that implicitly trusts a server's
    host key. Host keys should be verified to ensure the connection
    is not to a malicious server. Use RejectPolicy or a custom subclass
    instead.
  metadata:
    cwe: 'CWE-322: Key Exchange without Entity Authentication'
    owasp: 'A3: Sensitive Data Exposure'
    source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/ssh_no_host_key_verification.py
    references:
    - http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.AutoAddPolicy
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command
  patterns:
  - pattern-inside: |
      import paramiko
      ...
  - pattern: $CLIENT.exec_command(...)
  message: |
    Unverified SSL context detected. This will permit insecure connections without verifying
    SSL certificates. Use 'ssl.create_default_context()' instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/plugins/injection_paramiko.py
    owasp: 'A1: Injection'
    cwe: "CWE-78: Improper Neutralization of Special Elements used in an OS Command\
      \ ('OS Command Injection')"
    references:
    - http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.SSHClient.exec_command
    - https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/plugins/injection_paramiko.py
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.audit.paramiko.paramiko-exec-command.paramiko-exec-command
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - python
- id: python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated
  pattern: ssl.wrap_socket(...)
  message: |
    'ssl.wrap_socket()' is deprecated. This function creates an insecure socket
    without server name indication or hostname matching. Instead, create an SSL
    context using 'ssl.SSLContext()' and use that to wrap a socket.
  metadata:
    cwe: 'CWE-326: Inadequate Encryption Strength'
    owasp: 'A3: Sensitive Data Exposure'
    references:
    - https://docs.python.org/3/library/ssl.html#ssl.wrap_socket
    - https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true
  pattern: subprocess.$FUNC(..., shell=True, ...)
  message: |
    Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn
    the command using a shell process. Doing so propagates current shell settings and variables, which
    makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.
  fix-regex:
    regex: (shell\s*=\s*)True
    replacement: \1False
  metadata:
    owasp: 'A1: Injection'
    cwe: "CWE-78: Improper Neutralization of Special Elements used in an OS Command\
      \ ('OS Command Injection')"
    references:
    - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess
    - https://docs.python.org/3/library/subprocess.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: ERROR
- id: python.lang.security.audit.system-wildcard-detected.system-wildcard-detected
  patterns:
  - pattern-either:
    - pattern-inside: os.system("...")
    - pattern-inside: os.popen("...")
    - pattern-inside: os.popen2("...")
    - pattern-inside: os.popen3("...")
    - pattern-inside: os.popen4("...")
    - pattern-inside: subprocess.$W(..., shell=True, ...)
  - pattern-regex: (tar|chmod|chown|rsync)(.*?)\*
  message: |
    Detected use of the wildcard character in a system call that spawns a shell.
    This subjects the wildcard to normal shell expansion, which can have unintended consequences
    if there exist any non-standard file names. Consider a file named '-e sh script.sh' -- this
    will execute a script when 'rsync' is called. See
    https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt
    for more information.
  metadata:
    cwe: 'CWE-155: Improper Neutralization of Wildcards or Matching Symbols'
    owasp: 'A1: Injection'
    source-url-open: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/injection_wildcard.py
    references:
    - https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.audit.system-wildcard-detected.system-wildcard-detected
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.lang.security.audit.telnetlib.telnetlib
  pattern: telnetlib.$ANYTHING(...)
  message: |
    Telnet does not encrypt communications. Use SSH instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L208
    cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp: 'A3: Sensitive Data Exposure'
    bandit-code: B312
    references:
    - https://docs.python.org/3/library/telnetlib.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.audit.telnetlib.telnetlib
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - python
- id: python.lang.security.audit.weak-ssl-version.weak-ssl-version
  patterns:
  - pattern-either:
    - pattern: ssl.PROTOCOL_SSLv2
    - pattern: ssl.PROTOCOL_SSLv3
    - pattern: ssl.PROTOCOL_TLSv1
    - pattern: ssl.PROTOCOL_TLSv1_1
    - pattern: pyOpenSSL.SSL.SSLv2_METHOD
    - pattern: pyOpenSSL.SSL.SSLv23_METHOD
    - pattern: pyOpenSSL.SSL.SSLv3_METHOD
    - pattern: pyOpenSSL.SSL.TLSv1_METHOD
    - pattern: pyOpenSSL.SSL.TLSv1_1_METHOD
  message: |
    An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions
    are considered weak encryption and are deprecated.
    Use 'ssl.PROTOCOL_TLSv1_2' or higher.
  metadata:
    cwe: 'CWE-326: Inadequate Encryption Strength'
    owasp: 'A3: Sensitive Data Exposure'
    source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/insecure_ssl_tls.py#L30
    references:
    - https://tools.ietf.org/html/rfc7568
    - https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html
    - https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLSv1_2
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.audit.weak-ssl-version.weak-ssl-version
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load
  metadata:
    owasp: 'A8: Insecure Deserialization'
    cwe: 'CWE-502: Deserialization of Untrusted Data'
    references:
    - https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation
    - https://nvd.nist.gov/vuln/detail/CVE-2017-18342
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load
    semgrep.ruleset: r2c-security-audit
  languages:
  - python
  message: |
    Avoid using `load()`. `PyYAML.load` can create arbitrary Python
    objects. A malicious actor could exploit this to run arbitrary
    code. Use `safe_load()` instead.
  fix: yaml.safe_load($FOO)
  severity: ERROR
  patterns:
  - pattern-inside: |
      import yaml
      ...
      yaml.load($FOO)
  - pattern: yaml.load($FOO)
- id: python.lang.security.deserialization.pickle.avoid-cPickle
  metadata:
    owasp: 'A8: Insecure Deserialization'
    cwe: 'CWE-502: Deserialization of Untrusted Data'
    references:
    - https://docs.python.org/3/library/pickle.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-cPickle
    semgrep.ruleset: r2c-security-audit
  languages:
  - python
  message: |
    Avoid using `cPickle`, which is known to lead to code execution vulnerabilities.
    When unpickling, the serialized data could be manipulated to run arbitrary code.
    Instead, consider serializing the relevant data as JSON or a similar text-based
    serialization format.
  severity: WARNING
  pattern: cPickle.$FUNC(...)
- id: python.lang.security.deserialization.pickle.avoid-dill
  metadata:
    owasp: 'A8: Insecure Deserialization'
    cwe: 'CWE-502: Deserialization of Untrusted Data'
    references:
    - https://docs.python.org/3/library/pickle.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-dill
    semgrep.ruleset: r2c-security-audit
  languages:
  - python
  message: |
    Avoid using `dill`, which uses `pickle`, which is known to lead to code execution vulnerabilities.
    When unpickling, the serialized data could be manipulated to run arbitrary code.
    Instead, consider serializing the relevant data as JSON or a similar text-based
    serialization format.
  severity: WARNING
  pattern-either:
  - pattern: dill.$FUNC(...)
- id: python.lang.security.deserialization.pickle.avoid-pickle
  metadata:
    owasp: 'A8: Insecure Deserialization'
    cwe: 'CWE-502: Deserialization of Untrusted Data'
    references:
    - https://docs.python.org/3/library/pickle.html
    - https://davidhamann.de/2020/04/05/exploiting-python-pickle/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-pickle
    semgrep.ruleset: r2c-security-audit
  languages:
  - python
  message: |
    Avoid using `pickle`, which is known to lead to code execution vulnerabilities.
    When unpickling, the serialized data could be manipulated to run arbitrary code.
    Instead, consider serializing the relevant data as JSON or a similar text-based
    serialization format.
  severity: WARNING
  pattern-either:
  - pattern: pickle.$FUNC(...)
  - pattern: _pickle.$FUNC(...)
- id: python.lang.security.deserialization.pickle.avoid-shelve
  metadata:
    owasp: 'A8: Insecure Deserialization'
    cwe: 'CWE-502: Deserialization of Untrusted Data'
    references:
    - https://docs.python.org/3/library/pickle.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve
    semgrep.ruleset: r2c-security-audit
  languages:
  - python
  message: |
    Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities.
    When unpickling, the serialized data could be manipulated to run arbitrary code.
    Instead, consider serializing the relevant data as JSON or a similar text-based
    serialization format.
  severity: WARNING
  pattern-either:
  - pattern: shelve.$FUNC(...)
- id: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-md5
  pattern: hashlib.md5(...)
  message: |
    Detected MD5 hash algorithm which is considered insecure. MD5 is not
    collision resistant and is therefore not suitable as a cryptographic
    signature. Use SHA256 or SHA3 instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A3: Sensitive Data Exposure'
    bandit-code: B303
    references:
    - https://tools.ietf.org/html/rfc6151
    - https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision
    - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-md5
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - python
- id: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1
  pattern: hashlib.sha1(...)
  message: |
    Detected SHA1 hash algorithm which is considered insecure. SHA1 is not
    collision resistant and is therefore not suitable as a cryptographic
    signature. Use SHA256 or SHA3 instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A3: Sensitive Data Exposure'
    bandit-code: B303
    references:
    - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html
    - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability
    - http://2012.sharcs.org/slides/stevens.pdf
    - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - python
- id: python.lang.security.insecure-hash-function.insecure-hash-function
  patterns:
  - pattern-either:
    - pattern: hashlib.new("=~/[M|m][D|d][4|5]/", ...)
    - pattern: hashlib.new(..., name="=~/[M|m][D|d][4|5]/", ...)
  message: |
    Detected use of an insecure MD4 or MD5 hash function.
    These functions have known vulnerabilities and are considered deprecated.
    Consider using 'SHA256' or a similar function instead.
  metadata:
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A3: Sensitive Data Exposure'
    source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/hashlib_new_insecure_functions.py
    references:
    - https://tools.ietf.org/html/rfc6151
    - https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision
    - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.insecure-hash-function.insecure-hash-function
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: WARNING
- id: python.lang.security.unquoted-csv-writer.unquoted-csv-writer
  patterns:
  - pattern-not: csv.writer(..., quoting=csv.QUOTE_ALL, ...)
  - pattern: csv.writer(...)
  message: Found an unquoted CSV writer. This is susceptible to injection. Use 'quoting=csv.QUOTE_ALL'.
  metadata:
    cwe: 'CWE-1236: Improper Neutralization of Formula Elements in a CSV File'
    owasp: 'A1: Injection'
    references:
    - https://affinity-it-security.com/how-to-prevent-csv-injection/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.unquoted-csv-writer.unquoted-csv-writer
    semgrep.ruleset: r2c-security-audit
  fix-regex:
    regex: (.*)\)
    replacement: \1, quoting=csv.QUOTE_ALL)
  languages: [python]
  severity: ERROR
- id: python.lang.security.unverified-ssl-context.unverified-ssl-context
  pattern: ssl._create_unverified_context(...)
  message: |
    Unverified SSL context detected. This will permit insecure connections without verifying
    SSL certificates. Use 'ssl.create_default_context()' instead.
  metadata:
    owasp: 'A6: Security Misconfiguration'
    cwe: 'CWE-295: Improper Certificate Validation'
    references:
    - https://docs.python.org/3/library/ssl.html#ssl-security
    - https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.unverified-ssl-context.unverified-ssl-context
    semgrep.ruleset: r2c-security-audit
  severity: ERROR
  languages:
  - python
- id: python.lang.security.use-defused-xml.use-defused-xml
  pattern-either:
  - pattern: import xml
  - pattern: import lxml
  fix-regex:
    regex: (xml|lmxl)
    replacement: defusedxml
  metadata:
    owasp: 'A4: XML External Entities (XXE)'
    cwe: 'CWE-611: Improper Restriction of XML External Entity Reference'
    references:
    - https://docs.python.org/3/library/xml.html
    - https://github.com/tiran/defusedxml
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.use-defused-xml.use-defused-xml
    semgrep.ruleset: r2c-security-audit
  message: |
    Found use of the native Python XML libraries, which is vulnerable to XML external entity (XXE)
    attacks. The Python documentation recommends the 'defusedxml' library instead. Use 'defusedxml'.
    See https://github.com/tiran/defusedxml for more information.
  languages: [python]
  severity: ERROR
- id: python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc
  pattern-either:
  - pattern: import xmlrpclib
  - pattern: import SimpleXMLRPCServer
  # Python 3
  - pattern: import xmlrpc
  message: |
    Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities.
    Use defusedxml.xmlrpc instead.
  metadata:
    cwe: "CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML\
      \ Entity Expansion')"
    owasp: 'A4: XML External Entities (XXE)'
    source-rule-url: https://github.com/PyCQA/bandit/blob/07f84cb5f5e7c1055e6feaa0fe93afa471de0ac3/bandit/blacklists/imports.py#L160
    references:
    - https://pypi.org/project/defusedxml/
    - https://docs.python.org/3/library/xml.html#xml-vulnerabilities
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc
    semgrep.ruleset: r2c-security-audit
  severity: ERROR
  languages:
  - python
- id: python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-blowfish
  patterns:
  - pattern-either:
    - pattern: Cryptodome.Cipher.Blowfish.new(...)
    - pattern: Crypto.Cipher.Blowfish.new(...)
  message: |
    Detected Blowfish cipher algorithm which is considered insecure. The algorithm has many
    known vulnerabilities. Use AES instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A3: Sensitive Data Exposure'
    bandit-code: B304
    references:
    - https://sweet32.info/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-blowfish
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - python
- id: python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-des
  patterns:
  - pattern-either:
    - pattern: Cryptodome.Cipher.DES.new(...)
    - pattern: Crypto.Cipher.DES.new(...)
  message: |
    Detected DES cipher algorithm which is considered insecure. The algorithm is
    considered weak and has been deprecated. Use AES instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A3: Sensitive Data Exposure'
    bandit-code: B304
    references:
    - https://tools.ietf.org/html/rfc5469
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-des
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - python
- id: python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-rc2
  patterns:
  - pattern-either:
    - pattern: Cryptodome.Cipher.ARC2.new(...)
    - pattern: Crypto.Cipher.ARC2.new
  message: |
    Detected RC2 cipher algorithm which is considered insecure. The algorithm has known vulnerabilities and is difficult to use securely. Use AES instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A3: Sensitive Data Exposure'
    bandit-code: B304
    references:
    - https://security.stackexchange.com/questions/93924/is-rc2-cbc-at-all-secure
    - https://sweet32.info/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-rc2
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - python
- id: python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-rc4
  patterns:
  - pattern-either:
    - pattern: Cryptodome.Cipher.ARC4.new(...)
    - pattern: Crypto.Cipher.ARC4.new(...)
  message: |
    Detected RC4 cipher algorithm which is considered insecure. The algorithm has many
    known vulnerabilities. Use AES instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A3: Sensitive Data Exposure'
    bandit-code: B304
    references:
    - https://crypto.stackexchange.com/questions/853/google-is-using-rc4-but-isnt-rc4-considered-unsafe
    - https://sweet32.info/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-rc4
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - python
- id: python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor
  patterns:
  - pattern-either:
    - pattern: Cryptodome.Cipher.XOR.new(...)
    - pattern: Crypto.Cipher.XOR.new(...)
  message: |
    Detected XOR cipher algorithm which is considered insecure. This algorithm
    is not cryptographically secure and can be reversed easily. Use AES instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A3: Sensitive Data Exposure'
    bandit-code: B304
    references:
    - https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - python
- id: python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-md2
  patterns:
  - pattern-either:
    - pattern: Crypto.Hash.MD2.new(...)
    - pattern: Cryptodome.Hash.MD2.new (...)
  message: |
    Detected MD2 hash algorithm which is considered insecure. This algorithm
    has many known vulnerabilities and has been deprecated. Use SHA256 or SHA3 instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A3: Sensitive Data Exposure'
    references:
    - https://tools.ietf.org/html/rfc6149
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2409
    - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-md2
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - python
- id: python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-md4
  patterns:
  - pattern-either:
    - pattern: Crypto.Hash.MD4.new(...)
    - pattern: Cryptodome.Hash.MD4.new (...)
  message: |
    Detected MD4 hash algorithm which is considered insecure. This algorithm
    has many known vulnerabilities and has been deprecated. Use SHA256 or SHA3 instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A3: Sensitive Data Exposure'
    references:
    - https://tools.ietf.org/html/rfc6150
    - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-md4
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - python
- id: python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-md5
  patterns:
  - pattern-either:
    - pattern: Crypto.Hash.MD5.new(...)
    - pattern: Cryptodome.Hash.MD5.new (...)
  message: |
    Detected MD5 hash algorithm which is considered insecure. MD5 is not
    collision resistant and is therefore not suitable as a cryptographic
    signature. Use SHA256 or SHA3 instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A3: Sensitive Data Exposure'
    references:
    - https://tools.ietf.org/html/rfc6151
    - https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision
    - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-md5
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - python
- id: python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1
  patterns:
  - pattern-either:
    - pattern: Crypto.Hash.SHA.new(...)
    - pattern: Cryptodome.Hash.SHA.new (...)
  message: |
    Detected SHA1 hash algorithm which is considered insecure. SHA1 is not
    collision resistant and is therefore not suitable as a cryptographic
    signature. Use SHA256 or SHA3 instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A3: Sensitive Data Exposure'
    references:
    - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html
    - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability
    - http://2012.sharcs.org/slides/stevens.pdf
    - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - python
- id: python.requests.security.disabled-cert-validation.disabled-cert-validation
  patterns:
  - pattern-either:
    - pattern: requests.put(..., verify=False, ...)
    - pattern: requests.patch(..., verify=False, ...)
    - pattern: requests.delete(..., verify=False, ...)
    - pattern: requests.head(..., verify=False, ...)
    - pattern: requests.options(..., verify=False, ...)
    - pattern: requests.request(..., verify=False, ...)
    - pattern: requests.get(..., verify=False, ...)
    - pattern: requests.post(..., verify=False, ...)
  message: |
    Certificate verification has been explicitly disabled. This
    permits insecure connections to insecure servers. Re-enable
    certification validation.
  metadata:
    cwe: 'CWE-295: Improper Certificate Validation'
    owasp: 'A3: Sensitive Data Exposure'
    references:
    - https://stackoverflow.com/questions/41740361/is-it-safe-to-disable-ssl-certificate-verification-in-pythonss-requests-lib
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.requests.security.disabled-cert-validation.disabled-cert-validation
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: ERROR
- id: python.requests.security.no-auth-over-http.no-auth-over-http
  patterns:
  - pattern-either:
    - pattern: requests.$W("=~/http:\/\/.*/", ..., auth=$X, ...)
    - pattern: |
        $URL = "=~/http:\/\/.../"
        ...
        requests.$W($URL, ..., auth=$X, ...)
  fix-regex:
    regex: http:\/\/
    replacement: https://
    count: 1
  message: |
    Authentication detected over HTTP. HTTP does not provide any
    encryption or protection for these authentication credentials.
    This may expose these credentials to unauthhorized parties.
    Use 'https://' instead.
  metadata:
    cwe: 'CWE-523: Unprotected Transport of Credentials'
    owasp: 'A2: Broken Authentication'
    source-rule-url: https://pypi.org/project/flake8-flask/
    references:
    - https://blog.r2c.dev/2020/bento-check-no-auth-over-http/
    - https://bento.dev/checks/requests/no-auth-over-http/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/python.requests.security.no-auth-over-http.no-auth-over-http
    semgrep.ruleset: r2c-security-audit
  languages: [python]
  severity: ERROR
- id: ruby.lang.security.no-eval.ruby-eval
  patterns:
  - pattern-either:
    - pattern: eval(...)
    - pattern: |
        $CLASS.class_eval do
          ...
        end
    - pattern: |
        $CLASS.instance_eval do
          ...
        end
    - pattern: |
        $CLASS.module_eval do
          ...
        end
    - pattern: |
        $CLASS.class_eval(...)
    - pattern: |
        $CLASS.instance_eval(...)
    - pattern: |
        $CLASS.module_eval(...)
  message: |
    Use of eval detected. This can run arbirary code. Ensure external data
    does not reach here, otherwise this is a security vulnerability.
    Consider other ways to do this without eval.
  languages: [ruby]
  severity: WARNING
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ruby.lang.security.no-eval.ruby-eval
    semgrep.ruleset: r2c-security-audit
- id: ruby.lang.security.filter-skipping.filter-skipping
  patterns:
  - pattern-not: |
      $CALL "=~/.*(/:action.*).*/", $ACTION
  - pattern: |
      $CALL "=~/.*(/:action.*).*/"
  message: |
    Checks for use of action in Ruby routes. This can cause Rails to render an arbitrary view if an
    attacker creates an URL accurately. Affects 3.0 applications. Can avoid the vulnerability by providing
    additional constraints.
  metadata:
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_filter_skipping.rb
    - https://groups.google.com/g/rubyonrails-security/c/NCCsca7TEtY
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ruby.lang.security.filter-skipping.filter-skipping
    semgrep.ruleset: r2c-security-audit
  languages:
  - ruby
  severity: ERROR
- id: ruby.lang.security.bad-deserialization.bad-deserialization
  patterns:
  - pattern-either:
    - pattern: |
        YAML.load(...)
    - pattern: |
        CSV.load(...)
    - pattern: |
        Marshal.load(...)
    - pattern: |
        Marshal.restore(...)
    - pattern: |
        $OBJ.object_load(...)
  - pattern-not: |
      YAML.load(..., safe: true, ...)
  message: |
    Checks for unsafe deserialization. Objects in Ruby can be serialized into strings,
    then later loaded from strings. However, uses of load and object_load can cause remote code execution.
    Loading user input with YAML, MARSHAL, or CSV can potentially be dangerous. Use JSON securely instead.
  metadata:
    references:
    - https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ruby.lang.security.bad-deserialization.bad-deserialization
    semgrep.ruleset: r2c-security-audit
  languages:
  - ruby
  severity: ERROR
- id: ruby.lang.security.divide-by-zero.divide-by-zero
  patterns:
  - pattern-either:
    - pattern: |
        $X / 0
    - pattern: |
        $ZERO = 0
        ...
        $X / $ZERO
  message: |
    Checks for divide by zero. Best practice involves not dividing a variable by zero, as this leads to a Ruby
    ZeroDivisionError.
  metadata:
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_divide_by_zero.rb
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ruby.lang.security.divide-by-zero.divide-by-zero
    semgrep.ruleset: r2c-security-audit
  languages:
  - ruby
  severity: WARNING
- id: ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller
  pattern: |
    class $CONTROLLER < ApplicationController
      ...
      http_basic_authenticate_with ..., :password => "...", ...
    end
  message: |
    Detected hardcoded password used in basic authentication in a controller
    class. Including this password in version control could expose this
    credential. Consider refactoring to use environment variables or
    configuration files.
  severity: ERROR
  metadata:
    cwe: 'CWE-798: Use of Hard-coded Credentials'
    owasp: 'A3: Sensitive Data Exposure'
    source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/basic_auth/index.markdown
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller
    semgrep.ruleset: r2c-security-audit
  languages:
  - ruby
- id: ruby.lang.security.force-ssl-false.force-ssl-false
  patterns:
  - pattern: |
      config.force_ssl = false
  message: |
    Checks for configuration setting of force_ssl to false. Force_ssl forces usage of HTTPS, which
    could lead to network interception of unencrypted application traffic. To fix, set config.force_ssl = true.
  metadata:
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_force_ssl.rb
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ruby.lang.security.force-ssl-false.force-ssl-false
    semgrep.ruleset: r2c-security-audit
  languages:
  - ruby
  severity: WARNING
- id: ruby.lang.security.cookie-serialization.cookie-serialization
  patterns:
  - pattern-either:
    - pattern: |
        Rails.application.config.action_dispatch.cookies_serializer = :marshal
    - pattern: |
        Rails.application.config.action_dispatch.cookies_serializer = :hybrid
  message: |
    Checks if code allows cookies to be deserialized using Marshal. If the attacker can craft a valid cookie, this could lead to
    remote code execution. The hybrid check is just to warn users to migrate to :json for best practice.
  metadata:
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_cookie_serialization.rb
    - https://robertheaton.com/2013/07/22/how-to-hack-a-rails-app-using-its-secret-token/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ruby.lang.security.cookie-serialization.cookie-serialization
    semgrep.ruleset: r2c-security-audit
  languages:
  - ruby
  severity: ERROR
- id: ruby.lang.security.file-disclosure.file-disclosure
  patterns:
  - pattern: |
      config.serve_static_assets = true
  message: |
    Special requests can determine whether a file exists on a filesystem that's outside the Ruby app's
    root directory. To fix this, set config.serve_static_assets = false.
  metadata:
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_file_disclosure.rb
    - https://groups.google.com/g/rubyonrails-security/c/23fiuwb1NBA/m/MQVM1-5GkPMJ
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ruby.lang.security.file-disclosure.file-disclosure
    semgrep.ruleset: r2c-security-audit
  languages:
  - ruby
  severity: ERROR
- id: ruby.lang.security.create-with.create-with
  patterns:
  - pattern-not: |
      $FUNC.create_with($PARAMSB.permit(...))
  - pattern: |
      $FUNC.create_with($PARAMSA)
  message: |
    Checks for strong parameter bypass through usage of create_with. Create_with bypasses strong parameter protection, which
    could allow attackers to set arbitrary attributes on models. To fix this vulnerability, either remove all create_with calls
    or use the permit function to specify tags that are allowed to be set.
  metadata:
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_create_with.rb
    - https://groups.google.com/g/rubyonrails-security/c/M4chq5Sb540/m/CC1Fh0Y_NWwJ
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ruby.lang.security.create-with.create-with
    semgrep.ruleset: r2c-security-audit
  languages:
  - ruby
  severity: ERROR
- id: ruby.lang.security.no-send.bad-send
  patterns:
  - pattern-either:
    - pattern: |
        $PARAM = params[...]
        ...
        $RES = $MOD.send($PARAM.$FUNC)
    - pattern: |
        $PARAM = params[...]
        ...
        $RES = $MOD.try($PARAM.$FUNC)
    - pattern: |
        $PARAM = params[...]
        ...
        $RES = $MOD.__send__($PARAM.$FUNC)
    - pattern: |
        $PARAM = params[...]
        ...
        $RES = $MOD.public_send($PARAM.$FUNC)
  message: |
    Checks for unsafe use of Object#send, try, __send__, and public_send. These only account for unsafe
    use of a method, not target. This can lead to arbitrary calling of exit, along with arbitrary code     execution.
    Please be sure to sanitize input in order to avoid this.
  metadata:
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_send.rb
    - https://the.igreque.info/posts/2016/01-object-send-considered-harmful-en.html
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ruby.lang.security.no-send.bad-send
    semgrep.ruleset: r2c-security-audit
  languages:
  - ruby
  severity: ERROR
- id: ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled
  pattern: $MODEL.new(params[...], ..., :without_protection => true, ...)
  message: |
    Mass assignment protection disabled for '$MODEL'. This could
    permit assignment to sensitive model fields without intention. Instead,
    use 'attr_accessible' for the model or disable mass assigment using
    'config.active_record.whitelist_attributes = true'.
    ':without_protection => true' must be removed for this to take effect.
  metadata:
    cwe: 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object
      Attributes'
    owasp: 'A1: Injection'
    source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/mass_assignment/index.markdown
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ruby.lang.security.mass-assignment-protection-disabled.mass-assignment-protection-disabled
    semgrep.ruleset: r2c-security-audit
  severity: WARNING
  languages:
  - ruby
- id: ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify
  pattern: OpenSSL::SSL::VERIFY_NONE
  message: |
    Detected SSL that will accept an unverified connection.
    This makes the connections susceptible to man-in-the-middle attacks.
    Use 'OpenSSL::SSL::VERIFY_PEER' intead.
  fix-regex:
    regex: VERIFY_NONE
    replacement: VERIFY_PEER
  severity: WARNING
  languages:
  - ruby
  metadata:
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify
    semgrep.ruleset: r2c-security-audit
- id: ruby.lang.security.timing-attack.timing-attack
  patterns:
  - pattern: |
      http_basic_authenticate_with ...
  message: |
    Checks for unsafe use of method http_basic_authenticate_with, which is vulnerable to timing attacks as it
    does not use constant-time checking when comparing passwords. Affected Rails versions include:
    5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1. Avoid this function if possible.
  metadata:
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_basic_auth_timing_attack.rb
    - https://groups.google.com/g/rubyonrails-security/c/ANv0HDHEC3k/m/mt7wNGxbFQAJ
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ruby.lang.security.timing-attack.timing-attack
    semgrep.ruleset: r2c-security-audit
  languages:
  - ruby
  severity: ERROR
- id: ruby.lang.security.missing-csrf-protection.missing-csrf-protection
  patterns:
  - pattern: |
      class $CONTROLLER < ActionController::Base
        ...
      end
  - pattern-not: |
      class $CONTROLLER < ActionController::Base
        ...
        protect_from_forgery :with => :exception
      end
  - pattern-not: |
      class $CONTROLLER < ActionController::Base
        ...
        protect_from_forgery prepend: true, with: :exception
      end
  message: |
    Detected controller which does not enable cross-site request forgery
    protections using 'protect_from_forgery'. Add
    'protect_from_forgery :with => :exception' to your controller class.
  severity: ERROR
  metadata:
    cwe: 'CWE-352: Cross-Site Request Forgery (CSRF)'
    owasp: 'A6: Security Misconfiguration'
    source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/cross-site_request_forgery/index.markdown
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ruby.lang.security.missing-csrf-protection.missing-csrf-protection
    semgrep.ruleset: r2c-security-audit
  languages:
  - ruby
- id: ruby.lang.security.weak-hashes-md5.weak-hashes-md5
  patterns:
  - pattern-either:
    - pattern: Digest::MD5.base64digest $X
    - pattern: Digest::MD5.hexdigest $X
    - pattern: Digest::MD5.digest $X
    - pattern: Digest::MD5.new
    - pattern: OpenSSL::Digest::MD5.base64digest $X
    - pattern: OpenSSL::Digest::MD5.hexdigest $X
    - pattern: OpenSSL::Digest::MD5.digest $X
    - pattern: OpenSSL::Digest::MD5.new
  message: |
    Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks.
    Could also result in collisions,leading to potential collision attacks. Use SHA256 or other hashing functions instead.
  metadata:
    references:
    - https://www.ibm.com/support/pages/security-bulletin-vulnerability-md5-signature-and-hash-algorithm-affects-sterling-integrator-and-sterling-file-gateway-cve-2015-7575
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ruby.lang.security.weak-hashes-md5.weak-hashes-md5
    semgrep.ruleset: r2c-security-audit
  languages:
  - ruby
  severity: WARNING
- id: ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1
  patterns:
  - pattern-either:
    - pattern: Digest::SHA1.$FUNC $X
    - pattern: Digest::SHA1.$FUNC
    - pattern: OpenSSL::Digest::SHA1.$FUNC $X
    - pattern: OpenSSL::Digest::SHA1.$FUNC
    - pattern: OpenSSL::HMAC.$FUNC("sha1",...)
  message: |
    Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities.
    Use SHA256, SHA3 or other hashing functions instead.
  metadata:
    references:
    - https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html
    - https://shattered.io/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1
    semgrep.ruleset: r2c-security-audit
  languages:
  - ruby
  severity: WARNING
- id: ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln
  patterns:
  - pattern-either:
    - pattern: |
        $MOD.new(params[$CODE])
    - pattern: |
        $MOD.new(..., params[$CODE], :without_protection => true, ...)
  - pattern-not-inside: |
      attr_accessible $VAR
      ...
      $MOD.new(params[$CODE])
  message: |
    Checks for calls to without_protection during mass assignment (which allows record creation from hash values).
    This can lead to users bypassing permissions protections. For Rails 4 and higher, mass protection is on by default.
    Fix: Don't use :without_protection => true. Instead, configure attr_acessible to control attribute access.
  metadata:
    owasp: 'A1: Injection'
    cwe: 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object
      Attributes'
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_without_protection.rb
    - https://www.acunetix.com/vulnerabilities/web/rails-mass-assignment/
    dev.semgrep.actions: *id001
    semgrep.policy:
      id: 973
      name: Golang Apps
      slug: golang-apps
    semgrep.url: https://semgrep.dev/r/ruby.lang.security.unprotected-mass-assign.mass-assignment-vuln
    semgrep.ruleset: r2c-security-audit
  languages:
  - ruby
  severity: WARNING